@apso/cli@0.34.0
⚠ Under reviewApso CLI
Static Scan Results
scanned 3mo ago · by rust-scannerStatic analysis flagged 13 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsTelemetryUrlStrings
Source & flagged code
5 flaggeddist/lib/upgrade.jsView file
12const tslib_1 = require("tslib");
L13: const child_process_1 = require("child_process");
L14: const inquirer_1 = tslib_1.__importDefault(require("inquirer"));
High
Child Process
Package source references child process execution.
dist/lib/upgrade.jsView on unpkg · L12dist/lib/utils/template.jsView file
6const path = tslib_1.__importStar(require("path"));
L7: const shelljs_1 = tslib_1.__importDefault(require("shelljs"));
L8: exports.TEMPLATE_REPOS = {
High
dist/commands/update.jsView file
45? "brew upgrade apsoai/tap/apso"
L46: : "npm install -g @apso/cli@latest";
L47: this.log(`Updating via: ${cmd}`);
...
L49: try {
L50: (0, child_process_1.execSync)(cmd, { stdio: "inherit" });
L51: }
Findings
1 Critical3 High4 Medium5 Low
CriticalPrevious Version Dangerous Deltadist/commands/dev.js
HighChild Processdist/lib/upgrade.js
HighShelldist/lib/utils/template.js
HighRuntime Package Installdist/commands/update.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperbin/dev.cmd
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to @apso/cli@0.34.0.
See all versions of @apso/cli for other recorded verdicts.
- Review the evidence and your use of @apso/cli@0.34.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.