@risuko/app
Risuko download manager — launches the desktop app, downloading it from GitHub Releases on first run
10
Versions
MIT
License
No
Install Scripts
Verified
Provenance
Supply chain provenance
Status for the latest visible version.
SLSA provenance attestation
npm registry signatures
gitHead linked
Maintainers
yuemiyuki
Keywords
downloadtorrentbittorrented2km3u8ftpdownload-manager
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| semgrep | semgrep:silent-process-exec | AI (semgrep): Detached spawn is the documented mechanism for launching a desktop app binary from a CLI wrapper; not a reverse shell. | ai | |
| semgrep | semgrep:silent-process-exec-var | AI (semgrep): Same detached spawn pattern; consistent with desktop app launcher use case. | ai | |
| typosquat | typosquat.levenshtein:hapi | AI (typosquat): Scoped package @risuko/app is not a plausible typosquat of hapi; different namespace and purpose. | ai | |
| typosquat | typosquat.levenshtein:pg | AI (typosquat): Scoped package @risuko/app is not a plausible typosquat of pg; different namespace and purpose. | ai | |
| typosquat | typosquat.levenshtein:yup | AI (typosquat): Scoped package @risuko/app is not a plausible typosquat of yup; different namespace and purpose. | ai | |
| typosquat | typosquat.levenshtein:ajv | AI (typosquat): Scoped package @risuko/app is not a plausible typosquat of ajv; different namespace and purpose. | ai |