registry / usrcp-imessage / 0.2.2

usrcp-imessage@0.2.2

⚠ Under review

iMessage capture+reader adapter for USRCP — macOS-only, shells out to steipete/imsg for chat.db access

Static Scan Results

scanned 4h ago · by rust-scanner

Static analysis flagged 7 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVars

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 7 file(s), 48.8 KB of source, external domains: console.anthropic.com

Source & flagged code

3 flagged

package.jsonView file

Lines 1-37json

2 "name": "usrcp-imessage",

3 "version": "0.2.2",

4 "description": "iMessage capture+reader adapter for USRCP — macOS-only, shells out to steipete/imsg for chat.db access",

5 "main": "dist/index.js",

6 "os": [

7 "darwin"

8 ],

9 "files": [

10 "dist/**/*.js",

11 "dist/**/*.d.ts"

12 ],

13 "bin": {

14 "usrcp-imessage": "dist/index.js"

15 },

16 "scripts": {

17 "postinstall": "node -e \"const fs=require(\\\"fs\\\"); for (const p of [\\\"node_modules/better-sqlite3/build\\\",\\\"node_modules/usrcp-core/node_modules/better-sqlite3/build\\\",\\\"node_modules/usrcp-stream/node_modules/better-sqlite3/build\\\"]) fs.rmSync(p,{recursive:true,force:true})\" && npm rebuild better-sqlite3",

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg · L17

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L17

18 "prebuild": "(cd ../usrcp-adapter-kit && npm run build) && (cd ../usrcp-stream && npm run build)",

19 "build": "tsc",

20 "dev": "tsc --watch",

21 "start": "node dist/index.js",

22 "lint": "tsc --noEmit",

23 "pretest": "(cd ../usrcp-adapter-kit && npm run build) && (cd ../usrcp-stream && npm run build)",

24 "test": "vitest run",

25 "test:watch": "vitest"

26 },

27 "keywords": [

28 "usrcp",

29 "imessage",

30 "adapter",

31 "memory",

32 "macos"

33 ],

34 "author": "Chad Garner",

35 "license": "Apache-2.0",

36 "engines": {

37 "node": ">=20.0.0"

dist/setup.jsView file

Lines 177-217javascript

177 displayName = c.participants.join(", ");

178 }

179 else if (c.chat_identifier) {

180 displayName = c.chat_identifier;

181 }

182 else {

183 displayName = `Chat ${rowid}`

Source & flagged code

3 flagged · loading source

package.jsonView file

•scripts.postinstall = node -e "const fs=require(\"fs\"); for (const p of [\"node_modules/better-sqlite3/build\",\"node_modules/usrcp-core/node_modules/better-sqlite3/build\",\"node_modules/usrcp-stream/...

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/setup.jsView file

197package = usrcp-imessage; repositoryIdentity = usrcp; dependency = @anthropic-ai/sdk L197: try { L198: const { default: Anthropic } = await import("@anthropic-ai/sdk"); L199: const client = new Anthropic({ apiKey });

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/setup.jsView on unpkg · L197

Findings

1 Critical2 High2 Medium2 Low

CriticalRed Install Lifecycle Scriptpackage.json

HighInstall Time Lifecycle Scriptspackage.json

HighCopied Package Dependency Bridgedist/setup.js

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowUrl Strings

Source & flagged code

3 flagged

package.jsonView file

Lines 1-37json

2 "name": "usrcp-imessage",

3 "version": "0.2.2",

4 "description": "iMessage capture+reader adapter for USRCP — macOS-only, shells out to steipete/imsg for chat.db access",

5 "main": "dist/index.js",

6 "os": [

7 "darwin"

8 ],

9 "files": [

10 "dist/**/*.js",

11 "dist/**/*.d.ts"

12 ],

13 "bin": {

14 "usrcp-imessage": "dist/index.js"

15 },

16 "scripts": {

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg · L17

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L17

18 "prebuild": "(cd ../usrcp-adapter-kit && npm run build) && (cd ../usrcp-stream && npm run build)",

19 "build": "tsc",

20 "dev": "tsc --watch",

21 "start": "node dist/index.js",

22 "lint": "tsc --noEmit",

23 "pretest": "(cd ../usrcp-adapter-kit && npm run build) && (cd ../usrcp-stream && npm run build)",

24 "test": "vitest run",

25 "test:watch": "vitest"

26 },

27 "keywords": [

28 "usrcp",

29 "imessage",

30 "adapter",

31 "memory",

32 "macos"

33 ],

34 "author": "Chad Garner",

35 "license": "Apache-2.0",

36 "engines": {

37 "node": ">=20.0.0"

dist/setup.jsView file

Lines 177-217javascript

177 displayName = c.participants.join(", ");

178 }

179 else if (c.chat_identifier) {

180 displayName = c.chat_identifier;

181 }

182 else {

183 displayName = `Chat ${rowid}`