registry / snow-ai / 0.8.15

snow-ai@0.8.15

Agentic coding in your terminal

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 19 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 4 file(s), 2.08 MB of source, external domains: example.com, github.com, ipapi.co, jimmy.warting.se, nodejs.org, ns.adobe.com, reactjs.org, registry.npmjs.org, registry.npmmirror.com, sheetjs.com, www.apache.org, www.w3.org, www.xfa.org

Oversized source lightweight scan

bundle/cli.mjs29.9 MB file, sampled 256 KB

FilesystemNetworkChildProcessEnvironmentVarsNativeBindingsCryptoShellWebSocketHighEntropyStringsUrlStringsgithub.comjimmy.warting.senodejs.orgreactjs.orgregistry.npmjs.orgsheetjs.comwww.apache.org

Source & flagged code

10 flagged

package.jsonView file

Lines 24-64json

24 "url": "https://github.com/MayDay-wpf/snow-cli.git"

25 },

26 "bugs": {

27 "url": "https://github.com/MayDay-wpf/snow-cli/issues"

28 },

29 "homepage": "https://github.com/MayDay-wpf/snow-cli#readme",

30 "engines": {

31 "node": ">=22",

32 "npm": ">=8.3.0"

33 },

34 "scripts": {

35 "build": "node scripts/clean-build.cjs && tsc && node scripts/build-native.cjs && node build.mjs",

36 "build:ts": "tsc",

37 "build:bundle": "node build.mjs",

38 "dev": "tsc --watch",

39 "start": "node bundle/cli.mjs",

40 "start:dev": "node build.mjs && node bundle/cli.mjs",

41 "link": "npm run build && npm link",

42 "unlink": "npm unlink -g snow-ai",

43 "prepublishOnly": "npm run build",

44 "postinstall": "node scripts/postinstall.cjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L44

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L44

45 "test": "prettier --check . && xo && ava",

46 "lint": "xo",

47 "format": "prettier --write ."

48 },

49 "files": [

50 "bundle",

51 "scripts"

52 ],

53 "dependencies": {

54 "@microsoft/signalr": "^10.0.0",

55 "@vscode/ripgrep": "^1.18.0",

56 "abort-controller": "^3.0.0",

57 "eventsource": "^2.0.2",

58 "fetch-cookie": "^3.0.1",

59 "node-fetch": "^2.7.0",

60 "ssh2": "^1.17.0",

61 "tough-cookie": "^6.0.0",

62 "ws": "^8.14.2"

63 },

64 "devDependencies": {

scripts/build-native.cjsView file

Lines 1-22javascript

1/* eslint-disable unicorn/prefer-module */

3const {execFileSync} = require('child_process');

4const {copyFileSync, existsSync, mkdirSync} = require('fs');

High

Child Process

Package source references child process execution.

scripts/build-native.cjsView on unpkg · L2

bundle/pdf.worker.mjsView file

6002try { L6003: const mod = await import( L6004: /*webpackIgnore: true*/

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bundle/pdf.worker.mjsView on unpkg · L6002

498try { L499: new Function(""); L500: return true;

Low

Eval

Package source references a known benign dynamic code generation pattern.

bundle/pdf.worker.mjsView on unpkg · L498

scripts/postinstall.cjsView file

Lines 73-113javascript

73 console.error(` nvm install ${minVersion}`);

74 console.error(` nvm use ${minVersion}\n`);

75 console.error(`${colors.cyan}# Or download from official website:${colors.reset}`);

76 console.error(` https://nodejs.org/\n

bundle/native/snow_native.linux-x64.nodeView file

•path = bundle/native/snow_native.linux-x64.node kind = native_binary sizeBytes = 725080 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bundle/native/snow_native.linux-x64.nodeView on unpkg

bundle/tiktoken_bg.wasmView file

•path = bundle/tiktoken_bg.wasm kind = wasm_module sizeBytes = 5593287 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

bundle/tiktoken_bg.wasmView on unpkg

bundle/cli.mjsView file

•path = bundle/cli.mjs kind = oversized_source_file sizeBytes = 31351006 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

bundle/cli.mjsView on unpkg

•path = bundle/cli.mjs kind = oversized_cli_entrypoint sizeBytes = 31351006 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

bundle/cli.mjsView on unpkg

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.cjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/build-native.cjsView file

2L3: const {execFileSync} = require('child_process'); L4: const {copyFileSync, existsSync, mkdirSync} = require('fs');

High

Child Process

Package source references child process execution.

scripts/build-native.cjsView on unpkg · L2

bundle/pdf.worker.mjsView file

6002try { L6003: const mod = await import( L6004: /*webpackIgnore: true*/

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bundle/pdf.worker.mjsView on unpkg · L6002

498try { L499: new Function(""); L500: return true;

Low

Eval

Package source references a known benign dynamic code generation pattern.

bundle/pdf.worker.mjsView on unpkg · L498

scripts/postinstall.cjsView file

93try { L94: execSync('npm install --no-save --prefer-offline sharp', { L95: stdio: 'inherit',

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/postinstall.cjsView on unpkg · L93

bundle/native/snow_native.linux-x64.nodeView file

•path = bundle/native/snow_native.linux-x64.node kind = native_binary sizeBytes = 725080 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bundle/native/snow_native.linux-x64.nodeView on unpkg

bundle/tiktoken_bg.wasmView file

•path = bundle/tiktoken_bg.wasm kind = wasm_module sizeBytes = 5593287 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

bundle/tiktoken_bg.wasmView on unpkg

bundle/cli.mjsView file

•path = bundle/cli.mjs kind = oversized_source_file sizeBytes = 31351006 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

bundle/cli.mjsView on unpkg

•path = bundle/cli.mjs kind = oversized_cli_entrypoint sizeBytes = 31351006 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

bundle/cli.mjsView on unpkg

Findings

5 High8 Medium6 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processscripts/build-native.cjs

HighShell

HighRuntime Package Installscripts/postinstall.cjs

HighOversized Source Filebundle/cli.mjs

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requirebundle/pdf.worker.mjs

MediumNetwork

MediumEnvironment Vars

MediumShips Native Binarybundle/native/snow_native.linux-x64.node

MediumShips Wasm Modulebundle/tiktoken_bg.wasm

MediumOversized Cli Entrypointbundle/cli.mjs

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvalbundle/pdf.worker.mjs

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

10 flagged

package.jsonView file

Lines 24-64json

24 "url": "https://github.com/MayDay-wpf/snow-cli.git"

25 },

26 "bugs": {

27 "url": "https://github.com/MayDay-wpf/snow-cli/issues"

28 },

29 "homepage": "https://github.com/MayDay-wpf/snow-cli#readme",

30 "engines": {

31 "node": ">=22",

32 "npm": ">=8.3.0"

33 },

34 "scripts": {

35 "build": "node scripts/clean-build.cjs && tsc && node scripts/build-native.cjs && node build.mjs",

36 "build:ts": "tsc",

37 "build:bundle": "node build.mjs",

38 "dev": "tsc --watch",

39 "start": "node bundle/cli.mjs",

40 "start:dev": "node build.mjs && node bundle/cli.mjs",

41 "link": "npm run build && npm link",

42 "unlink": "npm unlink -g snow-ai",

43 "prepublishOnly": "npm run build",

44 "postinstall": "node scripts/postinstall.cjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L44

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L44

45 "test": "prettier --check . && xo && ava",

46 "lint": "xo",

47 "format": "prettier --write ."

48 },

49 "files": [

50 "bundle",

51 "scripts"

52 ],

53 "dependencies": {

54 "@microsoft/signalr": "^10.0.0",

55 "@vscode/ripgrep": "^1.18.0",

56 "abort-controller": "^3.0.0",

57 "eventsource": "^2.0.2",

58 "fetch-cookie": "^3.0.1",

59 "node-fetch": "^2.7.0",

60 "ssh2": "^1.17.0",

61 "tough-cookie": "^6.0.0",

62 "ws": "^8.14.2"

63 },

64 "devDependencies": {

scripts/build-native.cjsView file

Lines 1-22javascript

1/* eslint-disable unicorn/prefer-module */

3const {execFileSync} = require('child_process');

4const {copyFileSync, existsSync, mkdirSync} = require('fs');

High

Child Process

Package source references child process execution.

scripts/build-native.cjsView on unpkg · L2

bundle/pdf.worker.mjsView file

6002try { L6003: const mod = await import( L6004: /*webpackIgnore: true*/

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bundle/pdf.worker.mjsView on unpkg · L6002

498try { L499: new Function(""); L500: return true;

Low

Eval

Package source references a known benign dynamic code generation pattern.

bundle/pdf.worker.mjsView on unpkg · L498

scripts/postinstall.cjsView file

Lines 73-113javascript

73 console.error(` nvm install ${minVersion}`);

74 console.error(` nvm use ${minVersion}\n`);

75 console.error(`${colors.cyan}# Or download from official website:${colors.reset}`);

76 console.error(` https://nodejs.org/\n

bundle/native/snow_native.linux-x64.nodeView file

•path = bundle/native/snow_native.linux-x64.node kind = native_binary sizeBytes = 725080 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bundle/native/snow_native.linux-x64.nodeView on unpkg

bundle/tiktoken_bg.wasmView file

•path = bundle/tiktoken_bg.wasm kind = wasm_module sizeBytes = 5593287 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

bundle/tiktoken_bg.wasmView on unpkg

bundle/cli.mjsView file

•path = bundle/cli.mjs kind = oversized_source_file sizeBytes = 31351006 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

bundle/cli.mjsView on unpkg

•path = bundle/cli.mjs kind = oversized_cli_entrypoint sizeBytes = 31351006 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

bundle/cli.mjsView on unpkg