registry / xibecode / 1.4.2

xibecode@1.4.2

AI-powered autonomous coding assistant with AI test generation, multi-model support, and plugin system

Static Scan Results

scanned 16h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 65 file(s), 670 KB of source, external domains: ai.xibebase.in, api.openai.com, api.telegram.org, cli.github.com, cloud.xibeai.in, discord.com, github.com, registry.npmjs.org, slack.com, www.npmjs.com

Source & flagged code

4 flagged

dist/ui/claude-style-chat.jsView file

Lines 1-23javascript

1import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";

2import React, { useCallback, useEffect, useMemo, useRef, useState } from 'react';

3import { createRequire } from 'module';

4import { spawn } from 'child_process';

5import TextInput from 'ink-text-input';

High

Child Process

Package source references child process execution.

dist/ui/claude-style-chat.jsView on unpkg · L3

6import { Box, Static, Text, createRoot, useApp, useInput } from '../ink.js';

7import * as fs from 'fs/promises';

8import * as path from 'path';

9import { ConfigManager, PROVIDER_CONFIGS, listSetupProviders } from '../utils/config.js';

10import { EnhancedAgent } from 'xibecode-core';

11const pkg = createRequire(import.meta.url)('../../package.json');

12import { CodingToolExecutor, NeuralMemory } from 'xibecode-core';

13import { MCPClientManager } from 'xibecode-core';

14import { SkillManager } from 'xibecode-core';

15import { builtInSkillsDir } from '../utils/built-in-skills-dir.js';

16import { ENABLED_MODES, MODE_CONFIG } from 'xibecode-core';

17import { renderAndRun } from '../interactiveHelpers.js';

18import { AssistantMarkdown } from '../components/AssistantMarkdown.js';

19import { formatToolArgs, formatToolOutcome, formatRunSwarmDetailLines } from '../utils/tool-display.js';

20import { SPINNER_VERBS } from '../constants/spinnerVerbs.js';

21import { collectImageReferencesForPrompt } from 'xibecode-core';

22import { loadImageAttachment, mimeFromExtension } from '../utils/image-attachments.js';

23import { SessionManager } from 'xibecode-core';

dist/commands/diagnostics.jsView file

Lines 1-29javascript

1import * as fs from 'fs/promises';

2import * as path from 'path';

3import { createRequire } from 'module';

dist/ui/enhanced-tui.jsView file

Lines 1-25javascript

1import chalk from 'chalk';

2import ora from 'ora';

3import { formatRunSwarmDetailLines, formatToolOutcome } from '../utils/tool-display.js';

4import { getTheme } from './themes.js';

dist/commands/mcp.jsView file

Lines 203-238javascript

203 name: 'query',

204 message: 'Search query:'

205 }]);

206 await handleSearch(ui, query);

207 // Prompt to install from search results?

208 // For simplicity, just list for now and let user copy command.

Source & flagged code

4 flagged · loading source

dist/ui/claude-style-chat.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code