registry / petbox-wire / 0.1.0-ci.803

petbox-wire@0.1.0-ci.803

Wire any project to PetBox (Claude Code, opencode, Factory Droid) — global hooks, MCP configs and skills — with a single npx command, no repo clone.

Static Scan Results

scanned 11d ago · by rust-scanner

Static analysis completed at 93.0% confidence. No malicious behavior was detected; 8 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 21 file(s), 164 KB of source, external domains: opencode.ai, petbox.3po.su, petbox.example

Source & flagged code

3 flagged

bin/petbox-wire.jsView file

Lines 1-31javascript

1#!/usr/bin/env node

2// Thin launcher for the PetBox agent-wiring kit.

3//

4// Plain JS (no TypeScript) so it still starts on an old Node and can print a clear

5// version error. The kit itself is plain TypeScript executed by Node's native

6// type-stripping, which needs Node >= 23.6.

8const [maj, min] = process.versions.node.split(".").map((n) => parseInt(n, 10));

9if (maj < 23 || (maj === 23 && min < 6)) {

10 console.error(

11 `petbox-wire needs Node >= 23.6 (native TypeScript type-stripping); you have ${process.versions.node}`,

12 );

13 process.exit(1);

14}

16// Node deliberately refuses to type-strip .ts files under node_modules

17// (ERR_UNSUPPORTED_NODE_MODULES_TYPE_STRIPPING), and the npx cache is exactly that — so the

18// kit cannot run in place. Copy it out to a temp dir and import from there; wire.ts then

19// installs the stable copy (~/.petbox/wire/) itself after validating the key.

20const { cpSync, mkdtempSync } = await import("node:fs");

21const { tmpdir } = await import("node:os");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/petbox-wire.jsView on unpkg · L19

22const { join, dirname } = await import("node:path");

23const { fileURLToPath, pathToFileURL } = await import("node:url");

25const srcDir = join(dirname(fileURLToPath(import.meta.url)), "..", "src");

26const runDir = mkdtempSync(join(tmpdir(), "petbox-wire-"));

27cpSync(srcDir, runDir, { recursive: true });

29// wire.ts runs main() at module top level, so importing it executes the CLI.

30await import(pathToFileURL(join(runDir, "wire.ts")).href);

src/posix-env.test.tsView file

Lines 15-55typescript

16function freshHome(): string {

17 return mkdtempSync(join(tmpdir(), "petbox-wire-test-"));

18}

20test

src/wire.tsView file

•matchType = previous_version_dangerous_delta matchedPackage = petbox-wire@0.1.0-ci.767 matchedIdentity = npm:cGV0Ym94LXdpcmU:0.1.0-ci.767 similarity = 0.905 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/wire.tsView on unpkg

Source & flagged code

3 flagged · loading source

bin/petbox-wire.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code