registry / vaxcode-cli / 0.1.0

vaxcode-cli@0.1.0

The AI coding agent for the terminal — chat, edit, run, and ship from your shell.

Static Scan Results

scanned 3d ago · by rust-scanner

Static analysis flagged 8 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 57 file(s), 739 KB of source, external domains: 127.0.0.1, api.b.ai, api.cerebras.ai, api.deepseek.com, api.groq.com, api.openai.com, api.x.ai, chat.b.ai, console.x.ai, duckduckgo.com, example.com, github.com, inference.cerebras.ai, lite.duckduckgo.com, openrouter.ai, platform.deepseek.com, raw.githubusercontent.com, react.dev, registry.npmjs.org, vaxcode.local

Source & flagged code

1 flagged

cli/doctor.mjsView file

Lines 60-96javascript

60 }

61 }

63 // Workspace

64 try {

65 const testFile = path.join(state.cwd, `.vaxcode-doctor-${Date.now()}`);

66 await fs.writeFile(testFile, "ok");

67 await fs.unlink(testFile);

68 ok(`Workspace writable`, state.cwd);

69 } catch (error) {

70 fail(`Workspace writable`, `${state.cwd} — ${error.message}`);

71 }

73 // Native deps

74 try {

75 require("node-pty");

76 ok(`node-pty`, "available (embedded terminals)");

77 } catch {

78 warn(`node-pty`, "not installed — embedded terminals in desktop won't start");

79 }

80 try {

81 require("playwright-core");

82 ok(`playwright-core`, "available (browser automation)");

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

cli/doctor.mjsView on unpkg · L80

83 } catch {

84 warn(`playwright-core`, "not installed — browser tools disabled");

85 }

87 out.push("");

88 if (criticalFailures > 0) {

89 out.push(`\x1b[38;5;203m${criticalFailures} critical issue${criticalFailures === 1 ? "" : "s"}.\x1b[0m`);

90 } else {

91 out.push(`\x1b[38;5;114mAll critical checks passed.\x1b[0m`);

92 }

93 process.stdout.write(out.join("\n") + "\n");

94 return criticalFailures > 0 ? 1 : 0;

95}

Source & flagged code

1 flagged · loading source

cli/doctor.mjsView file

80package = vaxcode-cli; repositoryIdentity = vaxcode; dependency = playwright-core L80: try { L81: require("playwright-core"); L82: ok(`playwright-core`, "available (browser automation)");

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

cli/doctor.mjsView on unpkg · L80

Findings

1 High3 Medium4 Low

HighCopied Package Dependency Bridgecli/doctor.mjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

1 flagged

cli/doctor.mjsView file

Lines 60-96javascript

60 }

61 }

63 // Workspace

64 try {

65 const testFile = path.join(state.cwd, `.vaxcode-doctor-${Date.now()}`);

66 await fs.writeFile(testFile, "ok");

67 await fs.unlink(testFile);

68 ok(`Workspace writable`, state.cwd);

69 } catch (error) {

70 fail(`Workspace writable`, `${state.cwd} — ${error.message}`);

71 }

73 // Native deps

74 try {

75 require("node-pty");

76 ok(`node-pty`, "available (embedded terminals)");

77 } catch {

78 warn(`node-pty`, "not installed — embedded terminals in desktop won't start");

79 }

80 try {

81 require("playwright-core");

82 ok(`playwright-core`, "available (browser automation)");

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

cli/doctor.mjsView on unpkg · L80

83 } catch {

84 warn(`playwright-core`, "not installed — browser tools disabled");

85 }

87 out.push("");

88 if (criticalFailures > 0) {

89 out.push(`\x1b[38;5;203m${criticalFailures} critical issue${criticalFailures === 1 ? "" : "s"}.\x1b[0m`);

90 } else {

91 out.push(`\x1b[38;5;114mAll critical checks passed.\x1b[0m`);

92 }

93 process.stdout.write(out.join("\n") + "\n");

94 return criticalFailures > 0 ? 1 : 0;

95}