registry / @4ort/cli / 0.11.0

@4ort/cli@0.11.0

Unified CLI for the 4ort ecosystem — 4ort.net hosting, knowledge graph, and more

Static Scan Results

scanned 1h ago · by rust-scanner

Static analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 47 file(s), 229 KB of source, external domains: 4ort.ai, 4ort.dev, 4ort.mov, 4ort.net, 4ort.nexus, 4ort.social, 4ort.xyz, docs.4ort.net, factory.4ort.mov, produce.4ort.mov, sheets.4ort.net, slides.4ort.net, www.namesilo.com

Source & flagged code

1 flagged

dist/web-client.jsView file

Lines 1-26javascript

1/**

2 * Public-internet reader for `4ort web get`.

3 *

4 * Tiered, cheapest tier first:

5 * Tier 0 — if the URL is one of ours (4ort.xyz/entity/<slug>), return our own

6 * structured entity instead of scraping the HTML.

7 * Tier 2 — live fetch (undici global fetch, proxy-aware via kg-client's

8 * EnvHttpProxyAgent) + Mozilla Readability ("Reader Mode") extraction.

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/web-client.jsView on unpkg · L6

9 * (Tier 1 — full text out of our Common Crawl index via a future server

10 * /page-text endpoint — TODO once that ships.)

11 *

12 * No JS execution, no cookies, no login. On a JS-wall / 403 / paywall / binary

13 * body / parse failure we return { ok: false, ... } *with the URL* so the calling

14 * agent isn't dead-ended — it can fall back to the link or pick another source.

15 */

16import { Readability } from "@mozilla/readability";

17import { parseHTML } from "linkedom";

18import { loadConfig } from "./config.js";

19import { kgRequest } from "./kg-client.js";

20import { USER_AGENT } from "./version.js";

21const UA = `${USER_AGENT} (+https://4ort.xyz)`;

22const FETCH_TIMEOUT_MS = 15_000;

23const MAX_BODY_BYTES = 5 * 1024 * 1024; // 5 MB hard cap on what we'll download

24const DEFAULT_MAX_CHARS = 50_000;

25// ── Tier 0: our own pages ───────────────────────────────────────────────────

26function looksLikeOurEntity(u) {

Source & flagged code

1 flagged · loading source

dist/web-client.jsView file

6* structured entity instead of scraping the HTML. L7: * Tier 2 — live fetch (undici global fetch, proxy-aware via kg-client's L8: * EnvHttpProxyAgent) + Mozilla Readability ("Reader Mode") extraction. ... L56: if (!res.body) { L57: const ab = await res.arrayBuffer(); L58: const u = new Uint8Array(ab); L59: return { bytes: u.length > cap ? u.slice(0, cap) : u, truncatedBody: u.length > cap }; L60: }

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/web-client.jsView on unpkg · L6

Findings

1 High3 Medium5 Low

HighCloud Metadata Accessdist/web-client.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

1 flagged

dist/web-client.jsView file

Lines 1-26javascript

1/**

2 * Public-internet reader for `4ort web get`.

3 *

4 * Tiered, cheapest tier first:

5 * Tier 0 — if the URL is one of ours (4ort.xyz/entity/<slug>), return our own

6 * structured entity instead of scraping the HTML.

7 * Tier 2 — live fetch (undici global fetch, proxy-aware via kg-client's

8 * EnvHttpProxyAgent) + Mozilla Readability ("Reader Mode") extraction.

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/web-client.jsView on unpkg · L6

9 * (Tier 1 — full text out of our Common Crawl index via a future server

10 * /page-text endpoint — TODO once that ships.)

11 *

12 * No JS execution, no cookies, no login. On a JS-wall / 403 / paywall / binary

13 * body / parse failure we return { ok: false, ... } *with the URL* so the calling

14 * agent isn't dead-ended — it can fall back to the link or pick another source.

15 */

16import { Readability } from "@mozilla/readability";

17import { parseHTML } from "linkedom";

18import { loadConfig } from "./config.js";

19import { kgRequest } from "./kg-client.js";

20import { USER_AGENT } from "./version.js";

21const UA = `${USER_AGENT} (+https://4ort.xyz)`;

22const FETCH_TIMEOUT_MS = 15_000;

23const MAX_BODY_BYTES = 5 * 1024 * 1024; // 5 MB hard cap on what we'll download

24const DEFAULT_MAX_CHARS = 50_000;

25// ── Tier 0: our own pages ───────────────────────────────────────────────────

26function looksLikeOurEntity(u) {