registry / weave-ai-cli / 0.0.1

weave-ai-cli@0.0.1

Static Scan Results

scanned 13d ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 57 file(s), 558 KB of source, external domains: 127.0.0.1, api.anthropic.com, api.deepseek.com, api.github.com, api.openai.com, api.siliconflow.cn, example.com, schemas.openxmlformats.org, www.bing.com, your-claude-proxy.example.com, your-domain.com, your-proxy.example.com

Source & flagged code

3 flagged

bin/cli.jsView file

7const distPath = resolve(__dirname, '../dist/index.js'); L8: const { main } = await import(pathToFileURL(distPath).href); L9: main();

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/cli.jsView on unpkg · L7

dist/tools.jsView file

4import * as readline from 'node:readline'; L5: import { execSync } from 'node:child_process'; L6: import { C } from './utils.js'; ... L215: case 'web_search': return execWebSearch(call); L216: case 'web_fetch': return execWebFetch(call); L217: case 'list_agents': return execListAgents(call); ... L291: ? (path.isAbsolute(call.input.dir_path) ? call.input.dir_path : path.resolve(call.input.dir_path)) L292: : process.cwd(); L293: const filePattern = call.input.file_pattern; ... L464: catch (e) { L465: const errMsg = e.stderr || e.stdout || e.message; L466: return { tool_call_id: call.id, content: `Command failed:\n${errMsg}`.slice(0, 2000), is_error: true };

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/tools.jsView on unpkg · L4

weave.cmdView file

•path = weave.cmd kind = build_helper sizeBytes = 742 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

weave.cmdView on unpkg