registry / synsci / 1.2.2

synsci@1.2.2

Install wizard for OpenScience, the open-source AI research workspace (optionally with Atlas)

Static Scan Results

scanned 4h ago · by rust-scanner

Static analysis flagged 5 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemShell

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 9.17 KB of source

Source & flagged code

2 flagged

bin/synsci.mjsView file

Lines 1-39javascript

1#!/usr/bin/env node

3// `npx synsci`: the OpenScience install wizard.

4//

5// The npm package (and this bin) keep the historical `synsci` name so the

6// one-liner everyone knows keeps working; everything it installs is the

7// OpenScience CLI (`@synsci/openscience`, binary `openscience`), optionally with the

8// Atlas managed platform on top.

10// Hard guard against recursive invocation. If a check ever resolves to the

11// launcher itself, this prevents an infinite spawn chain that exhausts memory.

12if (process.env.__SYNSCI_LAUNCHER_PID) {

13 process.stderr.write(

14 `synsci: launcher invoked recursively (parent pid ${process.env.__SYNSCI_LAUNCHER_PID}). Exiting.\n`,

15 )

16 process.exit(2)

17}

18process.env.__SYNSCI_LAUNCHER_PID = String(process.pid)

20import { execFileSync, execSync, spawn } from "node:child_process"

21import { existsSync, readFileSync, realpathSync } from "node:fs"

High

Child Process

Package source references child process execution.

bin/synsci.mjsView on unpkg · L19

22import { homedir } from "node:os"

23import { join } from "node:path"

24import { createInterface } from "node:readline"

25import { fileURLToPath } from "node:url"

27const SELF_PATH = (() => {

28 try { return realpathSync(fileURLToPath(import.meta.url)) } catch { return "" }

29})()

31const BOLD = "\x1b[1m"

32const DIM = "\x1b[2m"

33const CYAN = "\x1b[36m"

34const GREEN = "\x1b[32m"

35const YELLOW = "\x1b[33m"

36const RED = "\x1b[31m"

37const RESET = "\x1b[0m"

38const HIDE_CURSOR = "\x1b[?25l"

39const SHOW_CURSOR = "\x1b[?25h"

Lines 79-119javascript

80function runFileQuiet(file, args = []) {

81 try { return execFileSync(file, args, { encoding: "utf-8", stdio: "pipe" }).trim() }

82 catch { return null }

83}

85function isLauncherPath

Source & flagged code

2 flagged · loading source

bin/synsci.mjsView file

19L20: import { execFileSync, execSync, spawn } from "node:child_process" L21: import { existsSync, readFileSync, realpathSync } from "node:fs"

High

Child Process

Package source references child process execution.

bin/synsci.mjsView on unpkg · L19

99const candidates = [] L100: // 1. Global npm prefix (where `npm i -g @synsci/openscience` puts it) L101: const prefix = runQuiet("npm prefix -g") ... L108: try { L109: const ver = execFileSync(cand, ["--version"], { L110: encoding: "utf-8", stdio: "pipe", timeout: 5000,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/synsci.mjsView on unpkg · L99

Findings

3 High1 Medium1 Low

HighChild Processbin/synsci.mjs

HighShell

HighRuntime Package Installbin/synsci.mjs

MediumEnvironment Vars

LowFilesystem

Source & flagged code

2 flagged

bin/synsci.mjsView file

Lines 1-39javascript

1#!/usr/bin/env node

3// `npx synsci`: the OpenScience install wizard.

4//

5// The npm package (and this bin) keep the historical `synsci` name so the

6// one-liner everyone knows keeps working; everything it installs is the

7// OpenScience CLI (`@synsci/openscience`, binary `openscience`), optionally with the

8// Atlas managed platform on top.

10// Hard guard against recursive invocation. If a check ever resolves to the

11// launcher itself, this prevents an infinite spawn chain that exhausts memory.

12if (process.env.__SYNSCI_LAUNCHER_PID) {

13 process.stderr.write(

14 `synsci: launcher invoked recursively (parent pid ${process.env.__SYNSCI_LAUNCHER_PID}). Exiting.\n`,

15 )

16 process.exit(2)

17}

18process.env.__SYNSCI_LAUNCHER_PID = String(process.pid)

20import { execFileSync, execSync, spawn } from "node:child_process"

21import { existsSync, readFileSync, realpathSync } from "node:fs"

High

Child Process

Package source references child process execution.

bin/synsci.mjsView on unpkg · L19

22import { homedir } from "node:os"

23import { join } from "node:path"

24import { createInterface } from "node:readline"

25import { fileURLToPath } from "node:url"

27const SELF_PATH = (() => {

28 try { return realpathSync(fileURLToPath(import.meta.url)) } catch { return "" }

29})()

31const BOLD = "\x1b[1m"

32const DIM = "\x1b[2m"

33const CYAN = "\x1b[36m"

34const GREEN = "\x1b[32m"

35const YELLOW = "\x1b[33m"

36const RED = "\x1b[31m"

37const RESET = "\x1b[0m"

38const HIDE_CURSOR = "\x1b[?25l"

39const SHOW_CURSOR = "\x1b[?25h"

Lines 79-119javascript

80function runFileQuiet(file, args = []) {

81 try { return execFileSync(file, args, { encoding: "utf-8", stdio: "pipe" }).trim() }

82 catch { return null }

83}

85function isLauncherPath