registry / pockcode / 0.0.13

pockcode@0.0.13

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

Manifest

NoLicense

scanned 21 file(s), 1.41 MB of source, external domains: base-ui.com, cdn.jsdelivr.net, github.com, react.dev, socket.io, www.w3.org

Source & flagged code

4 flagged

package.jsonView file

Lines 7-47json

7 "url": "git+https://github.com/monokaijs/pockcode.git"

8 },

9 "engines": {

10 "node": ">=20.0.0"

11 },

12 "bin": {

13 "pockcode": "./dist/pockcode.js"

14 },

15 "files": [

16 "build/client",

17 "dist",

18 "prisma/schema.prisma"

19 ],

20 "publishConfig": {

21 "registry": "https://registry.npmjs.org/"

22 },

23 "packageManager": "pnpm@10.17.1",

24 "scripts": {

25 "dev": "vite --host 0.0.0.0",

26 "build": "tsc -b && vite build --config vite.client.config.ts && vite build --config vite.cli.config.ts",

27 "postinstall": "prisma generate --schema=prisma/schema.prisma",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L27

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L27

28 "prepack": "npm run build",

29 "preview": "node dist/pockcode.js --host 0.0.0.0",

30 "test": "vitest run",

31 "test:real-codex": "node scripts/real-codex-smoke.mjs",

32 "typecheck": "tsc --noEmit"

33 },

34 "dependencies": {

35 "@base-ui/react": "^1.6.0",

36 "@fontsource-variable/geist": "^5.2.9",

37 "@monaco-editor/react": "^4.7.0",

38 "@openai/codex": "^0.142.5",

39 "@prisma/client": "^6.19.3",

40 "@react-router/dev": "^7.15.1",

41 "@xterm/addon-fit": "^0.11.0",

42 "@xterm/xterm": "^6.0.0",

43 "class-variance-authority": "^0.7.1",

44 "clsx": "^2.1.1",

45 "dotenv": "^17.4.2",

46 "grammy": "^1.44.0",

47 "lucide-react": "^1.21.0",

build/client/assets/geist-cyrillic-wght-normal-BEAKL7Jp.woff2View file

•path = build/client/assets/geist-cyrillic-wght-normal-BEAKL7Jp.woff2 kind = high_entropy_blob sizeBytes = 15084 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

build/client/assets/geist-cyrillic-wght-normal-BEAKL7Jp.woff2View on unpkg

dist/assets/codex.server-BcyfrKwc.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = pockcode@0.0.12 matchedIdentity = npm:cG9ja2NvZGU:0.0.12 similarity = 0.632 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/assets/codex.server-BcyfrKwc.jsView on unpkg

Source & flagged code

4 flagged · loading source

package.jsonView file

•scripts.postinstall = prisma generate --schema=prisma/schema.prisma

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = prisma generate --schema=prisma/schema.prisma

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

build/client/assets/geist-cyrillic-wght-normal-BEAKL7Jp.woff2View file

•path = build/client/assets/geist-cyrillic-wght-normal-BEAKL7Jp.woff2 kind = high_entropy_blob sizeBytes = 15084 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

build/client/assets/geist-cyrillic-wght-normal-BEAKL7Jp.woff2View on unpkg

dist/assets/codex.server-BcyfrKwc.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/assets/codex.server-BcyfrKwc.jsView on unpkg

Findings

3 High4 Medium6 Low

HighInstall Time Lifecycle Scriptspackage.json

HighShips High Entropy Blobbuild/client/assets/geist-cyrillic-wght-normal-BEAKL7Jp.woff2

HighPrevious Version Dangerous Deltadist/assets/codex.server-BcyfrKwc.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

4 flagged

package.jsonView file

Lines 7-47json

7 "url": "git+https://github.com/monokaijs/pockcode.git"

8 },

9 "engines": {

10 "node": ">=20.0.0"

11 },

12 "bin": {

13 "pockcode": "./dist/pockcode.js"

14 },

15 "files": [

16 "build/client",

17 "dist",

18 "prisma/schema.prisma"

19 ],

20 "publishConfig": {

21 "registry": "https://registry.npmjs.org/"

22 },

23 "packageManager": "pnpm@10.17.1",

24 "scripts": {

25 "dev": "vite --host 0.0.0.0",

26 "build": "tsc -b && vite build --config vite.client.config.ts && vite build --config vite.cli.config.ts",

27 "postinstall": "prisma generate --schema=prisma/schema.prisma",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L27

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L27

28 "prepack": "npm run build",

29 "preview": "node dist/pockcode.js --host 0.0.0.0",

30 "test": "vitest run",

31 "test:real-codex": "node scripts/real-codex-smoke.mjs",

32 "typecheck": "tsc --noEmit"

33 },

34 "dependencies": {

35 "@base-ui/react": "^1.6.0",

36 "@fontsource-variable/geist": "^5.2.9",

37 "@monaco-editor/react": "^4.7.0",

38 "@openai/codex": "^0.142.5",

39 "@prisma/client": "^6.19.3",

40 "@react-router/dev": "^7.15.1",

41 "@xterm/addon-fit": "^0.11.0",

42 "@xterm/xterm": "^6.0.0",

43 "class-variance-authority": "^0.7.1",

44 "clsx": "^2.1.1",

45 "dotenv": "^17.4.2",

46 "grammy": "^1.44.0",

47 "lucide-react": "^1.21.0",

build/client/assets/geist-cyrillic-wght-normal-BEAKL7Jp.woff2View file

•path = build/client/assets/geist-cyrillic-wght-normal-BEAKL7Jp.woff2 kind = high_entropy_blob sizeBytes = 15084 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

build/client/assets/geist-cyrillic-wght-normal-BEAKL7Jp.woff2View on unpkg

dist/assets/codex.server-BcyfrKwc.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/assets/codex.server-BcyfrKwc.jsView on unpkg