registry / vit / 0.5.1

vit@0.5.1

Social toolkit for personalized software

Static Scan Results

scanned 3mo ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 39 file(s), 199 KB of source, external domains: 127.0.0.1, bsky.social, cli.github.com, explore.v-it.org, github.com, plc.directory, public.api.bsky.app, v-it.org

Source & flagged code

4 flagged

package.jsonView file

Lines 1-36json

2 "name": "vit",

3 "version": "0.5.1",

4 "description": "Social toolkit for personalized software",

5 "license": "MIT",

6 "bin": {

7 "vit": "bin/vit.js"

8 },

9 "files": [

10 "bin/",

11 "src/",

12 "skills/vit/"

13 ],

14 "type": "module",

15 "scripts": {

16 "postinstall": "node src/postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L16

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L16

17 },

18 "engines": {

19 "node": ">=20.10.0"

20 },

21 "dependencies": {

22 "@atproto/api": "^0.18.20",

23 "@atproto/common-web": "^0.4.16",

24 "@atproto/oauth-client-node": "^0.3.16",

25 "@ipld/dag-cbor": "^9.2.0",

26 "@noble/curves": "^1.8.0",

27 "@noble/hashes": "^1.7.0",

28 "@scure/bip39": "2.0.1",

29 "bs58": "^6.0.0",

30 "commander": "^13.0.0",

31 "env-paths": "4.0.0",

32 "isomorphic-git": "1.37.0",

33 "memfs": "4.56.10"

34 },

35 "devDependencies": {

36 "marked": "^17.0.4"

src/cmd/hack.jsView file

Lines 1-23javascript

1// SPDX-License-Identifier: MIT

4import { execFileSync } from 'node:child_process';

5import { existsSync, readFileSync, writeFileSync } from 'node:fs';

High

Child Process

Package source references child process execution.

src/cmd/hack.jsView on unpkg · L3

6import { join, resolve }

src/cmd/learn.jsView file

Lines 38-78javascript

39 try {

40 const blobCid = resource.blob?.ref?.$link || resource.blob?.cid;

41 if (blobCid) {

42 const blobUrl = new

Source & flagged code

4 flagged · loading source

package.jsonView file

•scripts.postinstall = node src/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node src/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

src/cmd/hack.jsView file

3L4: import { execFileSync } from 'node:child_process'; L5: import { existsSync, readFileSync, writeFileSync } from 'node:fs';

High

Child Process

Package source references child process execution.

src/cmd/hack.jsView on unpkg · L3

src/cmd/learn.js

Findings

4 High4 Medium4 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processsrc/cmd/hack.js

HighShell

HighRuntime Package Installsrc/cmd/learn.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to vit@0.5.1.

See version security history for other recorded verdicts.

Review the evidence and your use of vit@0.5.1 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-07-04 16:25:05.255Z (UTC).