registry / syndes / 0.1.0

syndes@0.1.0

⚠ Under review

SynDes — a tamper-evident ledger of everything you do in Claude Code, an efficiency score built from it, and a local dashboard that shows you how you actually work. macOS, Windows and Linux. Zero dependencies.

Static Scan Results

scanned 27d ago · by rust-scanner

Static analysis flagged 16 finding(s) at 97.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 89 file(s), 368 KB of source, external domains: www.apple.com, www.w3.org

Source & flagged code

8 flagged

package.jsonView file

Lines 31-67json

31 "LICENSE",

32 "README.md",

33 "adapters",

34 "analytics",

35 "bin",

36 "collect",

37 "dashboard",

38 "ledger",

39 "notify",

40 "practices",

41 "runtime",

42 "src"

43 ],

44 "engines": {

45 "node": ">=18.0.0"

46 },

47 "scripts": {

48 "test": "node --test \"test/*.test.mjs\"",

49 "bench": "node test/hook-latency.test.mjs --bench",

50 "prepublishOnly": "npm test",

51 "postinstall": "node bin/postinstall.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L51

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L51

52 },

53 "dependencies": {},

54 "publishConfig": {

55 "access": "public"

56 },

57 "author": "guruprasath005",

58 "homepage": "https://github.com/guruprasath005/syndes#readme",

59 "bugs": {

60 "url": "https://github.com/guruprasath005/syndes/issues"

61 },

62 "repository": {

63 "type": "git",

64 "url": "git+https://github.com/guruprasath005/syndes.git"

65 }

66}

runtime/paths.mjsView file

Lines 1-31javascript

1/**

2 * Every filesystem location syndes touches.

3 *

4 * Derived from this module's URL, never from process.cwd() — hooks run with the

5 * cwd of whatever project Claude Code was launched in, not the package.

6 *

7 * `packageRoot` is the copy executing; `installDir` is the copy settings.json

8 * points at. They differ under `npx` (the npm cache, which npm prunes) and in

9 * development, which is why install copies to a stable home.

10 *

collect/git.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

collect/git.mjs#virtual:normalized:round1View on unpkg

runtime/hook.mjsView file

•matchType = normalized_sha256 matchedPackage = syndes@0.4.0 matchedPath = runtime/hook.mjs matchedIdentity = npm:c3luZGVz:0.4.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

runtime/hook.mjsView on unpkg

src/systemauth.mjsView file

•matchType = normalized_sha256 matchedPackage = syndes@0.4.0 matchedPath = src/systemauth.mjs matchedIdentity = npm:c3luZGVz:0.4.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/systemauth.mjsView on unpkg

notify/linux.mjsView file

•matchType = normalized_sha256 matchedPackage = syndes@0.4.0 matchedPath = notify/linux.mjs matchedIdentity = npm:c3luZGVz:0.4.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

notify/linux.mjsView on unpkg

Source & flagged code

8 flagged · loading source

package.jsonView file

syndes@0.1.0

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code