PyPI · pypi.org
vibe-ipd
Py Import Time Subprocess: subprocess call with shell=True — passes argv to /bin/sh.
Why PkgRadar flagged 1.0.7
| Severity | Signal | Evidence |
|---|---|---|
| medium | Py Import Time Subprocess | subprocess call with shell=True — passes argv to /bin/sh. · vibe_ipd-1.0.7/src/specify_cli/workflows/steps/shell/__init__.py |
| medium | Py Import Time Subprocess | subprocess call — process spawning. · vibe_ipd-1.0.7/src/specify_cli/integrations/copilot/__init__.py |
| medium | Py Import Time Subprocess | subprocess call — process spawning. · vibe_ipd-1.0.7/src/specify_cli/workflows/steps/prompt/__init__.py |
Scanned versions
| Version | Verdict | Score | Scanned (UTC) |
|---|---|---|---|
1.0.7 | Review | 98 | 2026-06-08 |
1.0.6 | Review | 98 | 2026-06-08 |
1.0.5 | Review | 98 | 2026-06-08 |
1.0.4 | Review | 98 | 2026-06-08 |
1.0.3 | Review | 98 | 2026-06-08 |
1.0.2 | Review | 98 | 2026-06-08 |
1.0.1 | Review | 98 | 2026-06-08 |
1.0.0 | Review | 98 | 2026-06-08 |
Block this in CI
pkgradar gate --ecosystem pypi vibe-ipd==1.0.7