registry / ryugi-artifacts / 1.18.4
ryugi-artifacts@1.18.4
Server and viewer for the Ryugi artifacts app
AI Security Review
scanned 15h ago · by lpm-firewall-aiSource inspection found no install-time attack or unrelated credential transfer. The scanner’s similarity and Unicode flags do not establish malicious behavior: the cited viewer files are bundled application code, and the flagged translation file showed no searched bidi controls.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
A user invokes the CLI or uses the viewer’s cloud features.
Impact
No malicious impact was identified; the inspected behavior supports the package’s artifact application.
Mechanism
The CLI starts the application, and the viewer makes same-origin API requests. Server cloud requests use the configured Ryugi origin for application authentication.
AI rationale
Source inspection found no install-time attack or unrelated credential transfer. The scanner’s similarity and Unicode flags do not establish malicious behavior: the cited viewer files are bundled application code, and the flagged translation file showed no searched bidi controls.
Evidence
package.jsonbin/ryugi-artifacts.cjsdist/cli.cjsdist/server.cjsdist/viewer/index.jsdist/viewer/ku-TR-6OUDTVRD-CctJtizJ.js
Network endpoints2
ryugi.innei.dev/api/cloud/${t}
Decision evidence
public snapshotAI called this Clean at 92.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json defines `prepublishOnly` as a build step, and the executable routes user invocation to the CLI.
- The flagged viewer files contain bundled UI and rendering code; the flagged Kurdish file contains UI translations, with no searched bidi controls found.
- The server sends saved credentials to its configured Ryugi cloud origin for application requests; the default origin is `https://ryugi.innei.dev`.
- The CLI processes arguments supplied by the user, and the viewer calls a same-origin cloud API.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkWebSocket
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
10 flagged · loading sourcedist/cli.cjsView file
26// src/cli/main.ts
L27: var import_node_child_process3 = require("node:child_process");
L28: var import_node_util = require("node:util");
High
26Cross-file remote execution chain: dist/cli.cjs spawns dist/server.cjs; helper contains network access plus dynamic code execution.
L26: // src/cli/main.ts
L27: var import_node_child_process3 = require("node:child_process");
L28: var import_node_util = require("node:util");
...
L145: }
L146: var invocation = () => process.env.RYUGI_ARTIFACTS_COMMAND || "ryugi-artifacts";
L147: var ARTIFACT_PATTERN = /^(artboard|document|html)\/[a-z0-9][a-z0-9-]*$/;
...
L167: const direct = (0, import_node_child_process.spawnSync)("ps", ["-ww", "-p", String(pid), "-o", "command="], { encoding: "utf8" });
L168: if (direct.status === 0 && direct.stdout.trim()) return direct.stdout.trim().split(/\s+/);
L169: const full = (0, import_node_child_process.spawnSync)("ps", ["-f", "-p", String(pid)], { encoding: "utf
High
Cross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
dist/cli.cjsView on unpkg · L26dist/viewer/ku-TR-6OUDTVRD-CctJtizJ.jsView file
Findings
1 Critical8 High4 Medium6 Low
CriticalTrojan Source Unicodedist/viewer/ku-TR-6OUDTVRD-CctJtizJ.js
HighChild Processdist/cli.cjs
HighCross File Remote Execution Contextdist/cli.cjs
HighSemantic Analysis Limiteddist/cli.cjs#virtual:string-array:round1
HighKnown Malware Source Similaritydist/server.cjs
HighKnown Malware Source Similaritydist/viewer/chunk-GMAD6QVW-COZQExf-.js
HighKnown Malware Source Similaritydist/viewer/chunk-IMKFNOWR-DoSmXTi7.js
HighKnown Malware Source Similaritydist/viewer/chunk-SHT3W25Y-Bo8j1N02.js
HighKnown Malware Source Similaritydist/viewer/diagram-VX7I27RA-VRK1Xx-r.js
MediumNetwork
MediumEnvironment Vars
Affected versions and remediation
This report applies to ryugi-artifacts@1.18.4.
See all versions of ryugi-artifacts for other recorded verdicts.
- Review the evidence and your use of ryugi-artifacts@1.18.4 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.