registry / recess-cli / 1.3.0

recess-cli@1.3.0

Safe Recess staff administration from the command line, for humans and coding agents.

Static Scan Results

scanned 1mo ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 12 file(s), 163 KB of source, external domains: 127.0.0.1, api.recess.gg, recess.gg

Source & flagged code

4 flagged

package.jsonView file

Lines 33-55json

33 "@typescript/native-preview": "7.0.0-dev.20251015.1",

34 "openapi-typescript": "^7.8.0",

35 "oxlint": "^1.28.0",

36 "oxlint-tsgolint": "^0.6.0",

37 "typescript": "^5.9.2",

38 "vitest": "^1.6.0",

39 "@tryrecess/typescript-config": "0.0.0"

40 },

41 "scripts": {

42 "build": "tsc",

43 "client:generate": "node scripts/generate-api-types.mjs",

44 "typecheck": "tsgo --noEmit",

45 "format": "oxfmt --ignore-path .oxfmtignore --check",

46 "format:fix": "oxfmt --ignore-path .oxfmtignore",

47 "lint": "oxlint --type-aware src/*.ts",

48 "lint:fix": "oxlint --type-aware --fix src/*.ts",

49 "test": "vitest run",

50 "install-local": "pnpm run build && make install-local",

51 "install-persistent": "pnpm run build && make install-persistent",

52 "install-skill": "pnpm run build && node scripts/install-skill.mjs",

53 "postinstall": "node scripts/postinstall.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L53

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L53

54 }

55}

scripts/postinstall.mjsView file

Lines 10-45javascript

10// 1. Never fail the install. A read-only HOME, a sandboxed CI runner, or a

11// missing build all exit 0 — a skill copy is not worth a failed upgrade.

12// 2. Never run from a source checkout. In the monorepo `pnpm install` fires

13// postinstall for the workspace package too, where dist/ may be stale or

14// absent; writing a developer's half-built skill into their real agent

15// directories would be a surprising side effect of `pnpm install`.

16// 3. Stay quiet on success. One line, on stderr, so it cannot pollute a

17// piped `--json` envelope if anything ever invokes this indirectly.

18import fs

dist/cli.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = recess-cli@1.3.3 matchedIdentity = npm:cmVjZXNzLWNsaQ:1.3.3 similarity = 0.917 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.jsView on unpkg

Source & flagged code

4 flagged · loading source

package.jsonView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code