registry / quantex-cli / 0.28.1

quantex-cli@0.28.1

⚠ Under review

Agent-friendly lifecycle CLI for AI coding assistant CLIs: install, inspect, update, uninstall, run, and automate Codex, Claude Code, Gemini, Cursor, OpenCode, and more

Static Scan Results

scanned 5h ago · by rust-scanner

Static analysis flagged 7 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessNetwork

Supply chain

MinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 30 file(s), 161 KB of source, external domains: ampcode.com, antigravity.google, api.github.com, app.factory.ai, autohand.ai, claude.ai, cli.devin.ai, cli.kiro.dev, code.claude.com, code.kimi.com, commandcode.ai, cursor.com, developers.openai.com, docs.augmentcode.com, docs.factory.ai, docs.mistral.ai, docs.openhands.dev, docs.qoder.com, forgecode.dev, gh.io, github.com, google-gemini.github.io, hermes-agent.nousresearch.com, install.openhands.dev, jsr.io, junie.jetbrains.com, kilo.ai, kiro.dev, mimo.xiaomi.com, mistral.ai, moonshotai.github.io, omp.sh, openclaw.ai, opencode.ai, pi.dev, qoder.com, qwen-code-assets.oss-cn-hangzhou.aliyuncs.com, qwenlm.github.io, raw.githubusercontent.com, registry.npmjs.org, static.devin.ai, www.codebuddy.cn

Source & flagged code

3 flagged

dist/color-DQ26gyy0.mjsView file

Lines 1-7javascript

1import{createHash as e,randomUUID as t}from"node:crypto";import n from"node:process";import{existsSync as r,mkdirSync as i,writeFileSync as a}from"node:fs";import{chmod as o,mkdir as s,mkdtemp as c,readFile as l,realpath as u,rename as d,rm as f,stat as p,writeFile as m}from"node:fs/promises";import{basename as h,dirname as g,join as _,win32 as v}from"node:path";import{homedir as ee}from"node:os";import{spawn as te}from"node:child_process";import{text as ne}from"node:stream/consumers";import{fileURLToPath as re}from"node:url";import{Buffer as ie}from"node:buffer";import ae from"picocolors";con ...

2`)[0],r=n.match(wt);return r?r[1]:n||void 0}function Et(e,t){let n=kt(e),r=kt(t);if(!(!n||!r)){for(let e=0;e<3;e+=1){let t=n.core[e]-r.core[e];if(t!==0)return t>0?1:-1}return At(n.prerelease,r.prerelease)}}function H(e,t){return Et(e,t)===1}async function U(e,t){let n=t?.command??[e,`--version`];try{let{exitCode:e,stdout:r}=await R(L(n));return e===0?Tt(r,t?.parser):void 0}catch{return}}async function W(e,t=`latest`,n={}){try{let r=E(n.registry)??`https://registry.npmjs.org`;return(await B(We(e,t,r),`npm:${r}:${e}:${t}`))?.version}catch{return}}async function Dt(e){try{let{exitCode:t,stdout:r} ...

High

Child Process

Package source references child process execution.

dist/color-DQ26gyy0.mjsView on unpkg · L1

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/color-DQ26gyy0.mjsView on unpkg · L1

3`)[0]:void 0}catch{return}}async function Ot(e){if(e)try{return await u(e)}catch{return e}}function kt(e){let t=e.trim().match(/^v?(\d+)\.(\d+)\.(\d+)(?:-([0-9a-z.-]+))?$/i);if(t)return{core:[Number(t[1]),Number(t[2]),Number(t[3])],prerelease:t[4]?t[4].split(`.`):[]}}function At(e,t){if(e.length===0&&t.length===0)return 0;if(e.length===0)return 1;if(t.length===0)return-1;let n=Math.max(e.length,t.length);for(let r=0;r<n;r+=1){let n=e[r],i=t[r];if(n===void 0)return-1;if(i===void 0)return 1;if(n===i)continue;let a=/^\d+$/.test(n),o=/^\d+$/.test(i);return a&&o?Number(n)>Number(i)?1:-1:a?-1:o||n>i ...

4`).map(e=>e.trim());for(let e=t.length-1;e>=0;--e){let n=t[e];if(!n||n.startsWith(`#`)||n.startsWith(`;`))continue;let r=n.match(/^registry\s*=\s*(.+)$/);if(!r?.[1])continue;let i=E(r[1]);if(i)return i}}catch{}}function wn(e,t){let n=e;for(;;){let e=_(n,t);if(r(e))return e;let i=g(n);if(i===n)return;n=i}}function Tn(e){return e.HOME||e.USERPROFILE||ee()}function En(e){let t=Dn(e,[/(?:^|\n)\s*install\.registry\s*=\s*["']([^"'#\n]+)["']/,/(?:^|\n)\s*install\.registry\s*=\s*\{\s*url\s*=\s*["']([^"'#\n]+)["']/,/(?:^|\n)\s*install\s*=\s*\{[\s\S]*?\bregistry\s*=\s*["']([^"'#\n]+)["'][\s\S]*?\}/,/(?: ...

5`).some(e=>e.trim().split(/\s+/).at(-1)?.startsWith(n))}function tr(e,t){let n=`${t}@`;for(let t of e.split(`

6`)){let e=t.trim().split(/\s+/).at(-1);if(!e?.startsWith(n))continue;let r=e.slice(n.length);if(r)return r}}async function nr(e,t){if(await I(F(e))!==0)return!1;let n=await ir(t);return!n&&e[1]===`add`&&await rr(t),n}async function rr(e){for(let t of new Set(e))try{await I(F([`bun`,`remove`,`-g`,t]))}catch{}}async function ir(e){let t=[...new Set(e)];if(t.length===0)return!0;let n=await ar();if(n===void 0)return!1;let r=or(n),i=t.filter(e=>r.has(e));return i.length===0?!0:await I(F([`bun`,`pm`,`-g`,`trust`,...i]))===0}async function ar(){try{let{exitCode:e,stdout:t}=await R(L([`bun`,`pm`,`-g`, ...

7`)){let e=n.replaceAll(`\\`,`/`).match(/^\.\/node_modules\/(.+?) @/);e?.[1]&&t.add(e[1])}return t}function sr(){return[`ignore`,`pipe`,`ignore`]}const cr={source:`bun`,canHandle:e=>lr(e)===`bun`,getRecoveryHint:e=>`bun add -g ${N}@${e.updateChannel===`beta`?`beta`:`latest`}`,async upgrade(e){let t=await qn(N,e.target.packageTag??(e.facts.updateChannel===`beta`?`beta`:`latest`),e.target.managedRegistry);return{error:t?void 0:{kind:`unknown`,message:`Failed to update ${N} through Bun.`},installSource:e.facts.installSource,newVersion:t?e.target.targetVersion:void 0,success:t}}};function lr(e){ret ...

Long lines were clipped for display.

•matchType = previous_version_dangerous_delta matchedPackage = quantex-cli@0.25.10 matchedIdentity = npm:cXVhbnRleC1jbGk:0.25.10 similarity = 0.867 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/color-DQ26gyy0.mjsView on unpkg

Source & flagged code

3 flagged · loading source

dist/color-DQ26gyy0.mjsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/color-DQ26gyy0.mjsView on unpkg

1import{createHash as e,randomUUID as t}from"node:crypto";import n from"node:process";import{existsSync as r,mkdirSync as i,writeFileSync as a}from"node:fs";import{chmod as o,mkdir ... L2: `)[0],r=n.match(wt);return r?r[1]:n||void 0}function Et(e,t){let n=kt(e),r=kt(t);if(!(!n||!r)){for(let e=0;e<3;e+=1){let t=n.core[e]-r.core[e];if(t!==0)return t>0?1:-1}return At(n....

High

Child Process

Package source references child process execution.

dist/color-DQ26gyy0.mjsView on unpkg · L1

1import{createHash as e,randomUUID as t}from"node:crypto";import n from"node:process";import{existsSync as r,mkdirSync as i,writeFileSync as a}from"node:fs";import{chmod as o,mkdir ... L2: `)[0],r=n.match(wt);return r?r[1]:n||void 0}function Et(e,t){let n=kt(e),r=kt(t);if(!(!n||!r)){for(let e=0;e<3;e+=1){let t=n.core[e]-r.core[e];if(t!==0)return t>0?1:-1}return At(n....

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/color-DQ26gyy0.mjsView on unpkg · L1

Findings

1 Critical2 High1 Medium3 Low

CriticalPrevious Version Dangerous Deltadist/color-DQ26gyy0.mjs

HighChild Processdist/color-DQ26gyy0.mjs

HighCommand Output Exfiltrationdist/color-DQ26gyy0.mjs

MediumNetwork

LowNon Install Lifecycle Scripts

LowScripts Present

LowUrl Strings

Source & flagged code

3 flagged

dist/color-DQ26gyy0.mjsView file

Lines 1-7javascript

High

Child Process

Package source references child process execution.

dist/color-DQ26gyy0.mjsView on unpkg · L1

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/color-DQ26gyy0.mjsView on unpkg · L1

5`).some(e=>e.trim().split(/\s+/).at(-1)?.startsWith(n))}function tr(e,t){let n=`${t}@`;for(let t of e.split(`

Long lines were clipped for display.

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/color-DQ26gyy0.mjsView on unpkg