registry  /  spikeme  /  0.3.0

spikeme@0.3.0

Analyze your repo's stack and generate a time-boxed spike doc to decide your next library, with evidence. Reads package.json (npm) and pyproject.toml/requirements.txt (Python).

Static Scan Results

scanned 18h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
Supply chain
HighEntropyStringsUrlStrings
ManifestNo manifest risk signals triggered.
scanned 1 file(s), 47.9 KB of source, external domains: api.spikeme.io, spikeme.io

Source & flagged code

4 flagged · loading source
dist/index.jsView file
1003import { createHash, randomBytes } from "node:crypto"; L1004: import { spawn } from "node:child_process"; L1005: var WEB = process.env.SPIKEME_WEB ?? "https://spikeme.io";
High
Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L1003
1003import { createHash, randomBytes } from "node:crypto"; L1004: import { spawn } from "node:child_process"; L1005: var WEB = process.env.SPIKEME_WEB ?? "https://spikeme.io"; L1006: var CLI_AUTH = `${SUPABASE_URL}/functions/v1/cli-auth`;
High
Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L1003
15state: "Estado", L16: data: "Dados & Fetch", L17: forms: "Formul\xE1rios", ... L84: { match: "swr", label: "SWR", category: "data" }, L85: { match: "axios", label: "Axios", category: "data" }, L86: { match: "graphql", label: "GraphQL", category: "data" }, ... L176: try { L177: parsed = JSON.parse(raw); L178: } catch { ... L253: label: "npm", L254: manifests: ["package.json"], L255: detect: (filename) => manifestBasename(filename).toLowerCase() === "package.json",
High
Credential Exfiltration

Source combines credential-like environment material and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L15
15state: "Estado", L16: data: "Dados & Fetch", L17: forms: "Formul\xE1rios", ... L84: { match: "swr", label: "SWR", category: "data" }, L85: { match: "axios", label: "Axios", category: "data" }, L86: { match: "graphql", label: "GraphQL", category: "data" }, ... L176: try { L177: parsed = JSON.parse(raw); L178: } catch { ... L253: label: "npm", L254: manifests: ["package.json"], L255: detect: (filename) => manifestBasename(filename).toLowerCase() === "package.json",
High
Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L15

Findings

5 High3 Medium5 Low
HighChild Processdist/index.js
HighShell
HighSame File Env Network Executiondist/index.js
HighCredential Exfiltrationdist/index.js
HighSandbox Evasion Gated Capabilitydist/index.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings