registry / u1s1-cli / 0.19.5

u1s1-cli@0.19.5

⚠ Under review

u1s1 — 有一说一,最省心的 AI 编程搭子。终端里用中文说需求,AI 帮你读文件、改代码、跑命令。

Static Scan Results

scanned 11d ago · by rust-scanner

Static analysis flagged 20 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationUrlStrings

ManifestNo manifest risk signals triggered.

scanned 33 file(s), 1.21 MB of source, external domains: api.u1s1.io, bellard.org, github.com, reactjs.org, registry.npmjs.org, u1s1.io, www.w3.org

Source & flagged code

12 flagged

package.jsonView file

Lines 11-51json

11 "types": "./dist/embed.d.ts",

12 "default": "./dist/embed.js"

13 },

14 "./package.json": "./package.json"

15 },

16 "files": [

17 "dist",

18 "webui-dist",

19 "bench",

20 "scripts"

21 ],

22 "engines": {

23 "node": ">=22.19.0"

24 },

25 "scripts": {

26 "build": "tsc",

27 "dev": "tsx src/index.ts",

28 "typecheck": "tsc --noEmit",

29 "prepublishOnly": "npm run build && npm test",

30 "test": "node scripts/render-regression.mjs",

31 "postinstall": "node scripts/patch-pi.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L31

32 "package": "bash ../../scripts/package.sh",

33 "upload-release": "bash ../../scripts/upload-release.sh",

34 "release": "npm run package && npm run upload-release"

35 },

36 "keywords": [

37 "ai",

38 "cli",

39 "coding-agent",

40 "deepseek",

41 "u1s1"

42 ],

43 "license": "MIT",

44 "homepage": "https://u1s1.io",

45 "dependencies": {

46 "@earendil-works/pi-coding-agent": "0.84.3",

47 "@earendil-works/pi-tui": "0.84.3",

48 "typebox": "1.3.7"

49 },

50 "optionalDependencies": {

51 "pi-web-ui": "0.26.0"

dist/shell-doctor.jsView file

Lines 1-21javascript

1import { spawn } from "node:child_process";

2import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";

High

Child Process

Package source references child process execution.

dist/shell-doctor.jsView on unpkg · L1

3import { dirname, join } from "node:path";

4import

dist/workflow/runner.jsView file

Lines 1-21javascript

1import { createHash } from "node:crypto";

2import { execFileSync } from "node:child_process";

3import { appendFileSync, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

dist/workflow/runner.jsView on unpkg · L1

dist/web.jsView file

Lines 1-30javascript

1import { spawn, spawnSync } from "node:child_process";

2import { mkdirSync } from "node:fs";

3import { createRequire } from "node:module";

4import { dirname, join } from "node:path";

dist/update.jsView file

Lines 1-21javascript

1import { execSync, spawnSync } from "node:child_process";

2import { mkdtempSync, readFileSync, writeFileSync } from "node:fs";

3import { createRequire } from "node:module";

4import { tmpdir } from "node:os";

Source & flagged code

12 flagged · loading source

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code