registry / pennyrouter / 0.1.15
pennyrouter@0.1.15
Install and manage PennyRouter local coding-agent integrations.
Static Scan Results
scanned 3mo ago · by rust-scannerStatic analysis flagged 8 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
One or more suspicious static signals were detected.
Decision evidence
public snapshotBehavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
1 flagged · loading sourcesrc/harnesses/codegpt.jsView file
1import { spawnSync } from "node:child_process";
L2:
...
L56: console.log(" Open CodeGPT settings and remove or replace the PennyRouter provider:");
L57: console.log(" - Base URL: https://api.pennyrouter.com/v1");
L58: console.log(" - API Key: pr-...");
...
L64: const commands =
L65: process.platform === "darwin"
L66: ? [["pbcopy"]]
L67: : process.platform === "win32"
High
Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
src/harnesses/codegpt.jsView on unpkg · L1Findings
1 High3 Medium4 Low
HighSandbox Evasion Gated Capabilitysrc/harnesses/codegpt.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to pennyrouter@0.1.15.
See all versions of pennyrouter for other recorded verdicts.
- Review the evidence and your use of pennyrouter@0.1.15 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.