registry / spikeme / 0.5.5

spikeme@0.5.5

Analyze your repo's stack and generate a time-boxed spike doc to decide your next library, with evidence. Reads package.json (npm) and pyproject.toml/requirements.txt (Python).

Static Scan Results

scanned 5h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 839 KB of source, external domains: api.spikeme.io, github.com, json-schema.org, raw.githubusercontent.com, spec.openapis.org, spikeme.io, stackoverflow.com, tools.ietf.org, www.safaribooksonline.com, www.w3.org

Source & flagged code

5 flagged

dist/index.jsView file

Lines 1-35javascript

1#!/usr/bin/env node

3// src/index.ts

4import { parseArgs } from "node:util";

5import { readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "node:fs";

6import { resolve } from "node:path";

8// ../marketing/wizard/lib/analyzer.ts

9var CATEGORY_LABELS = {

10 framework: "Framework",

11 "meta-framework": "Meta-framework",

12 build: "Build & Dev",

13 styling: "Estilo",

14 animation: "Anima\xE7\xE3o",

15 state: "Estado",

16 data: "Dados & Fetch",

17 forms: "Formul\xE1rios",

High

Credential Exfiltration

Source combines credential-like environment material and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L15

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L15

18 testing: "Testes",

19 e2e: "E2E",

20 ui: "UI Kit",

21 backend: "Backend & APIs",

22 lint: "Qualidade",

23 i18n: "i18n",

24 auth: "Auth",

25 monitoring: "Observabilidade",

26 other: "Outras"

27};

28var KNOWN = [

29 // frameworks

30 { match: "react", label: "React", category: "framework" },

31 { match: "react-dom", label: "React DOM", category: "framework" },

32 { match: "vue", label: "Vue", category: "framework" },

33 { match: "svelte", label: "Svelte", category: "framework" },

34 { match: "solid-js", label: "SolidJS", category: "framework" },

35 { match: "preact", label: "Preact", category: "framework" },

Lines 1329-1369javascript

1329 return runGeneration(

1330 {

1331 source: "cli",

1332 system: IMPLEMENTATION_SYSTEM_PROMPT,

1333 prompt: buildImplementationPrompt(analysis, options),

1334 meta: {

1335 ecosystem: analysis.ecosystem,

1336 topic: options.library.slice(

dist/mcp.jsView file

2941sourceCode = this.opts.code.process(sourceCode, sch); L2942: const makeValidate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode); L2943: const validate = makeValidate(this, this.scope.get());

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/mcp.jsView on unpkg · L2941

Source & flagged code

5 flagged · loading source

dist/index.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code