registry / vexp-cli / 2.2.4

vexp-cli@2.2.4

⚠ Under review

Vexp — Context Engine for AI Coding Agents. Pre-indexes your codebase into a dependency graph and delivers ranked context to any MCP-compatible agent. 58% lower cost per task, 90% fewer tool calls (SWE-bench Verified). Works with Claude Code, Cursor, Copi

Static Scan Results

scanned 5h ago · by rust-scanner

Static analysis flagged 18 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 16 file(s), 1.38 MB of source, external domains: 127.0.0.1, dub.sh, git.io, github.com, json-schema.org, opencode.ai, raw.githubusercontent.com, registry.npmjs.org, vexp.dev, www.apple.com

Source & flagged code

9 flagged

dist/autostart.jsView file

Lines 1-23javascript

1import * as fs from "fs";

2import * as os from "os";

3import * as path from "path";

4import { execFileSync, spawnSync } from "child_process";

5import { migrateClaudeCodeUnpin } from "./agent-config.js";

High

Child Process

Package source references child process execution.

dist/autostart.jsView on unpkg · L3

6const LABEL = "io.vexp.serve";

7const BEGIN_MARKER = "# vexp-autostart-begin";

8const END_MARKER = "# vexp-autostart-end";

9const INSTALL_MARKER_FILE = "autostart-installed";

10function homedir() {

11 return os.homedir();

12}

13function installMarkerPath() {

14 return path.join(homedir(), ".vexp", INSTALL_MARKER_FILE);

15}

16/** Resolve the launcher the OS should execute. Prefers the `vexp` bin in

17 * PATH; falls back to node+dist/cli.cjs if invoked from a dev checkout. */

18function resolveLauncher() {

19 if (process.env.VEXP_AUTOSTART_LAUNCHER) {

20 const parts = process.env.VEXP_AUTOSTART_LAUNCHER.split(" ");

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/autostart.jsView on unpkg · L3

21 return { bin: parts[0], args: [...parts.slice(1), "serve"] };

22 }

23 // `vexp` launches the commander CLI with argv-dispatch; argv[2] = "serve".

Lines 234-274javascript

234 continue;

235 const cleaned = content.replace(new RegExp(`${BEGIN_MARKER}[\\s\\S]*?${END_MARKER}\\n?`), "");

mcp/mcp-server.cjsView file

4|| (${o} === "string" && ${a} && ${a} == +${a} && !(${a} % 1))`).assign(s,(0,M._)`+${a}`);return;case"boolean":n.elseIf((0,M._)`${a} === "false" || ${a} === 0 || ${a} === null`).as... L5: || ${o} === "boolean" || ${a} === null`).assign(s,(0,M._)`[${a}]`)}}}function IP({gen:t,parentData:e,parentDataProperty:r},n){t.if((0,M._)`${e} !== undefined`,()=>t.assign((0,M._)`... L6: missingProperty: ${n}, ... L8: deps: ${r}}`};var Y9={keyword:"dependencies",type:"object",schemaType:"object",error:Kt.error,code(t){let[e,r]=Q9(t);Sb(t,e),Eb(t,r)}};function Q9({schema:t}){let e={},r={};for(let... L9: at `+t[r].toString();return e}function HO(t){if(!t)throw new TypeError("argument namespace is required");var e=Sc(),r=Sa(e[1]),n=r[0];function a(i){kc.call(a,i)}return a._file=n,a.... L10: `,"utf8")}}}

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

mcp/mcp-server.cjsView on unpkg · L4

1"use strict";var l4=Object.create;var Ou=Object.defineProperty;var d4=Object.getOwnPropertyDescriptor;var f4=Object.getOwnPropertyNames;var m4=Object.getPrototypeOf,h4=Object.proto... L2: `:""},this._extScope=e,this._scope=new Ot.Scope({parent:e}),this._nodes=[new nl]}toString(){return this._root.render(this.opts)}name(e){return this._scope.name(e)}scopeName(e){retu... L3: || (${o} == "string" && ${a} && ${a} == +${a})`).assign(s,(0,M._)`+${a}`);return;case"integer":n.elseIf((0,M._)`${o} === "boolean" || ${a} === null L4: || (${o} === "string" && ${a} && ${a} == +${a} && !(${a} % 1))`).assign(s,(0,M._)`+${a}`);return;case"boolean":n.elseIf((0,M._)`${a} === "false" || ${a} === 0 || ${a} === null`).as... L5: || ${o} === "boolean" || ${a} === null`).assign(s,(0,M._)`[${a}]`)}}}function IP

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

mcp/mcp-server.cjsView on unpkg · L1

dist/version.jsView file

Lines 1-5javascript

1import { createRequire } from "module";

2const require = createRequire(import.meta.url);

3const pkg = require("../package.json"

dist/cli.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = vexp-cli@2.2.2 matchedIdentity = npm:dmV4cC1jbGk:2.2.2 similarity = 0.800 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.jsView on unpkg

Source & flagged code

9 flagged · loading source

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code