registry  /  venzari-code  /  0.3.1

venzari-code@0.3.1

Governance-enforced engineering runtime — wraps OpenCode via ACP with mode engine, tool guard, evidence collection, and task lifecycle

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
Supply chain
HighEntropyStringsUrlStrings
ManifestNo manifest risk signals triggered.
scanned 1 file(s), 939 KB of source, external domains: aistudio.google.com, api.anthropic.com, api.cerebras.ai, api.cohere.ai, api.deepseek.com, api.fireworks.ai, api.github.com, api.groq.com, api.mistral.ai, api.openai.com, api.perplexity.ai, api.together.ai, api.x.ai, bun.sh, cloud.cerebras.ai, console.anthropic.com, console.groq.com, console.mistral.ai, dashboard.cohere.com, e2b.dev, fireworks.ai, generativelanguage.googleapis.com, github.com, huggingface.co, llm.mycompany.com, lmstudio.ai, ollama.ai, openrouter.ai, platform.deepseek.com, platform.openai.com, venzari.dev, www.perplexity.ai, x.ai

Source & flagged code

4 flagged · loading source
dist/index.jsView file
15009import { join as join19 } from "path"; L15010: import { spawnSync as spawnSync5 } from "child_process"; L15011:
High
Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L15009
15113const result = spawnSync5(cmd, { L15114: shell: true, L15115: ...timeoutMs !== undefined ? { timeout: timeoutMs } : {},
High
Shell

Package source references shell execution.

dist/index.jsView on unpkg · L15113
12812# ── Local engine URLs (auto-detected, change if non-standard) ───────────────── L12813: ollamaBaseUrl: http://localhost:11434 # Ollama L12814: lmstudioBaseUrl: http://localhost:1234 # LM Studio ... L15009: import { join as join19 } from "path"; L15010: import { spawnSync as spawnSync5 } from "child_process"; L15011: ... L18859: try { L18860: const content = readFileSync(yamlPath, "utf8"); L18861: return $parse(content);
High
Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/index.jsView on unpkg · L12812
2481if (typeof node_buffer.Buffer === "function") { L2482: return node_buffer.Buffer.from(src, "base64"); L2483: } else if (typeof atob === "function") { ... L4943: yield* this.next(token); L4944: yield* this.end(forceDoc, endOffset); L4945: } L4946: *next(token) { L4947: if (node_process.env.LOG_STREAM) L4948: console.dir(token, { depth: null }); ... L12741: mkdirSync2(VENZARI_DIR, { recursive: true }); L12742: if (process.platform !== "win32") { L12743: try {
Medium
Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/index.jsView on unpkg · L2481

Findings

3 High4 Medium5 Low
HighChild Processdist/index.js
HighShelldist/index.js
HighRemote Agent Bridgedist/index.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/index.js
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings