registry / sukiss / 1.1.7

sukiss@1.1.7

AI CLI terminal assistant

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 4 file(s), 9.44 KB of source, external domains: api.groq.com, github.com

Source & flagged code

5 flagged

.envView file

1patternName = blocked_file severity = critical matchedText = .env redactedSecretContext = secretLikeLines = 4 L1: OPENAI_API_KEY_8b=<redacted:56 token-like> L2: OPENAI_API_KEY=<redacted:56 token-like> L4: OPENWEATHER_API_KEY=<redacted:32 hex> L5: APIFREELLM_KEY=<redacted:28 token-like>

Critical

Critical Secret

Package contains a critical-looking secret pattern.

.envView on unpkg · L1

sukiss-1.0.0.tgzView file

•path = sukiss-1.0.0.tgz kind = high_entropy_blob sizeBytes = 5368 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

sukiss-1.0.0.tgzView on unpkg

•path = sukiss-1.0.0.tgz kind = compressed_blob sizeBytes = 5368 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

sukiss-1.0.0.tgzView on unpkg

•path = sukiss-1.0.0.tgz kind = nested_archive_needs_inspection sizeBytes = 5368 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

sukiss-1.0.0.tgzView on unpkg

main.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = sukiss@1.1.4 matchedIdentity = npm:c3VraXNz:1.1.4 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

main.jsView on unpkg

Source & flagged code

5 flagged · loading source

.envView file

Critical

Critical Secret

Package contains a critical-looking secret pattern.

.envView on unpkg · L1

sukiss-1.0.0.tgzView file

•path = sukiss-1.0.0.tgz kind = high_entropy_blob sizeBytes = 5368 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

sukiss-1.0.0.tgzView on unpkg

•path = sukiss-1.0.0.tgz kind = compressed_blob sizeBytes = 5368 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

sukiss-1.0.0.tgzView on unpkg

Findings

1 Critical2 High4 Medium5 Low

CriticalCritical Secret.env

HighShips High Entropy Blobsukiss-1.0.0.tgz

HighPrevious Version Dangerous Deltamain.js

MediumNetwork

MediumEnvironment Vars

MediumShips Compressed Blobsukiss-1.0.0.tgz

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNested Archive Needs Inspectionsukiss-1.0.0.tgz