registry / @antjs.org/colony / 0.0.1

@antjs.org/colony@0.0.1

Deploy Ant apps to ants.page (console.antjs.org)

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 8 file(s), 27.6 KB of source, external domains: console.antjs.org

Source & flagged code

2 flagged

dist/auth.jsView file

Lines 24-64javascript

24 };

25 return ownKeys(o);

26 };

27 return function (mod) {

28 if (mod && mod.__esModule) return mod;

29 var result = {};

30 if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);

31 __setModuleDefault(result, mod);

32 return result;

33 };

34})();

35Object.defineProperty(exports, "__esModule", { value: true });

36exports.readConfig = readConfig;

37exports.readToken = readToken;

38exports.requireToken = requireToken;

39exports.login = login;

40exports.logout = logout;

41exports.whoami = whoami;

42const os = __importStar(require("node:os"));

43const fs = __importStar(require("node:fs"));

44const path = __importStar(require("node:path"));

45const node_child_process_1 = require("node:child_process");

46const utils_1 = require("./utils");

High

Child Process

Package source references child process execution.

dist/auth.jsView on unpkg · L44

47const config_1 = require("./config");

48const sleep = (ms) => new Promise(r => setTimeout(r, ms));

49function cfgPath() {

50 return path.join(os.homedir(), '.colony', 'config.json');

51}

52function readConfig() {

53 try {

54 const config = JSON.parse(fs.readFileSync(cfgPath(), 'utf-8'));

55 if (typeof config !== 'object' || config === null || Array.isArray(config))

56 throw new Error('expected a JSON object');

57 for (const key of ['token', 'email', 'console']) {

58 if (key in config && typeof config[key] !== 'string')

59 throw new Error(`\`${key}\` must be a string`);

60 }

61 return config;

62 }

63 catch (error) {

64 if (error.code === 'ENOENT')

dist/commands.jsView file

Lines 13-53javascript

13const utils_1 = require("./utils");

14function ensureDeps() {

15 if (!(0, node_fs_1.existsSync)('package.json'))

16 return;

17 let manifest;

18 try

Source & flagged code

2 flagged · loading source

dist/auth.jsView file

44const path = __importStar(require("node:path")); L45: const node_child_process_1 = require("node:child_process"); L46: const utils_1 = require("./utils");

High

Child Process

Package source references child process execution.

dist/auth.jsView on unpkg · L44

dist/commands.jsView file

33if (result.error?.code === 'ENOENT') L34: result = (0, node_child_process_1.spawnSync)('npx', ['--yes', 'antland', 'install'], { stdio: 'inherit' }); L35: if (result.error || result.status !== 0)

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/commands.jsView on unpkg · L33

Findings

2 High3 Medium4 Low

HighChild Processdist/auth.js

HighRuntime Package Installdist/commands.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

dist/auth.jsView file

Lines 24-64javascript

24 };

25 return ownKeys(o);

26 };

27 return function (mod) {

28 if (mod && mod.__esModule) return mod;

29 var result = {};

30 if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);

31 __setModuleDefault(result, mod);

32 return result;

33 };

34})();

35Object.defineProperty(exports, "__esModule", { value: true });

36exports.readConfig = readConfig;

37exports.readToken = readToken;

38exports.requireToken = requireToken;

39exports.login = login;

40exports.logout = logout;

41exports.whoami = whoami;

42const os = __importStar(require("node:os"));

43const fs = __importStar(require("node:fs"));

44const path = __importStar(require("node:path"));

45const node_child_process_1 = require("node:child_process");

46const utils_1 = require("./utils");

High

Child Process

Package source references child process execution.

dist/auth.jsView on unpkg · L44

47const config_1 = require("./config");

48const sleep = (ms) => new Promise(r => setTimeout(r, ms));

49function cfgPath() {

50 return path.join(os.homedir(), '.colony', 'config.json');

51}

52function readConfig() {

53 try {

54 const config = JSON.parse(fs.readFileSync(cfgPath(), 'utf-8'));

55 if (typeof config !== 'object' || config === null || Array.isArray(config))

56 throw new Error('expected a JSON object');

57 for (const key of ['token', 'email', 'console']) {

58 if (key in config && typeof config[key] !== 'string')

59 throw new Error(`\`${key}\` must be a string`);

60 }

61 return config;

62 }

63 catch (error) {

64 if (error.code === 'ENOENT')

dist/commands.jsView file

Lines 13-53javascript

13const utils_1 = require("./utils");

14function ensureDeps() {

15 if (!(0, node_fs_1.existsSync)('package.json'))

16 return;

17 let manifest;

18 try