registry  /  tencentcloud-cls-sdk-codebuddy-test  /  1.0.1-beta.0

tencentcloud-cls-sdk-codebuddy-test@1.0.1-beta.0

CLS observability plugin for CodeBuddy — 6-layer span hierarchy per CLS spec, direct upload to Tencent Cloud CLS

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
Supply chain
HighEntropyStringsUrlStrings
ManifestNo manifest risk signals triggered.
scanned 16 file(s), 189 KB of source, external domains: 127.0.0.1, mirrors.tencent.com, mirrors.tencentyun.com, www.apple.com

Source & flagged code

4 flagged · loading source
package.jsonView file
•scripts.preinstall = node scripts/select-registry.cjs
High
Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg
•scripts.postinstall = node src/index.mjs _post-install
Medium
Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg
src/utils/autostart.mjsView file
1// 开机自启（autostart）管理 — 跨平台支持 Linux (systemd user service / crontab 兜底) 与 macOS (launchd) L2: // ... L11: import os from 'node:os'; L12: import { spawnSync } from 'node:child_process'; L13: import { fileURLToPath } from 'node:url'; ... L17: /** 数据目录（与 config.mjs 保持一致） */ L18: const CONFIG_DIR = path.join(os.homedir(), '.cls-codebuddy'); L19: const PID_FILE = path.join(CONFIG_DIR, 'cls-codebuddy.pid'); ... L47: export function detectPlatform(opts = {}) { L48: const platform = opts.platform ?? process.platform; L49: if (platform === 'darwin') return AutoStartMethod.LAUNCHD; ... L81: RestartSec=5
Medium
Install Persistence

Source writes installer persistence such as shell profile or service configuration.

src/utils/autostart.mjsView on unpkg · L1
assets/hooks/codebuddy-hook.shView file
•path = assets/hooks/codebuddy-hook.sh kind = build_helper sizeBytes = 4756 magicHex = [redacted]
Medium
Ships Build Helper

Package ships non-JavaScript build or shell helper files.

assets/hooks/codebuddy-hook.shView on unpkg

Findings

1 High6 Medium4 Low
HighInstall Time Lifecycle Scriptspackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencesrc/utils/autostart.mjs
MediumShips Build Helperassets/hooks/codebuddy-hook.sh
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings