registry / tonty-tech-interviews / 0.2.58

tonty-tech-interviews@0.2.58

⚠ Under review

CLI for Tonty Talents technical candidate evaluation — evaluate how engineers work with AI

Static Scan Results

scanned 4d ago · by rust-scanner

Static analysis flagged 17 finding(s) at 97.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 12 file(s), 286 KB of source, external domains: git-scm.com, github.com, nodejs.org, raw.githubusercontent.com, tonty-tech-interviews-relay.tonty-tech-interviews.workers.dev, tonty.app, ubuntu.com, x.ai

Source & flagged code

8 flagged

dist/chunk-3NWCBDRU.jsView file

Lines 1-37javascript

1#!/usr/bin/env node

2import {

3 SessionManager,

4 detectInstalledProviders,

5 discoverBuiltInScenarios,

6 getLauncher,

7 listSessions,

8 loadSession,

9 saveSession,

10 toStoredSession

11} from "./chunk-XOHAN56V.js";

13// src/ui/display.ts

14import chalk from "chalk";

15import { readFileSync } from "fs";

16import { join, dirname } from "path";

17import { fileURLToPath } from "url";

18var __dirname = dirname(fileURLToPath(import.meta.url));

19function readVersion() {

20 try {

21 let pkgPath = join(__dirname, "package.json");

22 let raw;

23 try {

24 raw = readFileSync(pkgPath, "utf-8");

25 } catch {

26 pkgPath = join(__dirname, "..", "package.json");

27 raw = readFileSync(pkgPath, "utf-8");

28 }

29 const pkg = JSON.parse(raw);

30 return pkg.version || "0.0.0";

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/chunk-3NWCBDRU.jsView on unpkg · L17

31 } catch {

32 return "0.0.0";

33 }

34}

35var VERSION = readVersion();

36var W = 58;

37function getVersion() {

Lines 84-124javascript

84 console.log(chalk.bold(" Scenario: ") + chalk.white(name));

85 console.log(chalk.gray(" " + description));

86 console.log(

87 chalk.gray(" Difficulty: ")

•matchType = previous_version_dangerous_delta matchedPackage = tonty-tech-interviews@0.2.57 matchedIdentity = npm:dG9udHktdGVjaC1pbnRlcnZpZXdz:0.2.57 similarity = 0.750 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/chunk-3NWCBDRU.jsView on unpkg

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. dist/chunk-3NWCBDRU.js: chalk.gray("\u2502") + center(chalk.dim(`v${VERSION} \u2022 https://tonty.app`), W) + chalk.gray("\u2502") import { writeFile, mkdir } from "fs/promises"; import { writeFile as writeFile2, mkdir as mkdir2, readFile as readFile2, rm as rm2 } from "fs/promises"; import { rm, copyFile } from "fs/promises"; await writeFile(tarballPath, tarball); await writeFile(systemPromptPath, systemPrompt); if (input.startsWith("http://") || input.startsWith("https://")) { return input.replace("git@github.com:", "https://github.com/").replace(/\.git$/, "");

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

dist/chunk-3NWCBDRU.jsView on unpkg

vendor/node-pty/lib/unixTerminal.jsView file

Lines 1-41javascript

1"use strict";

2var __extends = (this && this.__extends) || (function () {

3 var extendStatics = function (d

vendor/node-pty/build/Release/pty.nodeView file

•path = vendor/node-pty/build/Release/pty.node kind = native_binary sizeBytes = 71576 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

vendor/node-pty/build/Release/pty.nodeView on unpkg

dist/rl-epsilon-inverted/verify.shView file

•path = dist/rl-epsilon-inverted/verify.sh kind = build_helper sizeBytes = 2124 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/rl-epsilon-inverted/verify.shView on unpkg

Source & flagged code

8 flagged · loading source

dist/chunk-3NWCBDRU.js

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code