registry / rippletide-package / 0.6.1

rippletide-package@0.6.1

Rippletide's CLI for AI coding agents — one command, each feature a subcommand.

Static Scan Results

scanned 6d ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 13 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 51 file(s), 366 KB of source, external domains: 127.0.0.1, api.openai.com, example.com

Source & flagged code

4 flagged

reviewer/codex/rippletide-reviewer/scripts/rippletide-codex.mjsView file

Lines 3-25javascript

3import { existsSync } from "node:fs";

4import path from "node:path";

5import { fileURLToPath, pathToFileURL } from "node:url";

7const scriptDir = path.dirname(fileURLToPath(import.meta.url));

9const roots = [

10 process.env.RIPPLETIDE_REVIEWER_ROOT,

11 path.resolve(scriptDir, "../../.."),

12 process.cwd(),

13].filter(Boolean);

15const reviewerRoot = [...new Set(roots.map((root) => path.resolve(root)))]

16 .find((root) => existsSync(path.join(root, "src/integrations/codex/prepare.js")));

18if (!reviewerRoot) {

19 console.error("Rippletide reviewer source not found.");

20 console.error("Set RIPPLETIDE_REVIEWER_ROOT=/path/to/reviewer and rerun.");

21 process.exit(1);

22}

24await import(pathToFileURL(path.join(reviewerRoot, "src/integrations/codex/prepare.js")).href);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

reviewer/codex/rippletide-reviewer/scripts/rippletide-codex.mjsView on unpkg · L23

surface/src/util.jsView file

Lines 107-147javascript

107 const raw = text.slice(i + 1, end - 1);

108 return { value: raw, end };

109}

110

111/** First string-literal value for `key:` / `"key":` / `key=` inside an object/dict body. */

112export function stringField(body

tide/sdk-python/tests/test_runtime.pyView file

•path = tide/sdk-python/tests/test_runtime.py kind = payload_in_excluded_dir sizeBytes = 24078 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

tide/sdk-python/tests/test_runtime.pyView on unpkg

•path = tide/sdk-python/tests/test_runtime.py kind = build_helper sizeBytes = 24078 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

tide/sdk-python/tests/test_runtime.pyView on unpkg

Source & flagged code

4 flagged · loading source

reviewer/codex/rippletide-reviewer/scripts/rippletide-codex.mjsView file

23L24: await import(pathToFileURL(path.join(reviewerRoot, "src/integrations/codex/prepare.js")).href);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

reviewer/codex/rippletide-reviewer/scripts/rippletide-codex.mjsView on unpkg · L23

surface/src/util.jsView file

127L128: /** JSON.parse with tolerance for // comments and trailing commas (settings files). */ L129: export function tolerantJsonParse(text) {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

surface/src/util.jsView on unpkg · L127

tide/sdk-python/tests/test_runtime.pyView file

•path = tide/sdk-python/tests/test_runtime.py kind = payload_in_excluded_dir sizeBytes = 24078 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

tide/sdk-python/tests/test_runtime.pyView on unpkg

•path = tide/sdk-python/tests/test_runtime.py kind = build_helper sizeBytes = 24078 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

tide/sdk-python/tests/test_runtime.pyView on unpkg

Findings

1 High5 Medium7 Low

HighPayload In Excluded Dirtide/sdk-python/tests/test_runtime.py

MediumDynamic Requirereviewer/codex/rippletide-reviewer/scripts/rippletide-codex.mjs

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helpertide/sdk-python/tests/test_runtime.py

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowWeak Cryptosurface/src/util.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

4 flagged

reviewer/codex/rippletide-reviewer/scripts/rippletide-codex.mjsView file

Lines 3-25javascript

3import { existsSync } from "node:fs";

4import path from "node:path";

5import { fileURLToPath, pathToFileURL } from "node:url";

7const scriptDir = path.dirname(fileURLToPath(import.meta.url));

9const roots = [

10 process.env.RIPPLETIDE_REVIEWER_ROOT,

11 path.resolve(scriptDir, "../../.."),

12 process.cwd(),

13].filter(Boolean);

15const reviewerRoot = [...new Set(roots.map((root) => path.resolve(root)))]

16 .find((root) => existsSync(path.join(root, "src/integrations/codex/prepare.js")));

18if (!reviewerRoot) {

19 console.error("Rippletide reviewer source not found.");

20 console.error("Set RIPPLETIDE_REVIEWER_ROOT=/path/to/reviewer and rerun.");

21 process.exit(1);

22}

24await import(pathToFileURL(path.join(reviewerRoot, "src/integrations/codex/prepare.js")).href);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

reviewer/codex/rippletide-reviewer/scripts/rippletide-codex.mjsView on unpkg · L23

surface/src/util.jsView file

Lines 107-147javascript

107 const raw = text.slice(i + 1, end - 1);

108 return { value: raw, end };

109}

110

111/** First string-literal value for `key:` / `"key":` / `key=` inside an object/dict body. */

112export function stringField(body

tide/sdk-python/tests/test_runtime.pyView file

•path = tide/sdk-python/tests/test_runtime.py kind = payload_in_excluded_dir sizeBytes = 24078 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

tide/sdk-python/tests/test_runtime.pyView on unpkg

•path = tide/sdk-python/tests/test_runtime.py kind = build_helper sizeBytes = 24078 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

tide/sdk-python/tests/test_runtime.pyView on unpkg