registry  /  zest-dev  /  1.0.5

zest-dev@1.0.5

A lightweight, human-interactive development workflow for AI-assisted coding

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket
Supply chain
HighEntropyStrings
ManifestNo manifest risk signals triggered.
scanned 17 file(s), 93.0 KB of source

Source & flagged code

3 flagged · loading source
package.jsonView file
•scripts.postinstall = node scripts/ensure-plugin-symlinks.js
High
Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg
skills/brainstorming/scripts/server.cjsView file
1const crypto = require('crypto'); L2: const http = require('http'); L3: const fs = require('fs'); ... L11: function computeAcceptKey(clientKey) { L12: return crypto.createHash('sha1').update(clientKey + WS_MAGIC).digest('base64'); L13: } ... L75: L76: const PORT = process.env.BRAINSTORM_PORT || (49152 + Math.floor(Math.random() * 16383)); L77: const HOST = process.env.BRAINSTORM_HOST || '127.0.0.1'; ... L100: L101: const frameTemplate = fs.readFileSync(path.join(__dirname, 'frame-template.html'), 'utf-8'); L102: const helperScript = fs.readFileSync(path.join(__dirname, 'helper.js'), 'utf-8');
Low
Weak Crypto

Package source references weak cryptographic algorithms.

skills/brainstorming/scripts/server.cjsView on unpkg · L1
skills/brainstorming/scripts/stop-server.shView file
•path = [redacted]-server.sh kind = build_helper sizeBytes = 1314 magicHex = [redacted]
Medium
Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/brainstorming/scripts/stop-server.shView on unpkg

Findings

1 High4 Medium4 Low
HighInstall Time Lifecycle Scriptspackage.json
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperskills/brainstorming/scripts/stop-server.sh
MediumStructural Risk Force Deep Review
LowScripts Present
LowWeak Cryptoskills/brainstorming/scripts/server.cjs
LowFilesystem
LowHigh Entropy Strings