registry / vaxcode-cli / 0.5.1

vaxcode-cli@0.5.1

The AI coding agent for the terminal — chat, edit, run, and ship from your shell.

Static Scan Results

scanned 47m ago · by rust-scanner

Static analysis flagged 9 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 58 file(s), 772 KB of source, external domains: 127.0.0.1, api.b.ai, api.cerebras.ai, api.deepseek.com, api.groq.com, api.openai.com, api.x.ai, chat.b.ai, console.x.ai, duckduckgo.com, example.com, github.com, inference.cerebras.ai, lite.duckduckgo.com, openrouter.ai, platform.deepseek.com, raw.githubusercontent.com, react.dev, registry.npmjs.org, vaxcode.local

Source & flagged code

2 flagged

server/db.mjsView file

Lines 1-41javascript

1// server/db.mjs — SQLite backing store for VAXCODE state.

2//

3// Opens a database at ~/.vaxcode/state.db (override with VAXCODE_DATA_DIR).

4// Uses better-sqlite3's synchronous API, which fits store.mjs's in-memory

5// cache + debounced flush pattern: reads are synchronous, writes are

6// synchronous and atomic.

7//

8// Schema is intentionally minimal — a single `kv` table holds the whole

9// state blob as JSON under key 'appstate'. This preserves the exact state

10// shape without over-normalizing. A separate `agent_runs` table supports

11// future agent-run resume (storage layer only, not wired into agent.mjs).

13import { mkdirSync, renameSync, existsSync } from "node:fs";

14import os from "node:os";

15import path from "node:path";

16import { createRequire } from "node:module";

18const require = createRequire(import.meta.url);

19let Database = null;

20let dbLoadError = null;

21try {

22 Database = require("better-sqlite3");

23} catch (error) {

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

server/db.mjsView on unpkg · L21

24 // The native module may fail to load when the Node.js version doesn't

25 // match the one it was compiled for (e.g. CLI uses system Node while

26 // the desktop app uses Electron's Node). We degrade gracefully — the

27 // CLI falls back to env vars / config file for settings.

28 dbLoadError = error;

29}

31const STATE_KEY = "appstate";

33function dataDir() {

34 return path.resolve(process.env.VAXCODE_DATA_DIR || path.join(os.homedir(), ".vaxcode"));

35}

37function dbPath() {

38 return path.join(dataDir(), "state.db");

39}

41let db = null;

server/terminalPool.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = vaxcode-cli@0.4.5 matchedIdentity = npm:dmF4Y29kZS1jbGk:0.4.5 similarity = 0.948 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

server/terminalPool.mjsView on unpkg

Source & flagged code

2 flagged · loading source

server/db.mjsView file

21package = vaxcode-cli; repositoryIdentity = vaxcode; dependency = better-sqlite3 L21: try { L22: Database = require("better-sqlite3"); L23: } catch (error) {

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

server/db.mjsView on unpkg · L21

server/terminalPool.mjsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

server/terminalPool.mjsView on unpkg

Findings

2 High3 Medium4 Low

HighCopied Package Dependency Bridgeserver/db.mjs

HighPrevious Version Dangerous Deltaserver/terminalPool.mjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

server/db.mjsView file

Lines 1-41javascript

1// server/db.mjs — SQLite backing store for VAXCODE state.

2//

3// Opens a database at ~/.vaxcode/state.db (override with VAXCODE_DATA_DIR).

4// Uses better-sqlite3's synchronous API, which fits store.mjs's in-memory

5// cache + debounced flush pattern: reads are synchronous, writes are

6// synchronous and atomic.

7//

8// Schema is intentionally minimal — a single `kv` table holds the whole

9// state blob as JSON under key 'appstate'. This preserves the exact state

10// shape without over-normalizing. A separate `agent_runs` table supports

11// future agent-run resume (storage layer only, not wired into agent.mjs).

13import { mkdirSync, renameSync, existsSync } from "node:fs";

14import os from "node:os";

15import path from "node:path";

16import { createRequire } from "node:module";

18const require = createRequire(import.meta.url);

19let Database = null;

20let dbLoadError = null;

21try {

22 Database = require("better-sqlite3");

23} catch (error) {

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

server/db.mjsView on unpkg · L21

24 // The native module may fail to load when the Node.js version doesn't

25 // match the one it was compiled for (e.g. CLI uses system Node while

26 // the desktop app uses Electron's Node). We degrade gracefully — the

27 // CLI falls back to env vars / config file for settings.

28 dbLoadError = error;

29}

31const STATE_KEY = "appstate";

33function dataDir() {

34 return path.resolve(process.env.VAXCODE_DATA_DIR || path.join(os.homedir(), ".vaxcode"));

35}

37function dbPath() {

38 return path.join(dataDir(), "state.db");

39}

41let db = null;

server/terminalPool.mjsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

server/terminalPool.mjsView on unpkg