Static Scan Results
scanned 2h ago · by rust-scannerStatic analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
One or more suspicious static signals were detected.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
4 flagged · loading sourcedist/index.jsView file
15009import { join as join19 } from "path";
L15010: import { spawnSync as spawnSync5 } from "child_process";
L15011:
High
15113const result = spawnSync5(cmd, {
L15114: shell: true,
L15115: ...timeoutMs !== undefined ? { timeout: timeoutMs } : {},
High
12812# ── Local engine URLs (auto-detected, change if non-standard) ─────────────────
L12813: ollamaBaseUrl: http://localhost:11434 # Ollama
L12814: lmstudioBaseUrl: http://localhost:1234 # LM Studio
...
L15009: import { join as join19 } from "path";
L15010: import { spawnSync as spawnSync5 } from "child_process";
L15011:
...
L18859: try {
L18860: const content = readFileSync(yamlPath, "utf8");
L18861: return $parse(content);
High
Remote Agent Bridge
Source exposes local file and command tools to a remote model endpoint.
dist/index.jsView on unpkg · L128122481if (typeof node_buffer.Buffer === "function") {
L2482: return node_buffer.Buffer.from(src, "base64");
L2483: } else if (typeof atob === "function") {
...
L4943: yield* this.next(token);
L4944: yield* this.end(forceDoc, endOffset);
L4945: }
L4946: *next(token) {
L4947: if (node_process.env.LOG_STREAM)
L4948: console.dir(token, { depth: null });
...
L12741: mkdirSync2(VENZARI_DIR, { recursive: true });
L12742: if (process.platform !== "win32") {
L12743: try {
Medium
Install Persistence
Source writes installer persistence such as shell profile or service configuration.
dist/index.jsView on unpkg · L2481Findings
3 High4 Medium5 Low
HighChild Processdist/index.js
HighShelldist/index.js
HighRemote Agent Bridgedist/index.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/index.js
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings