registry / zidane-tui / 5.14.4

zidane-tui@5.14.4

Terminal UI for the zidane agent. Ships as a self-contained binary — install globally and run `zidane`.

Static Scan Results

scanned 5d ago · by rust-scanner

Static analysis flagged 7 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 2.81 KB of source, external domains: github.com

Source & flagged code

2 flagged

bin/zidane.mjsView file

Lines 1-78javascript

1#!/usr/bin/env node

2// `zidane-tui` CLI launcher.

3//

4// This shim runs under Node (any Node ≥18) so the package installs cleanly on

5// any machine that already has npm. It detects the host triple, resolves the

6// platform-specific binary from the matching optional dependency

7// (`zidane-tui-darwin-arm64`, …), and execs it. The binary itself is a

8// self-contained Bun executable — end users do NOT need Bun installed.

9//

10// Keep this file dependency-free: it has to run before anything from

11// `node_modules` is loaded other than the platform binary it resolves.

13import { execSync, spawn } from 'node:child_process'

14import { createRequire } from 'node:module'

High

Child Process

Package source references child process execution.

bin/zidane.mjsView on unpkg · L12

16const require = createRequire(import.meta.url)

18/** glibc vs musl detection. `ldd --version` mentions "musl" on Alpine and similar. */

19function detectLibc() {

20 try {

21 const out = execSync('ldd --version 2>&1', { encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] })

22 return out.toLowerCase().includes('musl') ? 'musl' : 'glibc'

23 }

24 catch {

25 return 'musl'

26 }

27}

29/** Returns the platform key matching one of the `zidane-tui-<key>` packages, or `null` when unsupported. */

30function platformKey() {

31 const { platform, arch } = process

32 if (platform === 'darwin')

38 }

39 return null

40}

42function resolveBinary() {

43 const key = platformKey()

44 if (!key) {

45 throw new Error(

46 `zidane has no prebuilt binary for ${process.platform}-${process.arch}.\n`

47 + `Supported targets: darwin/arm64, darwin/x64, linux/x64 (glibc), linux/arm64 (glibc).\n`

48 + `If you need another platform, please open an issue at https://github.com/Tahul/zidane/issues.`,

49 )

50 }

51 const pkg = `zidane-tui-${key}`

52 try {

53 return require.resolve(`${pkg}/bin/zidane`)

54 }

55 catch {

56 throw new Error(

57 `Could not find the ${pkg} binary in node_modules.\n`

58 + `It should have been installed automatically as an optional dependency of zidane-tui.\n`

59 + `Try reinstalling: \`npm install -g zidane-tui\` (or your package manager's equivalent).`,

60 )

61 }

62}

64try {

65 const bin = resolveBinary()

66 const child = spawn(bin, process.argv.slice(2), { stdio: 'inherit' })

67 child.on('exit', (code, signal) => {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/zidane.mjsView on unpkg · L58

68 if (signal) {

69 // Re-raise the signal so callers see the real cause of death (e.g. SIGINT).

70 process.kill(process.pid, signal)

71 return

72 }

73 process.exit(code ?? 1)

74 })

75 child.on('error', (err) => {

76 console.error(`zidane failed to launch: ${err instanceof Error ? err.message : err}`)

77 process.exit(1)

78 })

Source & flagged code

2 flagged · loading source

bin/zidane.mjsView file

12L13: import { execSync, spawn } from 'node:child_process' L14: import { createRequire } from 'node:module'

High

Child Process

Package source references child process execution.

bin/zidane.mjsView on unpkg · L12

58+ `It should have been installed automatically as an optional dependency of zidane-tui.\n` L59: + `Try reinstalling: \`npm install -g zidane-tui\` (or your package manager's equivalent).`, L60: ) ... L65: const bin = resolveBinary() L66: const child = spawn(bin, process.argv.slice(2), { stdio: 'inherit' }) L67: child.on('exit', (code, signal) => {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/zidane.mjsView on unpkg · L58

Findings

3 High1 Medium3 Low

HighChild Processbin/zidane.mjs

HighShell

HighRuntime Package Installbin/zidane.mjs

MediumStructural Risk Force Deep Review

LowScripts Present

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

bin/zidane.mjsView file

Lines 1-78javascript

1#!/usr/bin/env node

2// `zidane-tui` CLI launcher.

3//

4// This shim runs under Node (any Node ≥18) so the package installs cleanly on

5// any machine that already has npm. It detects the host triple, resolves the

6// platform-specific binary from the matching optional dependency

7// (`zidane-tui-darwin-arm64`, …), and execs it. The binary itself is a

8// self-contained Bun executable — end users do NOT need Bun installed.

9//

10// Keep this file dependency-free: it has to run before anything from

11// `node_modules` is loaded other than the platform binary it resolves.

13import { execSync, spawn } from 'node:child_process'

14import { createRequire } from 'node:module'

High

Child Process

Package source references child process execution.

bin/zidane.mjsView on unpkg · L12

16const require = createRequire(import.meta.url)

18/** glibc vs musl detection. `ldd --version` mentions "musl" on Alpine and similar. */

19function detectLibc() {

20 try {

21 const out = execSync('ldd --version 2>&1', { encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] })

22 return out.toLowerCase().includes('musl') ? 'musl' : 'glibc'

23 }

24 catch {

25 return 'musl'

26 }

27}

29/** Returns the platform key matching one of the `zidane-tui-<key>` packages, or `null` when unsupported. */

30function platformKey() {

31 const { platform, arch } = process

32 if (platform === 'darwin')

38 }

39 return null

40}

42function resolveBinary() {

43 const key = platformKey()

44 if (!key) {

45 throw new Error(

46 `zidane has no prebuilt binary for ${process.platform}-${process.arch}.\n`

47 + `Supported targets: darwin/arm64, darwin/x64, linux/x64 (glibc), linux/arm64 (glibc).\n`

48 + `If you need another platform, please open an issue at https://github.com/Tahul/zidane/issues.`,

49 )

50 }

51 const pkg = `zidane-tui-${key}`

52 try {

53 return require.resolve(`${pkg}/bin/zidane`)

54 }

55 catch {

56 throw new Error(

57 `Could not find the ${pkg} binary in node_modules.\n`

58 + `It should have been installed automatically as an optional dependency of zidane-tui.\n`

59 + `Try reinstalling: \`npm install -g zidane-tui\` (or your package manager's equivalent).`,

60 )

61 }

62}

64try {

65 const bin = resolveBinary()

66 const child = spawn(bin, process.argv.slice(2), { stdio: 'inherit' })

67 child.on('exit', (code, signal) => {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/zidane.mjsView on unpkg · L58

68 if (signal) {

69 // Re-raise the signal so callers see the real cause of death (e.g. SIGINT).

70 process.kill(process.pid, signal)

71 return

72 }

73 process.exit(code ?? 1)

74 })

75 child.on('error', (err) => {

76 console.error(`zidane failed to launch: ${err instanceof Error ? err.message : err}`)

77 process.exit(1)

78 })