registry  /  workspai  /  0.43.0

workspai@0.43.0

Open-source workspace intelligence CLI for software systems: create, adopt, govern, verify, and align polyglot workspaces for humans, CI, IDEs, and AI agents.

Static Scan Results

scanned 4h ago · by rust-scanner

Static analysis flagged 19 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
Supply chain
HighEntropyStringsMinifiedUrlStrings
Manifest
WildcardDependency
scanned 94 file(s), 1.08 MB of source, external domains: 0.0.0.0, 127.0.0.1, admin.example.com, adoptium.net, anywhere.com, app.example.com, dotnet.microsoft.com, evil.com, example.com, gin-gonic.com, github.com, go.dev, gofiber.io, golangci-lint.run, gradle.org, maven.apache.org, platform.openai.com, pypa.github.io, python-poetry.org, python.org, workspai.dev, www.python.org, www.w3.org

Source & flagged code

9 flagged · loading source
package.jsonView file
•scripts.postinstall = node scripts/check-cli-resolution.cjs
High
Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg
dist/index.jsView file
1#!/usr/bin/env node L2: import {a as a$d}from'./chunk-ICGWHIMK.js';import {b as b$5,a as a$3}from'./chunk-LO4C4VXR.js';import {a as a$b}from'./chunk-3ZK2GU7C.js';import {b as b$6,d as d$3,a as a$2,c as c$... L3: \u274C Invalid API key format (should start with sk-)
High
Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L1
146\u274C ${r instanceof Error?r.message:String(r)} L147: `)),process.exit(1);}});}function ol(t){try{let e=v.join(t,"Makefile");return P.existsSync(e)?P.readFileSync(e,"utf8"):""}catch{return ""}}function ze(t,e){let o=ol(t);return o?new... L148: ${r.stderr||""}`,i=n.match(/version\s+"([^"]+)"/i);if(i?.[1])return this.parseMajorJavaVersion(i[1]);let a=n.match(/(?:openjdk|java)\s+(\d+(?:[._]\d+)?)/i);return a?.[1]?this.parse...
High
Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L146
1Cross-file remote execution chain: dist/index.js spawns dist/demo-kit-AJ5LIM5G.js; helper contains network access plus dynamic code execution. L1: #!/usr/bin/env node L2: import {a as a$d}from'./chunk-ICGWHIMK.js';import {b as b$5,a as a$3}from'./chunk-LO4C4VXR.js';import {a as a$b}from'./chunk-3ZK2GU7C.js';import {b as b$6,d as d$3,a as a$2,c as c$... L3: \u274C Invalid API key format (should start with sk-) ... L33: `)),true}catch(a){i.fail("Failed to generate embeddings");let l=zs(a);return l.includes("429")?(console.log(s.red(` L34: \u274C OpenAI API quota exceeded`)),console.log(s.yellow(`Please check your billing: https://platform.openai.com/account/billing L35: `))):l.includes("401")?(console.log(s.red(` ... L103: `)),console.log(s.white(`Set your API key: workspai config set-api-key L104: `)),process.exit(1)),Oo(o);let r=await Xs();process.exit(r?0:1);}catch(o){let r=Nr(o);f.error("Failed to update embeddings:",r.message),process.exit(1);}});}var dc="rapidkit.produc... L105: `,"utf-8");}function kc(t,e){let o=v.join(".workspai","product-factory","manifests",`${e}.manifest.json`);return t?t.endsWith(".json")?t:v.join(t,`${e}.manifest.json`):o}function v... ... L114: `));}fu…
High
Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/index.jsView on unpkg · L1
1#!/usr/bin/env node L2: import {a as a$d}from'./chunk-ICGWHIMK.js';import {b as b$5,a as a$3}from'./chunk-LO4C4VXR.js';import {a as a$b}from'./chunk-3ZK2GU7C.js';import {b as b$6,d as d$3,a as a$2,c as c$... L3: \u274C Invalid API key format (should start with sk-) ... L33: `)),true}catch(a){i.fail("Failed to generate embeddings");let l=zs(a);return l.includes("429")?(console.log(s.red(` L34: \u274C OpenAI API quota exceeded`)),console.log(s.yellow(`Please check your billing: https://platform.openai.com/account/billing L35: `))):l.includes("401")?(console.log(s.red(` ... L103: `)),console.log(s.white(`Set your API key: workspai config set-api-key L104: `)),process.exit(1)),Oo(o);let r=await Xs();process.exit(r?0:1);}catch(o){let r=Nr(o);f.error("Failed to update embeddings:",r.message),process.exit(1);}});}var dc="rapidkit.produc... L105: `,"utf-8");}function kc(t,e){let o=v.join(".workspai","product-factory","manifests",`${e}.manifest.json`);return t?t.endsWith(".json")?t:v.join(t,`${e}.manifest.json`):o}function v... ... L114: `));}function si(t){let e=t.command("product",{hidden:true}).description("Product Factory commands for private workspace product manifests");e.command(
Medium
Unsafe Vm Context

Package source executes code through a VM context API.

dist/index.jsView on unpkg · L1
1#!/usr/bin/env node L2: import {a as a$d}from'./chunk-ICGWHIMK.js';import {b as b$5,a as a$3}from'./chunk-LO4C4VXR.js';import {a as a$b}from'./chunk-3ZK2GU7C.js';import {b as b$6,d as d$3,a as a$2,c as c$... L3: \u274C Invalid API key format (should start with sk-) ... L33: `)),true}catch(a){i.fail("Failed to generate embeddings");let l=zs(a);return l.includes("429")?(console.log(s.red(` L34: \u274C OpenAI API quota exceeded`)),console.log(s.yellow(`Please check your billing: https://platform.openai.com/account/billing L35: `))):l.includes("401")?(console.log(s.red(` ... L103: `)),console.log(s.white(`Set your API key: workspai config set-api-key L104: `)),process.exit(1)),Oo(o);let r=await Xs();process.exit(r?0:1);}catch(o){let r=Nr(o);f.error("Failed to update embeddings:",r.message),process.exit(1);}});}var dc="rapidkit.produc... L105: `,"utf-8");}function kc(t,e){let o=v.join(".workspai","product-factory","manifests",`${e}.manifest.json`);return t?t.endsWith(".json")?t:v.join(t,`${e}.manifest.json`):o}function v... ... L114: `));}function si(t){let e=t.command("product",{hidden:true}).description("Product Factory commands for private workspace product manifests");e.command(
Low
Weak Crypto

Package source references weak cryptographic algorithms.

dist/index.jsView on unpkg · L1
dist/chunk-AFSZHLQT.jsView file
1import {b as b$1}from'./chunk-JHC6SCJC.js';import {j as j$1}from'./chunk-RE773WOX.js';import {c}from'./chunk-LUP4U6EE.js';import {a}from'./chunk-Y45WZR5N.js';import {f}from'./chunk...
Medium
Dynamic Require

Package source references dynamic require/import behavior.

dist/chunk-AFSZHLQT.jsView on unpkg · L1
dist/chunk-LPZFK3Y6.jsView file
1import {f as f$1,e as e$2}from'./chunk-AFSZHLQT.js';import {b as b$2}from'./chunk-JHC6SCJC.js';import {e,g,f as f$2,b as b$4,c as c$3,d as d$2}from'./chunk-RE773WOX.js';import {a a... L2: __pycache__/ ... L39: verify_integrity: false L40: `}async function De(){try{let{stdout:t}=await execa("go",["version"],{timeout:3e3,stdio:"pipe"}),o=t.match(/go(\d+\.\d+(?:\.\d+)?)/i);return o?o[1]:void 0}catch{return}}async funct... L41: `,"utf-8"),f.debug(`Created .python-version with ${o}`);}catch(n){f.warn(`Failed to create .python-version: ${n}`);}}function H(){let n=[...(process.env.PATH||"").split(y.delimiter... L42: ... L122: exit /b 1 L123: `}async function he(t,o,n={}){await k.outputFile(y.join(t,"rapidkit"),et(o,n),{encoding:"utf-8",mode:493}),await k.outputFile(y.join(t,"rapidkit.cmd"),tt(o,n),"utf-8");}async funct... L124: \u{1F4CC} Configuration notes:`)),I.pythonVersion==="3.10"?console.log(e$1.gray(" \u2022 Python 3.10: Latest stable with widespread compatibility")):I.pythonVersion==="3.11"?conso... ... L156: `)),console.log(e$1.gray("\u{1F4A1} No Python required \u2014 Go kits run entirely through the npm package."));try{let{stdout:x}=await execa("go",["version"],{timeout:3
High
Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/chunk-LPZFK3Y6.jsView on unpkg · L1
1import {f as f$1,e as e$2}from'./chunk-AFSZHLQT.js';import {b as b$2}from'./chunk-JHC6SCJC.js';import {e,g,f as f$2,b as b$4,c as c$3,d as d$2}from'./chunk-RE773WOX.js';import {a a... L2: __pycache__/
High
Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/chunk-LPZFK3Y6.jsView on unpkg · L1

Findings

7 High6 Medium6 Low
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/index.js
HighShell
HighSame File Env Network Executiondist/index.js
HighSandbox Evasion Gated Capabilitydist/chunk-LPZFK3Y6.js
HighCross File Remote Execution Contextdist/index.js
HighRuntime Package Installdist/chunk-LPZFK3Y6.js
MediumDynamic Requiredist/chunk-AFSZHLQT.js
MediumUnsafe Vm Contextdist/index.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumWildcard Dependency
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Cryptodist/index.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings