registry  /  youmd  /  0.9.2

youmd@0.9.2

⚠ Under review

Identity context protocol for the agent internet — an MCP where the context is you. CLI for the You.md platform.

Static Scan Results

scanned 10d ago · by rust-scanner

Static analysis flagged 12 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
Supply chain
HighEntropyStringsUrlStrings
ManifestNo manifest risk signals triggered.
scanned 94 file(s), 1.82 MB of source, external domains: 127.0.0.1, avatars.githubusercontent.com, github.com, kindly-cassowary-600.convex.site, linkedin.com, openrouter.ai, raw.githubusercontent.com, registry.npmjs.org, unavatar.io, www.folder.md, www.linkedin.com, x.com, you.md

Source & flagged code

4 flagged · loading source
package.jsonView file
•scripts.postinstall = node -e "try{require('./dist/postinstall.js')}catch(e){if(e&&e.code!=='MODULE_NOT_FOUND')throw e}"
Critical
Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg
•scripts.postinstall = node -e "try{require('./dist/postinstall.js')}catch(e){if(e&&e.code!=='MODULE_NOT_FOUND')throw e}"
High
Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg
dist/commands/stack.jsView file
44const os = __importStar(require("os")); L45: const child_process = __importStar(require("child_process")); L46: const api_1 = require("../lib/api"); ... L66: return null; L67: return String(result.stdout ?? "").trim(); L68: } L69: function sharedAgentStackSnapshot() { L70: const home = process.env.HOME || ""; L71: const root = path.join(home, ".agent-shared"); ... L110: await (0, api_1.recordBrainActivity)({ L111: activityId: `stack-sync:${os.hostname()}`, L112: source: "stack-sync",
Medium
Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/commands/stack.jsView on unpkg · L44
scripts/agent-shared-template/bin/sync-agent-shared.shView file
•path = scripts/agent-shared-template/bin/sync-agent-shared.sh kind = build_helper sizeBytes = 3578 magicHex = [redacted]
Medium
Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/agent-shared-template/bin/sync-agent-shared.shView on unpkg

Findings

1 Critical1 High5 Medium5 Low
CriticalRed Install Lifecycle Scriptpackage.json
HighInstall Time Lifecycle Scriptspackage.json
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/commands/stack.js
MediumShips Build Helperscripts/agent-shared-template/bin/sync-agent-shared.sh
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings