registry / skillwiki / 0.9.36

skillwiki@0.9.36

⚠ Under review

Static Scan Results

scanned 12h ago · by rust-scanner

Static analysis flagged 17 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicenseWildcardDependency

scanned 5 file(s), 543 KB of source, external domains: example.com, www.w3.org

Source & flagged code

6 flagged

dist/auto-update-bg.jsView file

Lines 1-47javascript

1#!/usr/bin/env node

2#!/usr/bin/env node

3import {

4 normalizeDistTag,

5 semverGt

6} from "./chunk-E6UWZ3S3.js";

8// src/auto-update-bg.ts

9import { execSync } from "child_process";

10import { writeFileSync, mkdirSync } from "fs";

High

Child Process

Package source references child process execution.

dist/auto-update-bg.jsView on unpkg · L8

11import { join, dirname } from "path";

12var home = process.argv[2];

13var currentVersion = process.argv[3];

14var distTag = normalizeDistTag(process.argv[4]);

15if (!home || !currentVersion) process.exit(0);

16var cacheFile = join(home, ".skillwiki", ".update-cache.json");

17setTimeout(() => process.exit(0), 3e4);

18try {

19 const latest = execSync(`npm view skillwiki@${distTag} version`, {

20 encoding: "utf8",

21 timeout: 15e3

22 }).trim();

23 mkdirSync(dirname(cacheFile), { recursive: true });

24 const cache = {

25 lastCheck: Date.now(),

26 latestVersion: latest,

27 currentVersion,

28 distTag

29 };

30 if (semverGt(latest, currentVersion)) {

31 execSync(`npm install -g skillwiki@${distTag}`, {

32 stdio: "ignore",

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/auto-update-bg.jsView on unpkg · L30

33 timeout: 6e4

34 });

35 writeFileSync(cacheFile, JSON.stringify({ ...cache, updateAppliedAt: Date.now() }, null, 2));

36 } else {

37 writeFileSync(cacheFile, JSON.stringify(cache, null, 2));

38 }

39} catch {

40 try {

41 mkdirSync(dirname(cacheFile), { recursive: true });

42 writeFileSync(cacheFile, JSON.stringify({ lastCheck: Date.now(), latestVersion: "", currentVersion, distTag }, null, 2));

43 } catch {

44 }

45}

46process.exit(0);

dist/chunk-TK4ZIQNE.jsView file

Lines 1-32javascript

1#!/usr/bin/env node

2import {

3 CACHE_FILENAME,

4 CHECK_INTERVAL_MS,

5 CLI_DISABLE_FLAG,

6 DIST_TAG,

7 ENV_DISABLE_KEY,

8 normalizeDistTag,

9 semverGt

10} from "./chunk-E6UWZ3S3.js";

12// ../shared/src/exit-codes.ts

skills/hooks/run-hook.cmdView file

•path = skills/hooks/run-hook.cmd kind = build_helper sizeBytes = 1274 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/hooks/run-hook.cmdView on unpkg

dist/cli.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = skillwiki@0.9.26 matchedIdentity = npm:c2tpbGx3aWtp:0.9.26 similarity = 0.667 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.jsView on unpkg

Source & flagged code

6 flagged · loading source

dist/auto-update-bg.jsView file

8// src/auto-update-bg.ts L9: import { execSync } from "child_process"; L10: import { writeFileSync, mkdirSync } from "fs";

High

Child Process

Package source references child process execution.

dist/auto-update-bg.jsView on unpkg · L8

30if (semverGt(latest, currentVersion)) { L31: execSync(`npm install -g skillwiki@${distTag}`, { L32: stdio: "ignore",

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/auto-update-bg.jsView on unpkg · L30

dist/chunk-TK4ZIQNE.jsView file

12// ../shared/src/exit-codes.ts L13: var ExitCode = { L14: OK: 0, ... L214: users: z.array(sshUser).optional(), L215: transports: z.array(z.enum(["local", "public-ip", "tailscale", "private-lan"])).min(1) L216: }).strict(); ... L343: function splitFrontmatter(text) { L344: if (!FM_OPEN.test(text)) return ok({ rawFrontmatter: "", body: text, bodyStart: 0 }); L345: const afterOpen = text.replace(FM_OPEN, ""); ... L372: { L373: kind: "private_key", L374: re: /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z0-9 ]*PRIVATE KEY-----/g

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/chunk-TK4ZIQNE.jsView on unpkg · L12

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/chunk-TK4ZIQNE.jsView on unpkg · L12

skills/hooks/run-hook.cmdView file

•path = skills/hooks/run-hook.cmd kind = build_helper sizeBytes = 1274 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/hooks/run-hook.cmdView on unpkg

dist/cli.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.jsView on unpkg

Findings

1 Critical4 High6 Medium6 Low

CriticalPrevious Version Dangerous Deltadist/cli.js

HighChild Processdist/auto-update-bg.js

HighShell

HighCloud Metadata Accessdist/chunk-TK4ZIQNE.js

HighRuntime Package Installdist/auto-update-bg.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/chunk-TK4ZIQNE.js

MediumShips Build Helperskills/hooks/run-hook.cmd

MediumStructural Risk Force Deep Review

MediumWildcard Dependency

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

6 flagged

dist/auto-update-bg.jsView file

Lines 1-47javascript

1#!/usr/bin/env node

2#!/usr/bin/env node

3import {

4 normalizeDistTag,

5 semverGt

6} from "./chunk-E6UWZ3S3.js";

8// src/auto-update-bg.ts

9import { execSync } from "child_process";

10import { writeFileSync, mkdirSync } from "fs";

High

Child Process

Package source references child process execution.

dist/auto-update-bg.jsView on unpkg · L8

11import { join, dirname } from "path";

12var home = process.argv[2];

13var currentVersion = process.argv[3];

14var distTag = normalizeDistTag(process.argv[4]);

15if (!home || !currentVersion) process.exit(0);

16var cacheFile = join(home, ".skillwiki", ".update-cache.json");

17setTimeout(() => process.exit(0), 3e4);

18try {

19 const latest = execSync(`npm view skillwiki@${distTag} version`, {

20 encoding: "utf8",

21 timeout: 15e3

22 }).trim();

23 mkdirSync(dirname(cacheFile), { recursive: true });

24 const cache = {

25 lastCheck: Date.now(),

26 latestVersion: latest,

27 currentVersion,

28 distTag

29 };

30 if (semverGt(latest, currentVersion)) {

31 execSync(`npm install -g skillwiki@${distTag}`, {

32 stdio: "ignore",

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/auto-update-bg.jsView on unpkg · L30

33 timeout: 6e4

34 });

35 writeFileSync(cacheFile, JSON.stringify({ ...cache, updateAppliedAt: Date.now() }, null, 2));

36 } else {

37 writeFileSync(cacheFile, JSON.stringify(cache, null, 2));

38 }

39} catch {

40 try {

41 mkdirSync(dirname(cacheFile), { recursive: true });

42 writeFileSync(cacheFile, JSON.stringify({ lastCheck: Date.now(), latestVersion: "", currentVersion, distTag }, null, 2));

43 } catch {

44 }

45}

46process.exit(0);

dist/chunk-TK4ZIQNE.jsView file

Lines 1-32javascript

1#!/usr/bin/env node

2import {

3 CACHE_FILENAME,

4 CHECK_INTERVAL_MS,

5 CLI_DISABLE_FLAG,

6 DIST_TAG,

7 ENV_DISABLE_KEY,

8 normalizeDistTag,

9 semverGt

10} from "./chunk-E6UWZ3S3.js";

12// ../shared/src/exit-codes.ts

skills/hooks/run-hook.cmdView file

•path = skills/hooks/run-hook.cmd kind = build_helper sizeBytes = 1274 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/hooks/run-hook.cmdView on unpkg

dist/cli.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.jsView on unpkg