scip-query@0.24.0

Evidence and verification for AI coding agents: map code, reuse concepts, finish migrations, and gate diffs.

Static Scan Results

scanned 1mo ago · by rust-scanner

Static analysis flagged 18 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 348 file(s), 4.79 MB of source, external domains: github.com, registry.npmjs.org

Source & flagged code

8 flagged

package.jsonView file

•scripts.postinstall = node dist/postinstall.js || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node dist/postinstall.js || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/chunk-ZHG4WAHR.jsView file

1import{c as Re,f as ir,g as te,h as or,i as Y,j as ar,k as Ae,l as it,m as L,n as sr,p as cr,q as ne,r as Le,s as De,v as z,w as ie}from"./chunk-SYVJEEUJ.js";import{c as tr,d as rr... L2: `),console.log("Or install it with Go:"),console.log(` go install ${Oe}

High

Child Process

Package source references child process execution.

dist/chunk-ZHG4WAHR.jsView on unpkg · L1

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/chunk-ZHG4WAHR.jsView on unpkg · L1

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/chunk-ZHG4WAHR.jsView on unpkg · L1

dist/chunk-2XWIUW5Z.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2var bu=Symbol.for("scip-query.project-file-listing-context.v1"),xu=globalThis,ea=xu[bu],G=ea&&typeof ea=="object"?ea:{};xu[bu]=G;

dist/command-descriptors-7BKH53Y3.jsView file

1#!/usr/bin/env node L2: import{a as pc,b as mc,c as hc,d as fc,e as Di,f as gc,g as nn,h as yc,i as bc,l as vc,m as Lt,n as Dn,o as qn,p as Sc,r as wc,s as $c,t as Rc,u as xc,v as Cc,w as kc,x as Ec,z as ... L3: `).map(i=>i.slice(3).trim()).filter(i=>i!=="").sort()}}catch(n){return{state:"unavailable",reason:ch(n)}}}function ch(e){let t=e&&typeof e=="object"?e:{};if(t.code==="ETIMEDOUT"||t... ... L8: `)){if(!n.trim().startsWith("{"))continue;let i=Wi(n);if(!i||typeof i!="object")continue;let o=i;if(o.reason!=="compiler-message")continue;let r=o.message;if(!r||typeof r!="object"... L9: `).map(t=>t.trim()).filter(t=>/\berror\b/i.test(t)).map(t=>({file:"",message:t,parseBasis:"heuristic"}))}function kh(e){let t=e.file.length>0?`${e.file}${e.line?`:${e.line}`:""}${e... L10: `).map(n=>n.tri

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/command-descriptors-7BKH53Y3.jsView on unpkg · L1

dist/chunk-RBAD4GJ2.js#virtual:string-array:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/chunk-RBAD4GJ2.js#virtual:string-array:round1View on unpkg

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node dist/postinstall.js || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node dist/postinstall.js || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/chunk-ZHG4WAHR.jsView file

High

Child Process

Package source references child process execution.

dist/chunk-ZHG4WAHR.jsView on unpkg · L1

Findings

6 High5 Medium7 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/chunk-ZHG4WAHR.js

HighShell

HighSame File Env Network Executiondist/chunk-ZHG4WAHR.js

HighCommand Output Exfiltrationdist/chunk-ZHG4WAHR.js

HighSemantic Analysis Limiteddist/chunk-RBAD4GJ2.js#virtual:string-array:round1

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumUnsafe Vm Contextdist/chunk-2XWIUW5Z.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowWeak Crypto

Affected versions and remediation

This report applies to scip-query@0.24.0.

See all versions of scip-query for other recorded verdicts.

Review the evidence and your use of scip-query@0.24.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-13 15:11:56.850Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.