registry / yodaman / 0.3.4

yodaman@0.3.4

YodaMan — local-first workspace intelligence. AI agent, semantic search, Graphify knowledge graphs, plugins, VS Code extension, mobile companion.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 32 file(s), 540 KB of source, external domains: 127.0.0.1, ollama.com, reactjs.org, unpkg.com, www.w3.org

Source & flagged code

6 flagged

start.jsView file

Lines 1-21javascript

1const { execSync, spawn } = require('child_process');

2const fs = require('fs');

High

Child Process

Package source references child process execution.

start.jsView on unpkg · L1

Medium

Dynamic Require

Package source references dynamic require/import behavior.

start.jsView on unpkg · L1

3const path = require('path');

4const os = require('os');

6function findGraphifyBinary() {

7 if (process.env.YODAMAN_GRAPHIFY_BIN) return process.env.YODAMAN_GRAPHIFY_BIN;

8 const pythonRoot = path.join(os.homedir(), 'Library', 'Python');

9 if (fs.existsSync(pythonRoot)) {

10 const userBin = fs.readdirSync(pythonRoot)

11 .map(version => path.join(pythonRoot, version, 'bin', 'graphify'))

12 .find(candidate => fs.existsSync(candidate));

13 if (userBin) return userBin;

14 }

15 return 'graphify';

16}

18function checkDependencies() {

19 console.log('🔍 Checking for Context Expert (ctx)...');

20 try {

21 execSync('ctx --version', { stdio: 'ignore' });

Lines 33-61javascript

33 } catch (error) {

34 console.error('❌ Error: "graphify" CLI is required and not in PATH.');

35 console.error('Install it with: python3 -m pip install --user graphifyy');

36 console.error('If it is installed outside PATH, set YODAMAN_GRAPHIFY_BIN to the graphify executable.');

37 process.exit(1);

38 }

40 console.log('🔍 Checking for Ollama...'

server.jsView file

Lines 1-26javascript

1const express = require('express');

2const cors = require('cors');

3const path = require('path');

4const fs = require

backend/interfaces/RestController.jsView file

Lines 1-25javascript

1const express = require('express');

2const path = require('path');

3const fs = require('fs');

4const os =

Source & flagged code

6 flagged · loading source

start.jsView file

1const { execSync, spawn } = require('child_process'); L2: const fs = require('fs');

High

Child Process

Package source references child process execution.

start.jsView on unpkg · L1

53stdio: 'inherit', L54: shell: true L55: });

High

Shell

Package source references shell execution.

start.jsView on unpkg · L53

1const { execSync, spawn } = require('child_process'); L2: const fs = require('fs');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

start.jsView on unpkg · L1

server.jsView file

6Manifest entrypoint (manifest.main) carries capability families absent from dist/build output: environment+network L6: // Initialize Infrastructure & Services L7: process.env.DOTENVX_QUIET = 'true'; L8: const watcherService = require('./[redacted]'); ... L34: const PORT = Number(process.env.YODAMAN_PORT || 3090); L35: const CONFIG_PATH = process.env.YODAMAN_CONFIG_PATH || path.join(__dirname, 'config.json'); L36: L37: app.use(cors()); L38: app.use(express.json()); L39: app.use(logger.requestId); ... L46: 'Content-Security-Policy', L47: "default-src 'self'; img-src 'self' data:; style-src 'self' 'unsafe-inline'; script-src 'self'; connect-src 'self' http://localhost:* http://127.0.0.1:*" L48: );

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

server.jsView on unpkg · L6

backend/interfaces/RestController.jsView file

5const crypto = require('crypto'); L6: const { execFile } = require('child_process'); L7: ... L29: const router = express.Router(); L30: const DEFAULT_CONFIG_PATH = path.join(__dirname, '../../config.json'); L31: const PLUGINS_DIR = path.resolve(__dirname, '../../plugins'); ... L59: function getConfigPath() { L60: return process.env.YODAMAN_CONFIG_PATH || DEFAULT_CONFIG_PATH; L61: } ... L63: function jsonError(res, status, message, code) { L64: return res.status(status).json({ error: message, code }); L65: }

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

backend/interfaces/RestController.jsView on unpkg · L5

1584const installScript = process.platform === 'darwin' L1585: ? 'npm install -g @context-expert/cli' L1586: : 'npm install -g @context-expert/cli'; ... L1589: L1590: execFile('/bin/sh', ['-c', installScript], { timeout: 120000 }, (err, stdout) => { L1591: if (err) {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

backend/interfaces/RestController.jsView on unpkg · L1584

Findings

5 High4 Medium5 Low

HighChild Processstart.js

HighShellstart.js

HighEntrypoint Build Divergenceserver.js

HighSandbox Evasion Gated Capabilitybackend/interfaces/RestController.js

HighRuntime Package Installbackend/interfaces/RestController.js

MediumDynamic Requirestart.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

6 flagged

start.jsView file

Lines 1-21javascript

1const { execSync, spawn } = require('child_process');

2const fs = require('fs');

High

Child Process

Package source references child process execution.

start.jsView on unpkg · L1

Medium

Dynamic Require

Package source references dynamic require/import behavior.

start.jsView on unpkg · L1

3const path = require('path');

4const os = require('os');

6function findGraphifyBinary() {

7 if (process.env.YODAMAN_GRAPHIFY_BIN) return process.env.YODAMAN_GRAPHIFY_BIN;

8 const pythonRoot = path.join(os.homedir(), 'Library', 'Python');

9 if (fs.existsSync(pythonRoot)) {

10 const userBin = fs.readdirSync(pythonRoot)

11 .map(version => path.join(pythonRoot, version, 'bin', 'graphify'))

12 .find(candidate => fs.existsSync(candidate));

13 if (userBin) return userBin;

14 }

15 return 'graphify';

16}

18function checkDependencies() {

19 console.log('🔍 Checking for Context Expert (ctx)...');

20 try {

21 execSync('ctx --version', { stdio: 'ignore' });

Lines 33-61javascript

33 } catch (error) {

34 console.error('❌ Error: "graphify" CLI is required and not in PATH.');

35 console.error('Install it with: python3 -m pip install --user graphifyy');

36 console.error('If it is installed outside PATH, set YODAMAN_GRAPHIFY_BIN to the graphify executable.');

37 process.exit(1);

38 }

40 console.log('🔍 Checking for Ollama...'

server.jsView file

Lines 1-26javascript

1const express = require('express');

2const cors = require('cors');

3const path = require('path');

4const fs = require

backend/interfaces/RestController.jsView file

Lines 1-25javascript

1const express = require('express');

2const path = require('path');

3const fs = require('fs');

4const os =

Lines 1564-1604javascript

1564 logger.info('health_install_started', { component, command: installScript });

1565

1566 execFile('/bin/sh', ['-c', installScript], { timeout: 120000 }, (err, stdout) => {

1567 if (err) {

1568 logger.error('health_install_failed', err, { component });

1569 res.json({

1570 ok: false,

1571 component,

1572 message: `Installation failed: ${err.message}. Install manually from https://ollama.com`,

1573 stdout: stdout || ''

1574 });

1575 return;

1576 }

1577 logger.info('health_install_completed', { component });

1578 res.json({ ok: true, component, message: 'Ollama installed. Restart the runtime.' });

1579 });

1580 break;

1581 }

1582

1583 case 'ctx': {

1584 const installScript = process.platform === 'darwin'

1585 ? 'npm install -g @context-expert/cli'

1586 : 'npm install -g @context-expert/cli';

1587

1588 logger.info('health_install_started', { component, command: installScript });

1589

1590 execFile('/bin/sh', ['-c', installScript], { timeout: 120000 }, (err, stdout) => {

1591 if (err) {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

backend/interfaces/RestController.jsView on unpkg · L1584

1592 res.json({

1593 ok: false,

1594 component,

1595 message: `Installation failed: ${err.message}. Install manually: npm install -g @context-expert/cli`,

1596 stdout: stdout || ''

1597 });

1598 return;

1599 }

1600 res.json({ ok: true, component, message: 'Context Expert installed. Restart the runtime.' });

1601 });

1602 break;

1603 }

1604