registry / quantex-cli / 0.25.6

quantex-cli@0.25.6

Agent-friendly lifecycle CLI for AI coding assistant CLIs: install, inspect, update, uninstall, run, and automate Codex, Claude Code, Gemini, Cursor, OpenCode, and more

Static Scan Results

scanned 6d ago · by rust-scanner

Static analysis flagged 6 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessNetwork

Supply chain

MinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 30 file(s), 157 KB of source, external domains: ampcode.com, antigravity.google, api.github.com, app.factory.ai, autohand.ai, claude.ai, cli.devin.ai, cli.kiro.dev, code.claude.com, code.kimi.com, cursor.com, developers.openai.com, docs.augmentcode.com, docs.factory.ai, docs.mistral.ai, docs.openhands.dev, docs.qoder.com, forgecode.dev, gh.io, github.com, google-gemini.github.io, install.openhands.dev, jsr.io, junie.jetbrains.com, kilo.ai, kiro.dev, mimo.xiaomi.com, mistral.ai, moonshotai.github.io, omp.sh, opencode.ai, pi.dev, qoder.com, qwen-code-assets.oss-cn-hangzhou.aliyuncs.com, qwenlm.github.io, raw.githubusercontent.com, registry.npmjs.org, static.devin.ai, www.codebuddy.cn

Source & flagged code

2 flagged

dist/color-BTJkJp6l.mjsView file

Lines 1-6javascript

1import{createHash as e,randomUUID as t}from"node:crypto";import n from"node:process";import{existsSync as r,mkdirSync as i,writeFileSync as a}from"node:fs";import{chmod as o,mkdir as s,mkdtemp as c,readFile as l,realpath as u,rename as d,rm as f,stat as p,writeFile as m}from"node:fs/promises";import{basename as h,dirname as g,join as _,win32 as v}from"node:path";import{homedir as ee}from"node:os";import{spawn as te}from"node:child_process";import{text as ne}from"node:stream/consumers";import{fileURLToPath as re}from"node:url";import{Buffer as ie}from"node:buffer";import ae from"picocolors";con ...

2`)[0],r=n.match(Tt);return r?r[1]:n||void 0}function Dt(e,t){let n=At(e),r=At(t);if(!(!n||!r)){for(let e=0;e<3;e+=1){let t=n.core[e]-r.core[e];if(t!==0)return t>0?1:-1}return jt(n.prerelease,r.prerelease)}}function B(e,t){return Dt(e,t)===1}async function V(e,t){let n=t?.command??[e,`--version`];try{let{exitCode:e,stdout:r}=await I(F(n));return e===0?Et(r,t?.parser):void 0}catch{return}}async function H(e,t=`latest`,n={}){try{let r=E(n.registry)??`https://registry.npmjs.org`;return(await R(Ue(e,t,r),`npm:${r}:${e}:${t}`))?.version}catch{return}}async function Ot(e){try{let{exitCode:t,stdout:r} ...

High

Child Process

Package source references child process execution.

dist/color-BTJkJp6l.mjsView on unpkg · L1

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/color-BTJkJp6l.mjsView on unpkg · L1

3`)[0]:void 0}catch{return}}async function kt(e){if(e)try{return await u(e)}catch{return e}}function At(e){let t=e.trim().match(/^v?(\d+)\.(\d+)\.(\d+)(?:-([0-9a-z.-]+))?$/i);if(t)return{core:[Number(t[1]),Number(t[2]),Number(t[3])],prerelease:t[4]?t[4].split(`.`):[]}}function jt(e,t){if(e.length===0&&t.length===0)return 0;if(e.length===0)return 1;if(t.length===0)return-1;let n=Math.max(e.length,t.length);for(let r=0;r<n;r+=1){let n=e[r],i=t[r];if(n===void 0)return-1;if(i===void 0)return 1;if(n===i)continue;let a=/^\d+$/.test(n),o=/^\d+$/.test(i);return a&&o?Number(n)>Number(i)?1:-1:a?-1:o||n>i ...

4`).map(e=>e.trim());for(let e=t.length-1;e>=0;--e){let n=t[e];if(!n||n.startsWith(`#`)||n.startsWith(`;`))continue;let r=n.match(

5`)){let e=t.trim().split(/\s+/).at(-1);if(!e?.startsWith(n))continue;let r=e.slice(n.length);if(r)return r}}async function Qn(e,t){if(await P(N(e))!==0)return!1;let n=await er(t);return!n&&e[1]===`add`&&await $n(t),n}async function $n(e){for(let t of new Set(e))try{await P(N([`bun`,`remove`,`-g`,t]))}catch{}}async function er(e){let t=[...new Set(e)];if(t.length===0)return!0;let n=await tr();if(n===void 0)return!1;let r=nr(n),i=t.filter(e=>r.has(e));return i.length===0?!0:await P(N([`bun`,`pm`,`-g`,`trust`,...i]))===0}async function tr(){try{let{exitCode:e,stdout:t}=await I(F([`bun`,`pm`,`-g`, ...

6`)){let e=n.replaceAll(`\\`,`/`).match(/^\.\/node_modules\/(.+?) @/);e?.[1]&&t.add(e[1])}return t}function rr(){return[`ignore`,`pipe`,`ignore`]}const ir={source:`bun`,canHandle:e

Long lines were clipped for display.

Source & flagged code

2 flagged · loading source

dist/color-BTJkJp6l.mjsView file

1import{createHash as e,randomUUID as t}from"node:crypto";import n from"node:process";import{existsSync as r,mkdirSync as i,writeFileSync as a}from"node:fs";import{chmod as o,mkdir ... L2: `)[0],r=n.match(Tt);return r?r[1]:n||void 0}function Dt(e,t){let n=At(e),r=At(t);if(!(!n||!r)){for(let e=0;e<3;e+=1){let t=n.core[e]-r.core[e];if(t!==0)return t>0?1:-1}return jt(n....

High

Child Process

Package source references child process execution.

dist/color-BTJkJp6l.mjsView on unpkg · L1

1import{createHash as e,randomUUID as t}from"node:crypto";import n from"node:process";import{existsSync as r,mkdirSync as i,writeFileSync as a}from"node:fs";import{chmod as o,mkdir ... L2: `)[0],r=n.match(Tt);return r?r[1]:n||void 0}function Dt(e,t){let n=At(e),r=At(t);if(!(!n||!r)){for(let e=0;e<3;e+=1){let t=n.core[e]-r.core[e];if(t!==0)return t>0?1:-1}return jt(n....

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/color-BTJkJp6l.mjsView on unpkg · L1

Findings

2 High1 Medium3 Low

HighChild Processdist/color-BTJkJp6l.mjs

HighCommand Output Exfiltrationdist/color-BTJkJp6l.mjs

MediumNetwork

LowNon Install Lifecycle Scripts

LowScripts Present

LowUrl Strings

Source & flagged code

2 flagged

dist/color-BTJkJp6l.mjsView file

Lines 1-6javascript

High

Child Process

Package source references child process execution.

dist/color-BTJkJp6l.mjsView on unpkg · L1

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/color-BTJkJp6l.mjsView on unpkg · L1

4`).map(e=>e.trim());for(let e=t.length-1;e>=0;--e){let n=t[e];if(!n||n.startsWith(`#`)||n.startsWith(`;`))continue;let r=n.match(

6`)){let e=n.replaceAll(`\\`,`/`).match(/^\.\/node_modules\/(.+?) @/);e?.[1]&&t.add(e[1])}return t}function rr(){return[`ignore`,`pipe`,`ignore`]}const ir={source:`bun`,canHandle:e

Long lines were clipped for display.