registry / ryugi-artifacts / 1.7.1
ryugi-artifacts@1.7.1
Server and viewer for the Ryugi artifacts app
AI Security Review
scanned 3d ago · by lpm-firewall-aiSource inspection found no concrete malicious behavior. The scanner’s lifecycle and execution flags correspond to a prepublish build, a user-started launcher, and ordinary bundled viewer code.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
The user runs the ryugi-artifacts command; the package manifest has no preinstall, install, or postinstall hook.
Impact
No confirmed attack impact was established.
Mechanism
The launcher starts the server and can install this package version into a cache on first use. The server uses saved credentials only for requests to the matching configured cloud origin.
AI rationale
Source inspection found no concrete malicious behavior. The scanner’s lifecycle and execution flags correspond to a prepublish build, a user-started launcher, and ordinary bundled viewer code.
Decision evidence
public snapshotAI called this Clean at 88.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest defines a prepublishOnly build hook; the CLI starts the server launcher only when the user runs the command.
- The server reads saved cloud credentials only when their saved origin matches its configured origin, and sends cloud requests to that same origin for artifact operations.
- The flagged viewer files contain bundled application modules, localization strings, and KaTeX parsing code; inspection found no concrete attack behavior in them.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkWebSocket
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
8 flagged · loading sourcebin/ryugi-artifacts.cjsView file
•matchType = previous_version_dangerous_delta
matchedPackage = ryugi-artifacts@1.6.0
matchedIdentity = npm:cnl1Z2ktYXJ0aWZhY3Rz:1.6.0
similarity = 0.975
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
bin/ryugi-artifacts.cjsView on unpkg1#!/usr/bin/env node
L2: const { execFile, spawn } = require('node:child_process');
L3: const fs = require('node:fs');
High
Child Process
Package source references child process execution.
bin/ryugi-artifacts.cjsView on unpkg · L11#!/usr/bin/env node
L2: const { execFile, spawn } = require('node:child_process');
L3: const fs = require('node:fs');
Medium
Dynamic Require
Package source references dynamic require/import behavior.
bin/ryugi-artifacts.cjsView on unpkg · L1Findings
2 Critical3 High6 Medium6 Low
CriticalTrojan Source Unicodedist/viewer/ku-TR-6OUDTVRD-BECmOCof.js
CriticalPrevious Version Dangerous Deltabin/ryugi-artifacts.cjs
HighChild Processbin/ryugi-artifacts.cjs
HighCross File Remote Execution Contextdist/server.cjs
HighSemantic Analysis Limiteddist/viewer/ganttDiagram-EL5Y4UJY-BVcwKFHE.js#virtual:normalized:round1
MediumDynamic Requirebin/ryugi-artifacts.cjs
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperdist/start-server.sh
MediumOversized Source Filedist/viewer/DocumentEditor-BS16Wb_Z.js
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
Affected versions and remediation
This report applies to ryugi-artifacts@1.7.1.
See all versions of ryugi-artifacts for other recorded verdicts.
- Review the evidence and your use of ryugi-artifacts@1.7.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.