registry / ryugi-artifacts / 1.8.0
ryugi-artifacts@1.8.0
Server and viewer for the Ryugi artifacts app
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe manifest exposes a user-run launcher, and its helper installs the same package only as part of starting the server. The inspected launcher, server, and required flagged bundle excerpts establish no concrete attack surface; the static hints alone do not support a malicious verdict.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A user runs the ryugi-artifacts command for a project.
Impact
The command starts the artifacts server for the selected project; no unrelated mutation, credential transfer, or attack behavior was established.
Mechanism
The launcher starts the packaged helper, which prefers a local server bundle and otherwise retrieves and runs a release of ryugi-artifacts from npm.
AI rationale
The manifest exposes a user-run launcher, and its helper installs the same package only as part of starting the server. The inspected launcher, server, and required flagged bundle excerpts establish no concrete attack surface; the static hints alone do not support a malicious verdict.
Decision evidence
public snapshotAI called this Clean at 81.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json exposes the launcher as the package command and ships the server and viewer artifacts.
- The launcher starts the packaged shell helper for a project directory; the helper can install and run a newer release of this same package when no local server bundle is present.
- The required viewer files contain bundled UI, rendering, and localization code; the inspected excerpts show no attack behavior.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkWebSocket
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
7 flagged · loading sourcebin/ryugi-artifacts.cjsView file
1#!/usr/bin/env node
L2: const { execFile, spawn } = require('node:child_process');
L3: const fs = require('node:fs');
High
Child Process
Package source references child process execution.
bin/ryugi-artifacts.cjsView on unpkg · L11#!/usr/bin/env node
L2: const { execFile, spawn } = require('node:child_process');
L3: const fs = require('node:fs');
Medium
Dynamic Require
Package source references dynamic require/import behavior.
bin/ryugi-artifacts.cjsView on unpkg · L1dist/viewer/ku-TR-6OUDTVRD-BECmOCof.jsView file
7contains invisible/control Unicode U+200C (zero width non-joiner)
یان Alt ڕابگرە و کلیک بکە بۆ زیادکردنی خاڵە نوێیەکان`,placeImage:`کلیک بکە بۆ دانانی وێنەکە، یان کلیک بکە و ڕایبکێشە بۆ ئەوەی قەبارەکەی بە دەستی دابنێیت`,publishLibrary:`کتێبخانەی تایبەت بە خۆت بڵاوبکەرەوە`,bindTextToElement:`بۆ زیادکردنی د
Findings
1 Critical3 High6 Medium6 Low
CriticalTrojan Source Unicodedist/viewer/ku-TR-6OUDTVRD-BECmOCof.js
HighChild Processbin/ryugi-artifacts.cjs
HighCross File Remote Execution Contextdist/server.cjs
HighSemantic Analysis Limiteddist/viewer/ganttDiagram-EL5Y4UJY-BVcwKFHE.js#virtual:normalized:round1
MediumDynamic Requirebin/ryugi-artifacts.cjs
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperdist/start-server.sh
MediumOversized Source Filedist/viewer/DocumentEditor-BS16Wb_Z.js
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEval
Affected versions and remediation
This report applies to ryugi-artifacts@1.8.0.
See all versions of ryugi-artifacts for other recorded verdicts.
- Review the evidence and your use of ryugi-artifacts@1.8.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.