registry / @arach/speakeasy / 0.2.15

@arach/speakeasy@0.2.15

Convenient TTS CLI for Mac — centralized credentials + configurable caching so all your apps and agents can speak.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 194 KB of source, external domains: aistudio.google.com, api.elevenlabs.io, api.groq.com, api.openai.com, console.groq.com, elevenlabs.io, generativelanguage.googleapis.com, github.com, makersuite.google.com, platform.openai.com, speakeasy.arach.dev

Source & flagged code

2 flagged

dist/bin/speakeasy-cli.jsView file

Lines 1-36javascript

1#!/usr/bin/env node

2"use strict";

3var __create = Object.create;

4var __defProp = Object.defineProperty;

5var __getOwnPropDesc = Object.getOwnPropertyDescriptor;

6var __getOwnPropNames = Object.getOwnPropertyNames;

7var __getProtoOf = Object.getPrototypeOf;

8var __hasOwnProp = Object.prototype.hasOwnProperty;

9var __esm = (fn, res, err) => function __init() {

10 if (err) throw err[0];

11 try {

12 return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;

13 } catch (e) {

14 throw err = [e], e;

15 }

16};

17var __commonJS = (cb, mod) => function __require() {

18 try {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/bin/speakeasy-cli.jsView on unpkg · L16

19 return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;

20 } catch (e) {

21 throw mod = 0, e;

22 }

23};

24var __export = (target, all) => {

25 for (var name in all)

26 __defProp(target, name, { get: all[name], enumerable: true });

27};

28var __copyProps = (to, from, except, desc) => {

29 if (from && typeof from === "object" || typeof from === "function") {

30 for (let key of __getOwnPropNames(from))

31 if (!__hasOwnProp.call(to, key) && key !== except)

32 __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });

33 }

34 return to;

35};

36var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(

Lines 235-275javascript

235 this.db.exec(CREATE_ENTRIES_TABLE);

236 this.db.exec(CREATE_INDEXES);

237 this.db.exec("PRAGMA journal_mode = WAL;");

238 this.migrateJsonMetadataIfNeeded();

239 this.migrateLegacySqliteIfNeeded();

240 this.logger.

Source & flagged code

2 flagged · loading source

dist/bin/speakeasy-cli.jsView file

255try { L256: const data = JSON.parse(fs3.readFileSync(this.metadataFile, "utf8")); L257: const entries = Object.entries(data.entries || {}); ... L496: if (process.argv[1]?.includes("speakeasy-cli")) return "cli"; L497: if (process.env.NODE_ENV === "test") return "test"; L498: return "api"; ... L737: processId: process.pid.toString(), L738: hostname: require("os").hostname(), L739: user: require("os").userInfo().username, ... L905: L906: // package.json L907: var require_package = __commonJS({

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/bin/speakeasy-cli.jsView on unpkg · L255

16}; L17: var __commonJS = (cb, mod) => function __require() { L18: try {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/bin/speakeasy-cli.jsView on unpkg · L16

Findings

1 High4 Medium5 Low

HighSandbox Evasion Gated Capabilitydist/bin/speakeasy-cli.js

MediumDynamic Requiredist/bin/speakeasy-cli.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

dist/bin/speakeasy-cli.jsView file

Lines 1-36javascript

1#!/usr/bin/env node

2"use strict";

3var __create = Object.create;

4var __defProp = Object.defineProperty;

5var __getOwnPropDesc = Object.getOwnPropertyDescriptor;

6var __getOwnPropNames = Object.getOwnPropertyNames;

7var __getProtoOf = Object.getPrototypeOf;

8var __hasOwnProp = Object.prototype.hasOwnProperty;

9var __esm = (fn, res, err) => function __init() {

10 if (err) throw err[0];

11 try {

12 return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;

13 } catch (e) {

14 throw err = [e], e;

15 }

16};

17var __commonJS = (cb, mod) => function __require() {

18 try {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/bin/speakeasy-cli.jsView on unpkg · L16

19 return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;

20 } catch (e) {

21 throw mod = 0, e;

22 }

23};

24var __export = (target, all) => {

25 for (var name in all)

26 __defProp(target, name, { get: all[name], enumerable: true });

27};

28var __copyProps = (to, from, except, desc) => {

29 if (from && typeof from === "object" || typeof from === "function") {

30 for (let key of __getOwnPropNames(from))

31 if (!__hasOwnProp.call(to, key) && key !== except)

32 __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });

33 }

34 return to;

35};

36var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(

Lines 235-275javascript

235 this.db.exec(CREATE_ENTRIES_TABLE);

236 this.db.exec(CREATE_INDEXES);

237 this.db.exec("PRAGMA journal_mode = WAL;");

238 this.migrateJsonMetadataIfNeeded();

239 this.migrateLegacySqliteIfNeeded();

240 this.logger.