registry  /  vinuscli  /  2.2.8

vinuscli@2.2.8

The autonomous AI coding agent in your terminal — one key, every model.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
EnvironmentVarsNetwork
Supply chain
HighEntropyStringsMinifiedObfuscatedTrivialUrlStrings
Manifest
NoLicense
scanned 1 file(s), 516 KB of source, external domains: api.github.com, raw.githubusercontent.com

Source & flagged code

4 flagged · loading source
dist/vinus.mjsView file
1#!/usr/bin/env node L2: const _0xcb0c1b=_0x52ca;(function(_0x229324,_0x199ec3){const _0x190df5=_0x52ca,_0x288edf=_0x229324();while(!![]){try{const _0x1d068b=-parseInt(_0x190df5(0x236))/0x1+parseInt(_0x190...
High
Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/vinus.mjsView on unpkg · L1
1#!/usr/bin/env node L2: const _0xcb0c1b=_0x52ca;(function(_0x229324,_0x199ec3){const _0x190df5=_0x52ca,_0x288edf=_0x229324();while(!![]){try{const _0x1d068b=-parseInt(_0x190df5(0x236))/0x1+parseInt(_0x190...
High
Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/vinus.mjsView on unpkg · L1
1#!/usr/bin/env node L2: const _0xcb0c1b=_0x52ca;(function(_0x229324,_0x199ec3){const _0x190df5=_0x52ca,_0x288edf=_0x229324();while(!![]){try{const _0x1d068b=-parseInt(_0x190df5(0x236))/0x1+parseInt(_0x190...
High
Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

dist/vinus.mjsView on unpkg · L1
skills/github-auth/scripts/gh-env.shView file
•path = skills/github-auth/scripts/gh-env.sh kind = build_helper sizeBytes = 2606 magicHex = [redacted]
Medium
Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/github-auth/scripts/gh-env.shView on unpkg

Findings

4 High4 Medium5 Low
HighSame File Env Network Executiondist/vinus.mjs
HighCommand Output Exfiltrationdist/vinus.mjs
HighObfuscated Payload Loaderdist/vinus.mjs
HighObfuscated
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperskills/github-auth/scripts/gh-env.sh
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
LowNo License