@api-now/cli: Suspicious npm security report (Warn)

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedTelemetryUrlStrings

Manifest

NoLicense

scanned 1 file(s), 639 KB of source, external domains: 127.0.0.1, a.ml, api.apinow.app, github.com, registry.npmjs.org, www.w3.org

Source & flagged code

1 flagged

dist/index.jsView file

1#!/usr/bin/env node L2: import { createRequire } from 'module'; const require = createRequire(import.meta.url); import { fileURLToPath } from 'url'; import { dirname } from 'path'; const __filename = file... L3: var Po=Object.create;var ns=Object.defineProperty;var Ro=Object.getOwnPropertyDescriptor;var Co=Object.getOwnPropertyNames;var Do=Object.getPrototypeOf,Uo=Object.prototype.hasOwnPr... L4: `)}var B=class{format;constructor(e={}){this.format=e.format||"text"}success(e,t){this.format==="json"?console.log(JSON.stringify({success:!0,message:e,data:t},null,2)):(console.lo... L5: Validation errors:`);for(let i of e.errors)console.error(` - ${X.yellow(i.field)}: ${i.message}`)}if(console.error(X.dim(`(cli v${ds})`)),console.error(X.dim(`Log file: ${Qi}`)),t... ... L16: Please report this bug: ${a}`)}}}list(e,t,i={}){if(this.format==="json")console.log(JSON.stringify(e,null,2));else{if(e.length===0){console.log("No records found.");return}console.... L17: `)}*keys(){let e=Object.keys(this._map);for(let t of e)this._map[t].enabled&&(yield this._map[t].name)}*values(){let e=Object.keys(this._map);for(let t of e)this._map[t].enabled&&(... L18:

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L1

Source & flagged code

1 flagged · loading source

dist/index.jsView file

1#!/usr/bin/env node L2: import { createRequire } from 'module'; const require = createRequire(import.meta.url); import { fileURLToPath } from 'url'; import { dirname } from 'path'; const __filename = file... L3: var Po=Object.create;var ns=Object.defineProperty;var Ro=Object.getOwnPropertyDescriptor;var Co=Object.getOwnPropertyNames;var Do=Object.getPrototypeOf,Uo=Object.prototype.hasOwnPr... L4: `)}var B=class{format;constructor(e={}){this.format=e.format||"text"}success(e,t){this.format==="json"?console.log(JSON.stringify({success:!0,message:e,data:t},null,2)):(console.lo... L5: Validation errors:`);for(let i of e.errors)console.error(` - ${X.yellow(i.field)}: ${i.message}`)}if(console.error(X.dim(`(cli v${ds})`)),console.error(X.dim(`Log file: ${Qi}`)),t... ... L16: Please report this bug: ${a}`)}}}list(e,t,i={}){if(this.format==="json")console.log(JSON.stringify(e,null,2));else{if(e.length===0){console.log("No records found.");return}console.... L17: `)}*keys(){let e=Object.keys(this._map);for(let t of e)this._map[t].enabled&&(yield this._map[t].name)}*values(){let e=Object.keys(this._map);for(let t of e)this._map[t].enabled&&(... L18:

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L1

Findings

1 High3 Medium7 Low

HighSandbox Evasion Gated Capabilitydist/index.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

LowNo License