registry / vachi-claude / 0.5.0

vachi-claude@0.5.0

Route Claude Code through the Vachi gateway. Keeps your Anthropic login untouched (auth passthrough).

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 53.4 KB of source, external domains: code.claude.com, gateway.example.com, gateway.vachiai.com, vachiai.com

3 flagged

lib/activation.jsView file

Lines 1-37javascript

1'use strict';

2/**

3 * Shared Vachi activation module — vendored byte-identically into every installer

4 * (vachi-claude, vachi-codex). A parity test asserts the copies never drift.

5 *

6 * Owns everything tool-agnostic: the device-authorization grant client (Stage 1),

7 * the concurrent paste-secret fallback, key validation (ping), credential storage,

8 * new-install/welcome bookkeeping, and the shared logger/util helpers. Each installer's

3 flagged · loading source

lib/activation.jsView file

17const readline = require('readline'); L18: const { spawn } = require('child_process'); L19: