registry / rivet-design / 0.13.5

rivet-design@0.13.5

Local visual web development tool with AI-powered code modification

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 15 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedTelemetryUrlStrings

Manifest

CopyleftLicense

scanned 153 file(s), 2.95 MB of source, external domains: 127.0.0.1, cdn.jsdelivr.net, cdn.skypack.dev, cdnjs.cloudflare.com, claude.ai, cli.github.com, cursor.com, demo.rivet.design, esm.sh, getdesign.md, github.com, gsap.com, reactjs.org, releases.rivet.design, rivet-core-production.up.railway.app, rivet-prototype-host.onrender.com, rivet-proxy.onrender.com, rivet.design, rivet.local, unpkg.com, us.posthog.com, vdonwyzxpnsrihtrrvza.supabase.co, www.gstatic.com, www.w3.org, yandex.com

Source & flagged code

5 flagged

package.jsonView file

Lines 1-36json

2 "name": "rivet-design",

3 "version": "0.13.5",

4 "description": "Local visual web development tool with AI-powered code modification",

5 "main": "dist/index.js",

6 "workspaces": [

7 "src/ui",

8 "src/proxy",

9 "desktop",

10 "desktop/renderer"

11 ],

12 "bin": {

13 "rivet": "./bin/rivet.js"

14 },

15 "scripts": {

16 "preinstall": "node scripts/verify-node-version.cjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L16

17 "build": "npm run clean && tsc && npm run build:assets && npm run build:ui && npm run build:bin",

18 "build:assets": "mkdir -p dist/services/templates/designmd && cp src/services/templates/designmd/*.md dist/services/templates/designmd/",

19 "build:ui": "cd src/ui && vite build",

20 "storybook:ui": "yarn workspace @rivet/ui storybook",

21 "build-storybook:ui": "yarn workspace @rivet/ui build-storybook",

22 "build:bin": "mkdir -p bin && cp src/bin-template.js bin/rivet.js && chmod +x bin/rivet.js",

23 "dev": "tsc --watch",

24 "clean": "rm -rf dist src/ui/dist bin",

25 "pack": "npm run build && npm pack",

26 "pack:verify": "npm run pack && tar -tzf rivet-design-*.tgz | sort && echo '\n✓ Package contents listed above'",

27 "prepublishOnly": "git rev-parse --abbrev-ref HEAD | grep -qx main || (echo 'ERROR: npm publish must be run from the main branch' && exit 1) && cp README.npm.md README.md && npm run build || (git checkout README.md && exit 1)",

28 "postpublish": "git checkout README.md",

29 "lint": "eslint . --ext ts,tsx,js,jsx",

30 "lint:fix": "eslint . --ext ts,tsx,js,jsx --fix",

31 "format": "prettier --write .",

32 "format:check": "prettier --check .",

33 "test": "node --max-old-space-size=4096 ./node_modules/jest/bin/jest.js --config src/jest.config.ts",

34 "test:install": "yarn build && node scripts/test-host-install.mjs",

35 "test:watch": "jest --config src/jest.config.ts --watch",

36 "test:coverage": "jest --config src/jest.config.ts --coverage",

bin/rivet.jsView file

Lines 1-24javascript

1#!/usr/bin/env node

3process.noDeprecation = true;

5const fs = require('fs');

6const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/rivet.js

dist/cli/commands/open.jsView file

Lines 175-215javascript

175 }

176 return {

177 attached: true,

178 alreadyRunning: wasAlreadyRunning,

179 rivetPort: attached.handshake.rivetPort,

180 editorUrl: (0, client_1.editorUrlFor)(attached),

181 sessionId: session?.sessionId ?? attached.handshake.sessionId,

182 applyMode: attached.handshake.applyMode,

183 resolvedRunner: session?.resolvedRunner ??

src/ui/dist/favicon.icoView file

•path = src/ui/dist/favicon.ico kind = high_entropy_blob sizeBytes = 4820 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

src/ui/dist/favicon.icoView on unpkg

dist/services/WorktreeManager.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = rivet-design@0.13.1 matchedIdentity = npm:cml2ZXQtZGVzaWdu:0.13.1 similarity = 0.800 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/services/WorktreeManager.jsView on unpkg

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.preinstall = node scripts/verify-node-version.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

bin/rivet.jsView file

4L5: const fs = require('fs'); L6: const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/rivet.jsView on unpkg · L4

dist/cli/commands/open.jsView file

195package = rivet-design; repositoryIdentity = rivet; dependency = open L195: const launch = openBrowser ?? L196: (await Promise.resolve().then(() => __importStar(require('open')))).default; L197: await launch(editorUrl);

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/cli/commands/open.jsView on unpkg · L195

src/ui/dist/favicon.icoView file

•path = src/ui/dist/favicon.ico kind = high_entropy_blob sizeBytes = 4820 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

src/ui/dist/favicon.icoView on unpkg

dist/services/WorktreeManager.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/services/WorktreeManager.jsView on unpkg

Findings

4 High4 Medium7 Low

HighInstall Time Lifecycle Scriptspackage.json

HighCopied Package Dependency Bridgedist/cli/commands/open.js

HighShips High Entropy Blobsrc/ui/dist/favicon.ico

HighPrevious Version Dangerous Deltadist/services/WorktreeManager.js

MediumDynamic Requirebin/rivet.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

LowCopyleft License

Source & flagged code

5 flagged

package.jsonView file

Lines 1-36json

2 "name": "rivet-design",

3 "version": "0.13.5",

4 "description": "Local visual web development tool with AI-powered code modification",

5 "main": "dist/index.js",

6 "workspaces": [

7 "src/ui",

8 "src/proxy",

9 "desktop",

10 "desktop/renderer"

11 ],

12 "bin": {

13 "rivet": "./bin/rivet.js"

14 },

15 "scripts": {

16 "preinstall": "node scripts/verify-node-version.cjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L16

17 "build": "npm run clean && tsc && npm run build:assets && npm run build:ui && npm run build:bin",

18 "build:assets": "mkdir -p dist/services/templates/designmd && cp src/services/templates/designmd/*.md dist/services/templates/designmd/",

19 "build:ui": "cd src/ui && vite build",

20 "storybook:ui": "yarn workspace @rivet/ui storybook",

21 "build-storybook:ui": "yarn workspace @rivet/ui build-storybook",

22 "build:bin": "mkdir -p bin && cp src/bin-template.js bin/rivet.js && chmod +x bin/rivet.js",

23 "dev": "tsc --watch",

24 "clean": "rm -rf dist src/ui/dist bin",

25 "pack": "npm run build && npm pack",

26 "pack:verify": "npm run pack && tar -tzf rivet-design-*.tgz | sort && echo '\n✓ Package contents listed above'",

28 "postpublish": "git checkout README.md",

29 "lint": "eslint . --ext ts,tsx,js,jsx",

30 "lint:fix": "eslint . --ext ts,tsx,js,jsx --fix",

31 "format": "prettier --write .",

32 "format:check": "prettier --check .",

33 "test": "node --max-old-space-size=4096 ./node_modules/jest/bin/jest.js --config src/jest.config.ts",

34 "test:install": "yarn build && node scripts/test-host-install.mjs",

35 "test:watch": "jest --config src/jest.config.ts --watch",

36 "test:coverage": "jest --config src/jest.config.ts --coverage",

bin/rivet.jsView file

Lines 1-24javascript

1#!/usr/bin/env node

3process.noDeprecation = true;

5const fs = require('fs');

6const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/rivet.js

dist/cli/commands/open.jsView file

Lines 175-215javascript

175 }

176 return {

177 attached: true,

178 alreadyRunning: wasAlreadyRunning,

179 rivetPort: attached.handshake.rivetPort,

180 editorUrl: (0, client_1.editorUrlFor)(attached),

181 sessionId: session?.sessionId ?? attached.handshake.sessionId,

182 applyMode: attached.handshake.applyMode,

183 resolvedRunner: session?.resolvedRunner ??

src/ui/dist/favicon.icoView file

•path = src/ui/dist/favicon.ico kind = high_entropy_blob sizeBytes = 4820 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

src/ui/dist/favicon.icoView on unpkg

dist/services/WorktreeManager.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/services/WorktreeManager.jsView on unpkg