registry / stella-coder / 3.9.2

stella-coder@3.9.2

Stella Coder 3.9 — AI coding agent with computer control, smart home, Office automation, and antivirus

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNativeBindingsNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 15 file(s), 377 KB of source, external domains: api.duckduckgo.com, discord.gg, github.com, html.duckduckgo.com, ollama.com, opencode.ai, www.google.com, www.kinopoisk.ru, www.virustotal.com, www.youtube.com

Source & flagged code

7 flagged

publish.mjsView file

Lines 1-22javascript

1#!/usr/bin/env node

2// Stella Coder — Publish to npm

3import { execSync } from "node:child_process"

4import fs from "node:fs"

High

Child Process

Package source references child process execution.

publish.mjsView on unpkg · L2

6console.log("\n ✦ Stella Coder — Publish to npm\n")

8const pkg = JSON.parse(fs.readFileSync("package.json", "utf8"))

9console.log(` Версия: ${pkg.version}`)

10console.log(` Имя: ${pkg.name}\n`)

12// Publish

13console.log(" [1/1] Публикация...")

14try {

15 execSync("npm publish --access public", { stdio: "inherit" })

16 console.log("\n ✓ Опубликовано!\n")

17} catch (e) {

18 console.error("\n ✗ Ошибка публикации:", e.message)

19 process.exit(1)

20}

22console.log(" Установка для пользователей:")

stella-cli/index.mjsView file

Lines 1-26javascript

1#!/usr/bin/env node

2// Stella Coder 3.9 — терминальный AI-агент

3import readline from "node:readline"

4import fs from "node:fs"

5import path from "node:path"

6import os from "node:os"

7import { execSync } from "node:child_process"

stella-cli/build.mjsView file

Lines 1-24javascript

1#!/usr/bin/env node

2// Stella Coder — Build Script (SEA: Single Executable Application)

3import fs from "node:fs"

4import path from "node:path"

5import { execSync } from "node:child_process"

6import { fileURLToPath } from "node:url"

8const __filename

hello.pyView file

•path = hello.py kind = build_helper sizeBytes = 88 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

hello.pyView on unpkg

Source & flagged code

7 flagged · loading source

publish.mjsView file

2// Stella Coder — Publish to npm L3: import { execSync } from "node:child_process" L4: import fs from "node:fs"

High

Child Process

Package source references child process execution.

publish.mjsView on unpkg · L2

stella-cli/index.mjsView file

604["/shell", "выполнить shell-команду"], L605: ["/powershell", "выполнить PowerShell команду"], L606: ["/cmd", "выполнить cmd команду"],

High

Shell

Package source references shell execution.

stella-cli/index.mjsView on unpkg · L604

6import os from "node:os" L7: import { execSync } from "node:child_process" L8: import { streamText, stepCountIs, generateText } from "ai" ... L22: const VERSION = "3.9.1" L23: const CONFIG_DIR = path.join(os.homedir(), ".stella") L24: const CONFIG_PATH = path.join(CONFIG_DIR, "config.json") ... L26: L27: const ZEN_BASE_URL = "https://opencode.ai/zen/v1" L28: ... L53: function loadConfig() { L54: try { return JSON.parse(fs.readFileSync(CONFIG_PATH, "utf8")) } catch { return {} } L55: }

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

stella-cli/index.mjsView on unpkg · L6

Low

Weak Crypto

Package source references weak cryptographic algorithms.

stella-cli/index.mjsView on unpkg · L6

stella-cli/build.mjsView file

4Cross-file remote execution chain: stella-cli/build.mjs spawns stella-cli/tools.mjs; helper contains network access plus dynamic code execution. L4: import path from "node:path" L5: import { execSync } from "node:child_process" L6: import { fileURLToPath } from "node:url" ... L8: const __filename = fileURLToPath(import.meta.url) L9: const __dirname = path.dirname(__filename) L10: ... L12: const SEA_BLOB = path.join(DIST, "sea-prep.blob") L13: const EXE_NAME = process.platform === "win32" ? "stella.exe" : "stella" L14: const OUTPUT = path.join(DIST, EXE_NAME)

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

stella-cli/build.mjsView on unpkg · L4

94try { L95: execSync(`node --experimental-sea-config ${path.join(DIST, "sea-config.json")}`, { L96: cwd: DIST, ... L102: console.log() L103: console.log(" Альтернатива: npm install -g pkg && pkg --targets node18-win-x64 .") L104: console.log()

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

stella-cli/build.mjsView on unpkg · L94

hello.pyView file

•path = hello.py kind = build_helper sizeBytes = 88 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

hello.pyView on unpkg

Findings

4 High5 Medium5 Low

HighChild Processpublish.mjs

HighShellstella-cli/index.mjs

HighCross File Remote Execution Contextstella-cli/build.mjs

HighRuntime Package Installstella-cli/build.mjs

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencestella-cli/index.mjs

MediumShips Build Helperhello.py

MediumStructural Risk Force Deep Review

LowScripts Present

LowWeak Cryptostella-cli/index.mjs

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

7 flagged

publish.mjsView file

Lines 1-22javascript

1#!/usr/bin/env node

2// Stella Coder — Publish to npm

3import { execSync } from "node:child_process"

4import fs from "node:fs"

High

Child Process

Package source references child process execution.

publish.mjsView on unpkg · L2

6console.log("\n ✦ Stella Coder — Publish to npm\n")

8const pkg = JSON.parse(fs.readFileSync("package.json", "utf8"))

9console.log(` Версия: ${pkg.version}`)

10console.log(` Имя: ${pkg.name}\n`)

12// Publish

13console.log(" [1/1] Публикация...")

14try {

15 execSync("npm publish --access public", { stdio: "inherit" })

16 console.log("\n ✓ Опубликовано!\n")

17} catch (e) {

18 console.error("\n ✗ Ошибка публикации:", e.message)

19 process.exit(1)

20}

22console.log(" Установка для пользователей:")

stella-cli/index.mjsView file

Lines 1-26javascript

1#!/usr/bin/env node

2// Stella Coder 3.9 — терминальный AI-агент

3import readline from "node:readline"

4import fs from "node:fs"

5import path from "node:path"

6import os from "node:os"

7import { execSync } from "node:child_process"

stella-cli/build.mjsView file

Lines 1-24javascript

1#!/usr/bin/env node

2// Stella Coder — Build Script (SEA: Single Executable Application)

3import fs from "node:fs"

4import path from "node:path"

5import { execSync } from "node:child_process"

6import { fileURLToPath } from "node:url"

8const __filename

hello.pyView file

•path = hello.py kind = build_helper sizeBytes = 88 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

hello.pyView on unpkg

Lines 584-624javascript

584 ["/windows", "список открытых окон"],

585 ["/focus", "переключиться на окно"],

586 ["/wifi", "Wi-Fi сети"],

587 ["/lock", "заблокировать экран"],

588 ["/shutdown", "выключить/перезагрузить"],

589 ["/search", "быстрый поиск файлов"],

590

591 // Умный дом

592 ["/tv", "управление Sony TV (вкл/выкл/канал/громкость)"],

593 ["tv-off", "выключить TV"],

594 ["tv-on", "включить TV"],

595 ["/tv-info", "информация о TV"],

596 ["/cec", "HDMI-CEC управление"],

597 ["/smart", "сканирование умных устройств"],

598 ["/light", "управление умными лампами"],

599 ["/cast", "трансляция на Chromecast"],

600 ["/wol", "включить устройство по MAC"],

601

602 // Сервер и терминал

603 ["/exec", "выполнить команду в терминале"],

604 ["/shell", "выполнить shell-команду"],

605 ["/powershell", "выполнить PowerShell команду"],

606 ["/cmd", "выполнить cmd команду"],

High

Shell

Package source references shell execution.

stella-cli/index.mjsView on unpkg · L604

607 ["/ssh", "подключение по SSH"],

608 ["/scp", "копирование файлов по SCP"],

609 ["/server", "статус сервера"],

610 ["/ports", "открытые порты"],

611 ["/connections", "активные соединения"],

612 ["/kill-port", "завершить процесс на порту"],

613 ["/network", "сетевые интерфейсы"],

614 ["/dns", "DNS настройки"],

615 ["/ping", "пинг хоста"],

616 ["/traceroute", "трассировка маршрута"],

617 ["/download", "скачать файл"],

618 ["/upload", "загрузить файл"],

619 ["/http-server", "запустить HTTP сервер"],

620 ["/firewall", "файрвол Windows"],

621 ["/service", "службы Windows"],

622 ["/registry", "реестр Windows"],

623 ["/script", "запустить скрипт"],

624 ["/schedule", "запланировать задачу"],

Lines 74-114javascript

74 console.log(` ${file}`)

75 }

76}

78// Also copy antimalware directory

79const antimalwareSrc = path.join(__dirname, "..", "antimalware")

80const antimalwareDst = path.join(DIST, "antimalware")

81if (fs.existsSync(antimalwareSrc)) {

82 fs.cpSync(antimalwareSrc, antimalwareDst, { recursive: true })

83 console.log(" antimalware/")

84}

86// 3. Create SEA blob

87console.log(" [3/5] Создание SEA blob...")

88const seaConfig = {

89 main: "index.mjs",

90 disableExperimentalSEAWarning: true,

91}

92fs.writeFileSync(path.join(DIST, "sea-config.json"), JSON.stringify(seaConfig, null, 2))

94try {

95 execSync(`node --experimental-sea-config ${path.join(DIST, "sea-config.json")}`, {

96 cwd: DIST,

97 stdio: "inherit",

98 })

99} catch (e) {

100 console.log(" ⚠ SEA config не поддерживается этой версией Node.js")

101 console.log(" Используйте Node.js 20+ или pkg для компиляции")

102 console.log()

103 console.log(" Альтернатива: npm install -g pkg && pkg --targets node18-win-x64 .")

104 console.log()

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

stella-cli/build.mjsView on unpkg · L94

105 process.exit(0)

106}

107

108// 4. Copy node executable

109console.log(" [4/5] Копирование Node.js executable...")

110const nodeExe = process.execPath

111const targetExe = path.join(DIST, EXE_NAME)

112fs.copyFileSync(nodeExe, targetExe)

113

114// 5. Inject SEA blob into executable