registry  /  ruvnet-brain  /  2.0.0

ruvnet-brain@2.0.0

One-command installer for RuvNet Brain — a portable, source-grounded brain over rUv's RuvNet building blocks, delivered as a Claude Code plugin so Claude uses the stack instead of fighting it.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
Supply chain
HighEntropyStringsObfuscatedUrlStrings
ManifestNo manifest risk signals triggered.
scanned 1 file(s), 78.8 KB of source, external domains: api.github.com, github.com, nodejs.org, www.apple.com

Source & flagged code

3 flagged · loading source
bin/install.mjsView file
10// L11: // Design rules: dependency-free (Node built-ins + shelling to unzip/npm/claude only), idempotent L12: // (safe to re-run), and never a silent half-state (every failure explains the next step). L13: L14: import https from 'node:https'; L15: import fs from 'node:fs'; ... L17: import path from 'node:path'; L18: import { spawnSync } from 'node:child_process'; L19: import { fileURLToPath, pathToFileURL } from 'node:url'; ... L40: L41: const __dirname = path.dirname(fileURLToPath(import.meta.url)); L42: const REPO_ROOT = path.resolve(__dirname, '..');
High
Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/install.mjsView on unpkg · L10
543if (!fs.existsSync(p)) return null; L544: try { return await import(pathToFileURL(p).href); } catch { return null; } L545: }
Medium
Dynamic Require

Package source references dynamic require/import behavior.

bin/install.mjsView on unpkg · L543
10// L11: // Design rules: dependency-free (Node built-ins + shelling to unzip/npm/claude only), idempotent L12: // (safe to re-run), and never a silent half-state (every failure explains the next step). L13: L14: import https from 'node:https'; L15: import fs from 'node:fs'; ... L17: import path from 'node:path'; L18: import { spawnSync } from 'node:child_process'; L19: import { fileURLToPath, pathToFileURL } from 'node:url'; ... L40: L41: const __dirname = path.dirname(fileURLToPath(import.meta.url)); L42: const REPO_ROOT = path.resolve(__dirname, '..');
Medium
Install Persistence

Source writes installer persistence such as shell profile or service configuration.

bin/install.mjsView on unpkg · L10

Findings

1 High5 Medium5 Low
HighSandbox Evasion Gated Capabilitybin/install.mjs
MediumDynamic Requirebin/install.mjs
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencebin/install.mjs
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowObfuscated
LowHigh Entropy Strings
LowUrl Strings