registry / xtrm-tools / 0.10.6

xtrm-tools@0.10.6

Claude Code tools installer (skills, hooks, MCP servers)

Static Scan Results

scanned 6h ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 13 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 49 file(s), 486 KB of source, external domains: chat.qwen.ai, dashscope.aliyuncs.com, github.com, mcp.grep.app, registry.npmjs.org, xtrm.dev

Oversized source lightweight scan

cli/dist/index.cjs2.78 MB file, sampled 256 KB

FilesystemChildProcessEnvironmentVarsCryptoHighEntropyStringsUrlStringsgithub.comregistry.npmjs.orgxtrm.dev

Source & flagged code

5 flagged

packages/pi-extensions/extensions/xtrm-ui/index.tsView file

Lines 155-195typescript

155 if (realArgvPath.endsWith("/dist/cli.js")) {

156 candidates.push(join(dirname(realArgvPath), "index.js"));

157 }

158 }

159

160 candidates.push(

161 join(dirname(process.execPath), "..", "lib", "node_modules", "@earendil-works", "pi-coding-agent", "dist", "index.js"),

162 );

163

164 try {

165 candidates.push(maybeFileUrlToPath(import.meta.resolve("@earendil-works/pi-coding-agent")));

166 } catch {}

167

168 const entryPath = candidates.find((candidate) => existsSync(candidate));

169 if (!entryPath) throw new Error("Could not resolve pi-coding-agent entry path");

170 return entryPath;

171}

172

173async function installSilentHiddenThinkingPatch(): Promise<void> {

174 const entryPath = resolvePiCodingAgentEntryPath();

175 const componentPath = join(dirname(entryPath), "modes", "interactive", "components", "assistant-message.js");

176 const mod = await import(pathToFileURL(componentPath).href) as {

177 AssistantMessageComponent?: AssistantMessageComponentCtor;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

packages/pi-extensions/extensions/xtrm-ui/index.tsView on unpkg · L175

178 };

179 const proto = mod.AssistantMessageComponent?.prototype as

180 | (AssistantMessageComponentCtor["prototype"] & { [PATCHED_ASSISTANT_MESSAGE]?: boolean })

181 | undefined;

182 if (!proto?.updateContent || proto[PATCHED_ASSISTANT_MESSAGE]) return;

183

184 const updateContent = proto.updateContent;

185 proto.updateContent = function patchedUpdateContent(this: PatchableAssistantMessage, message: AssistantMessageLike) {

186 if (this.hiddenThinkingLabel === "" && Array.isArray(message.content)) {

187 if (!this.__xtrmThinkingExpanded) {

188 updateContent.call(this, {

189 ...message,

190 content: message.content.filter((block) => block.type !== "thinking" || !block.thinking?.trim()),

191 });

192 return;

193 }

194

195 const previousHideThinking = this.hideThinkingBlock;

.xtrm/hooks/quality-check.pyView file

•path = .xtrm/hooks/quality-check.py kind = payload_in_excluded_dir sizeBytes = 13403 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.xtrm/hooks/quality-check.pyView on unpkg

•path = .xtrm/hooks/quality-check.py kind = build_helper sizeBytes = 13403 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

.xtrm/hooks/quality-check.pyView on unpkg

cli/dist/index.cjsView file

•path = cli/dist/index.cjs kind = oversized_source_file sizeBytes = 2917852 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

cli/dist/index.cjsView on unpkg

•path = cli/dist/index.cjs kind = oversized_cli_entrypoint sizeBytes = 2917852 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

cli/dist/index.cjsView on unpkg

Source & flagged code

5 flagged · loading source

packages/pi-extensions/extensions/xtrm-ui/index.tsView file

175const componentPath = join(dirname(entryPath), "modes", "interactive", "components", "assistant-message.js"); L176: const mod = await import(pathToFileURL(componentPath).href) as { L177: AssistantMessageComponent?: AssistantMessageComponentCtor;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

packages/pi-extensions/extensions/xtrm-ui/index.tsView on unpkg · L175

.xtrm/hooks/quality-check.pyView file

•path = .xtrm/hooks/quality-check.py kind = payload_in_excluded_dir sizeBytes = 13403 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.xtrm/hooks/quality-check.pyView on unpkg

•path = .xtrm/hooks/quality-check.py kind = build_helper sizeBytes = 13403 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

.xtrm/hooks/quality-check.pyView on unpkg

cli/dist/index.cjsView file

•path = cli/dist/index.cjs kind = oversized_source_file sizeBytes = 2917852 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

cli/dist/index.cjsView on unpkg

•path = cli/dist/index.cjs kind = oversized_cli_entrypoint sizeBytes = 2917852 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

cli/dist/index.cjsView on unpkg

Findings

2 High6 Medium5 Low

HighPayload In Excluded Dir.xtrm/hooks/quality-check.py

HighOversized Source Filecli/dist/index.cjs

MediumDynamic Requirepackages/pi-extensions/extensions/xtrm-ui/index.ts

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helper.xtrm/hooks/quality-check.py

MediumOversized Cli Entrypointcli/dist/index.cjs

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

5 flagged

packages/pi-extensions/extensions/xtrm-ui/index.tsView file

Lines 155-195typescript

155 if (realArgvPath.endsWith("/dist/cli.js")) {

156 candidates.push(join(dirname(realArgvPath), "index.js"));

157 }

158 }

159

160 candidates.push(

161 join(dirname(process.execPath), "..", "lib", "node_modules", "@earendil-works", "pi-coding-agent", "dist", "index.js"),

162 );

163

164 try {

165 candidates.push(maybeFileUrlToPath(import.meta.resolve("@earendil-works/pi-coding-agent")));

166 } catch {}

167

168 const entryPath = candidates.find((candidate) => existsSync(candidate));

169 if (!entryPath) throw new Error("Could not resolve pi-coding-agent entry path");

170 return entryPath;

171}

172

173async function installSilentHiddenThinkingPatch(): Promise<void> {

174 const entryPath = resolvePiCodingAgentEntryPath();

175 const componentPath = join(dirname(entryPath), "modes", "interactive", "components", "assistant-message.js");

176 const mod = await import(pathToFileURL(componentPath).href) as {

177 AssistantMessageComponent?: AssistantMessageComponentCtor;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

packages/pi-extensions/extensions/xtrm-ui/index.tsView on unpkg · L175

178 };

179 const proto = mod.AssistantMessageComponent?.prototype as

180 | (AssistantMessageComponentCtor["prototype"] & { [PATCHED_ASSISTANT_MESSAGE]?: boolean })

181 | undefined;

182 if (!proto?.updateContent || proto[PATCHED_ASSISTANT_MESSAGE]) return;

183

184 const updateContent = proto.updateContent;

185 proto.updateContent = function patchedUpdateContent(this: PatchableAssistantMessage, message: AssistantMessageLike) {

186 if (this.hiddenThinkingLabel === "" && Array.isArray(message.content)) {

187 if (!this.__xtrmThinkingExpanded) {

188 updateContent.call(this, {

189 ...message,

190 content: message.content.filter((block) => block.type !== "thinking" || !block.thinking?.trim()),

191 });

192 return;

193 }

194

195 const previousHideThinking = this.hideThinkingBlock;

.xtrm/hooks/quality-check.pyView file

•path = .xtrm/hooks/quality-check.py kind = payload_in_excluded_dir sizeBytes = 13403 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.xtrm/hooks/quality-check.pyView on unpkg

•path = .xtrm/hooks/quality-check.py kind = build_helper sizeBytes = 13403 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

.xtrm/hooks/quality-check.pyView on unpkg

cli/dist/index.cjsView file

•path = cli/dist/index.cjs kind = oversized_source_file sizeBytes = 2917852 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

cli/dist/index.cjsView on unpkg

•path = cli/dist/index.cjs kind = oversized_cli_entrypoint sizeBytes = 2917852 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

cli/dist/index.cjsView on unpkg