registry / quackstack / 2.0.0

quackstack@2.0.0

Your cracked unpaid intern for all things codebase related! AI-powered codebase search and Q&A.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 19 file(s), 101 KB of source, external domains: agents.md, api.deepseek.com, api.mistral.ai, api.pinference.ai, api.x.ai

Source & flagged code

3 flagged

package.jsonView file

Lines 2-47json

2 "name": "quackstack",

3 "version": "2.0.0",

4 "description": "Your cracked unpaid intern for all things codebase related! AI-powered codebase search and Q&A.",

5 "type": "module",

6 "main": "dist/cli.cjs",

Source & flagged code

3 flagged · loading source

package.jsonView file

•scripts.postinstall = prisma generate

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•Runtime dependency names matching Node built-ins: crypto

High

Node Builtin Dependency Squat

Package declares a runtime dependency whose name matches a Node built-in module.

package.jsonView on unpkg

dist/lib/local-search.jsView file

1import crypto from "crypto"; L2: export class LocalEmbeddings {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/lib/local-search.jsView on unpkg · L1

Findings

2 High2 Medium6 Low

HighInstall Time Lifecycle Scriptspackage.json

HighNode Builtin Dependency Squatpackage.json

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowWeak Cryptodist/lib/local-search.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

dist/lib/local-search.jsView file

Lines 1-21javascript

1import crypto from "crypto";

2export class LocalEmbeddings {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/lib/local-search.jsView on unpkg · L1

3 idf = new Map();

4 documents = [];

5 tokenize(text) {

6 return text

7 .toLowerCase()

8 .replace(/[^a-z0-9_\s]/g, " ")

9 .split(/\s+/)

10 .filter(t => t.length > 2);

11 }

12 computeTF(tokens) {

13 const tf = new Map();

14 tokens.forEach(token => {

15 tf.set(token, (tf.get(token) || 0) + 1);

16 });

17 tokens.forEach(token => {

18 tf.set(token, tf.get(token) / tokens.length);

19 });

20 return tf;

21 }