registry / snow-ai / 0.8.13

snow-ai@0.8.13

Agentic coding in your terminal

Static Scan Results

scanned 3d ago · by rust-scanner

Static analysis flagged 18 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 2.07 MB of source, external domains: example.com, github.com, ipapi.co, jimmy.warting.se, nodejs.org, ns.adobe.com, reactjs.org, registry.npmjs.org, registry.npmmirror.com, sheetjs.com, www.apache.org, www.w3.org, www.xfa.org

Oversized source lightweight scan

bundle/cli.mjs29.9 MB file, sampled 256 KB

FilesystemNetworkChildProcessEnvironmentVarsNativeBindingsCryptoShellWebSocketHighEntropyStringsUrlStringsgithub.comjimmy.warting.senodejs.orgreactjs.orgregistry.npmjs.orgsheetjs.comwww.apache.org

Source & flagged code

9 flagged

package.jsonView file

Lines 24-64json

24 "url": "https://github.com/MayDay-wpf/snow-cli.git"

25 },

26 "bugs": {

27 "url": "https://github.com/MayDay-wpf/snow-cli/issues"

28 },

29 "homepage": "https://github.com/MayDay-wpf/snow-cli#readme",

30 "engines": {

31 "node": ">=22",

32 "npm": ">=8.3.0"

33 },

34 "scripts": {

35 "build": "node scripts/clean-build.cjs && tsc && node build.mjs",

36 "build:ts": "tsc",

37 "build:bundle": "node build.mjs",

38 "dev": "tsc --watch",

39 "start": "node bundle/cli.mjs",

40 "start:dev": "node build.mjs && node bundle/cli.mjs",

41 "link": "npm run build && npm link",

42 "unlink": "npm unlink -g snow-ai",

43 "prepublishOnly": "npm run build",

44 "postinstall": "node scripts/postinstall.cjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L44

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L44

45 "test": "prettier --check . && xo && ava",

46 "lint": "xo",

47 "format": "prettier --write ."

48 },

49 "files": [

50 "bundle",

51 "scripts"

52 ],

53 "dependencies": {

54 "@microsoft/signalr": "^10.0.0",

55 "@vscode/ripgrep": "^1.18.0",

56 "abort-controller": "^3.0.0",

57 "eventsource": "^2.0.2",

58 "fetch-cookie": "^3.0.1",

59 "node-fetch": "^2.7.0",

60 "ssh2": "^1.17.0",

61 "tough-cookie": "^6.0.0",

62 "ws": "^8.14.2"

63 },

64 "devDependencies": {

scripts/postinstall.cjsView file

Lines 1-27javascript

1#!/usr/bin/env node

3/**

4 * Post-install script to provide installation optimization tips for users

5 */

7const https = require('https');

8const { execSync } = require('child_process');

bundle/pdf.worker.mjsView file

6002try { L6003: const mod = await import( L6004: /*webpackIgnore: true*/

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bundle/pdf.worker.mjsView on unpkg · L6002

498try { L499: new Function(""); L500: return true;

Low

Eval

Package source references a known benign dynamic code generation pattern.

bundle/pdf.worker.mjsView on unpkg · L498

bundle/tiktoken_bg.wasmView file

•path = bundle/tiktoken_bg.wasm kind = wasm_module sizeBytes = 5593287 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

bundle/tiktoken_bg.wasmView on unpkg

bundle/cli.mjsView file

•path = bundle/cli.mjs kind = oversized_source_file sizeBytes = 31334044 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

bundle/cli.mjsView on unpkg

•path = bundle/cli.mjs kind = oversized_cli_entrypoint sizeBytes = 31334044 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

bundle/cli.mjsView on unpkg

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.cjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/postinstall.cjsView file

7const https = require('https'); L8: const { execSync } = require('child_process'); L9:

High

Child Process

Package source references child process execution.

scripts/postinstall.cjsView on unpkg · L7

93try { L94: execSync('npm install --no-save --prefer-offline sharp', { L95: stdio: 'inherit',

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/postinstall.cjsView on unpkg · L93

bundle/pdf.worker.mjsView file

6002try { L6003: const mod = await import( L6004: /*webpackIgnore: true*/

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bundle/pdf.worker.mjsView on unpkg · L6002

498try { L499: new Function(""); L500: return true;

Low

Eval

Package source references a known benign dynamic code generation pattern.

bundle/pdf.worker.mjsView on unpkg · L498

bundle/tiktoken_bg.wasmView file

•path = bundle/tiktoken_bg.wasm kind = wasm_module sizeBytes = 5593287 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

bundle/tiktoken_bg.wasmView on unpkg

bundle/cli.mjsView file

•path = bundle/cli.mjs kind = oversized_source_file sizeBytes = 31334044 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

bundle/cli.mjsView on unpkg

•path = bundle/cli.mjs kind = oversized_cli_entrypoint sizeBytes = 31334044 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

bundle/cli.mjsView on unpkg

Findings

5 High7 Medium6 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processscripts/postinstall.cjs

HighShell

HighRuntime Package Installscripts/postinstall.cjs

HighOversized Source Filebundle/cli.mjs

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requirebundle/pdf.worker.mjs

MediumNetwork

MediumEnvironment Vars

MediumShips Wasm Modulebundle/tiktoken_bg.wasm

MediumOversized Cli Entrypointbundle/cli.mjs

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvalbundle/pdf.worker.mjs

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

9 flagged

package.jsonView file

Lines 24-64json

24 "url": "https://github.com/MayDay-wpf/snow-cli.git"

25 },

26 "bugs": {

27 "url": "https://github.com/MayDay-wpf/snow-cli/issues"

28 },

29 "homepage": "https://github.com/MayDay-wpf/snow-cli#readme",

30 "engines": {

31 "node": ">=22",

32 "npm": ">=8.3.0"

33 },

34 "scripts": {

35 "build": "node scripts/clean-build.cjs && tsc && node build.mjs",

36 "build:ts": "tsc",

37 "build:bundle": "node build.mjs",

38 "dev": "tsc --watch",

39 "start": "node bundle/cli.mjs",

40 "start:dev": "node build.mjs && node bundle/cli.mjs",

41 "link": "npm run build && npm link",

42 "unlink": "npm unlink -g snow-ai",

43 "prepublishOnly": "npm run build",

44 "postinstall": "node scripts/postinstall.cjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L44

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L44

45 "test": "prettier --check . && xo && ava",

46 "lint": "xo",

47 "format": "prettier --write ."

48 },

49 "files": [

50 "bundle",

51 "scripts"

52 ],

53 "dependencies": {

54 "@microsoft/signalr": "^10.0.0",

55 "@vscode/ripgrep": "^1.18.0",

56 "abort-controller": "^3.0.0",

57 "eventsource": "^2.0.2",

58 "fetch-cookie": "^3.0.1",

59 "node-fetch": "^2.7.0",

60 "ssh2": "^1.17.0",

61 "tough-cookie": "^6.0.0",

62 "ws": "^8.14.2"

63 },

64 "devDependencies": {

scripts/postinstall.cjsView file

Lines 1-27javascript

1#!/usr/bin/env node

3/**

4 * Post-install script to provide installation optimization tips for users

5 */

7const https = require('https');

8const { execSync } = require('child_process');

bundle/pdf.worker.mjsView file

6002try { L6003: const mod = await import( L6004: /*webpackIgnore: true*/

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bundle/pdf.worker.mjsView on unpkg · L6002

498try { L499: new Function(""); L500: return true;

Low

Eval

Package source references a known benign dynamic code generation pattern.

bundle/pdf.worker.mjsView on unpkg · L498

bundle/tiktoken_bg.wasmView file

•path = bundle/tiktoken_bg.wasm kind = wasm_module sizeBytes = 5593287 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

bundle/tiktoken_bg.wasmView on unpkg

bundle/cli.mjsView file

•path = bundle/cli.mjs kind = oversized_source_file sizeBytes = 31334044 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

bundle/cli.mjsView on unpkg

•path = bundle/cli.mjs kind = oversized_cli_entrypoint sizeBytes = 31334044 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

bundle/cli.mjsView on unpkg

Lines 73-113javascript

73 console.error(` nvm install ${minVersion}`);

74 console.error(` nvm use ${minVersion}\n`);

75 console.error(`${colors.cyan}# Or download from official website:${colors.reset}`);

76 console.error(` https://nodejs.org/\n`);

77 console.error(`${colors.yellow}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${colors.reset}\n`);

78 process.exit(1);

79 }

80}

82/**

83 * Try to install sharp as optional dependency

84 */

85function tryInstallSharp() {

86 try {

87 // Check if sharp is already installed

88 require.resolve('sharp');

89 console.log(`${colors.green}✓ sharp is already installed${colors.reset}`);

90 return true;

91 } catch {

92 console.log(`${colors.yellow}Installing optional dependency: sharp (for SVG to PNG conversion)${colors.reset}`);

93 try {

94 execSync('npm install --no-save --prefer-offline sharp', {

95 stdio: 'inherit',

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/postinstall.cjsView on unpkg · L93

96 cwd: process.cwd()

97 });

98 console.log(`${colors.green}✓ sharp installed successfully${colors.reset}`);

99 return true;

100 } catch (error) {

101 console.log(`${colors.yellow}⚠ sharp installation failed (this is OK - SVG will be returned as-is)${colors.reset}`);

102 console.log(`${colors.cyan} Reason: sharp requires native binaries that may not be compatible with your system${colors.reset}`);

103 return false;

104 }

105 }

106}

107

108/**

109 * Main function

110 */

111async function main() {

112 // Check Node.js version first

113 checkNodeVersion();