registry / virgil-cli / 0.1.8

virgil-cli@0.1.8

⚠ Under review

Virgil in your terminal — an AI agent that does real work on your machine. No account, no store, one command.

Static Scan Results

scanned 14h ago · by rust-scanner

Static analysis completed at 93.0% confidence. No malicious behavior was detected; 16 low-signal pattern(s) were surfaced and cleared.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 42 file(s), 314 KB of source, external domains: 127.0.0.1, api.nm-streetwear.space, github.com, huggingface.co, www.google.com

Source & flagged code

8 flagged

dist/tools/mutationFix.jsView file

Lines 1-26javascript

1// ── fix_by_mutation: find a one-token fix by trying small changes and letting the TEST decide. ──

2// No model involved. Producing a candidate is blind search; checking it is cheap and unbiased (run the test).

3// Works only when the bug is a small change (an operator, a constant, a boolean). Otherwise it says so.

4import { readFile, writeFile, mkdir } from "node:fs/promises";

5import { homedir } from "node:os";

6import { join } from "node:path";

7import { spawn } from "node:child_process";

8import { resolvePath, errMessage } from "./util.js";

High

Child Process

Package source references child process execution.

dist/tools/mutationFix.jsView on unpkg · L6

9import { onInterrupt } from "../interrupt.js";

10import { generate, order, applyCand } from "./repairEngine.js";

11import { failSet, crashed } from "./failset.js";

12const CMP = {

13 "<": [">", "<=", ">="],

14 ">": ["<", ">=", "<="],

15 "<=": [">=", "<", ">"],

16 ">=": ["<=", ">", "<"],

17 "===": ["!=="],

18 "!==": ["==="],

19 "==": ["!="],

20 "!=": ["=="],

21};

22const MAX_CANDIDATES = 80;

23const MAX_FILE = 200_000;

24/** Walk the source (skipping strings and comments) and list every small change we could try. */

25function candidates(src) {

26 const out = [];

Lines 103-143javascript

103 i += 2;

104 continue;

105 }

106 if (two === "||") {

107 add(i, i + 2, "&&", 2);

dist/tools/bibRepair.js#virtual:normalized:round1View file

264* Measured 05.10.2026 on a file that itself contains regexes (judge.ts): opening the already-escaped L265: * pattern dropped real metacharacters like `[^"]*` into it, the result was invalid, and the client threw\n * away 3 of 6 correct answers. The snippet is literal text, so escaping i... L266: ? { body: { id: t.id, description: t.description, pattern: t.pattern, flags: t.flags, replacement: t.replacement, explanation: t.explanation } }

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/tools/bibRepair.js#virtual:normalized:round1View on unpkg · L264

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/tools/bibRepair.js#virtual:normalized:round1View on unpkg · L264

264Trigger-reachable command-output exfiltration chain: scripts.dev -> dist/index.js -> dist/tools/index.js -> dist/tools/bibRepair.js L264: * Measured 05.10.2026 on a file that itself contains regexes (judge.ts): opening the already-escaped L265: * pattern dropped real metacharacters like `[^"]*` into it, the result was invalid, and the client threw\n * away 3 of 6 correct answers. The snippet is literal text, so escaping i... L266: ? { body: { id: t.id, description: t.description, pattern: t.pattern, flags: t.flags, replacement: t.replacement, explanation: t.explanation } }

dist/setup.jsView file

Lines 1-24javascript

1// ── `virgil setup` — der Rechner des Nutzers denkt selbst, ohne dass der Nutzer etwas tut. ──

2// Holt beim ersten Start den llama.cpp-Server und das kleine Modell nach ~/.virgil, startet es auf 8089

3// und schaltet den lokalen Betrieb ein. Keine Webseite, keine Anleitung, keine Rückfrage.

4// Das Modell spricht nur; gefunden und behoben wird im Code (siehe fixroute.ts). Darum reicht ein kleines.

5import { spawn } from "node:child_process";

6import { mkdir, chmod, rm, stat } from "node:fs/promises";

dist/coderoute.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = virgil-cli@0.1.2 matchedIdentity = npm:dmlyZ2lsLWNsaQ:0.1.2 similarity = 0.375 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/coderoute.jsView on unpkg

Source & flagged code

8 flagged · loading source

dist/tools/mutationFix.jsView file

virgil-cli@0.1.8

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code