registry / @arbidocs/cli / 0.3.99

@arbidocs/cli@0.3.99

CLI tool for interacting with ARBI — login, manage workspaces, upload documents, query the RAG assistant

Static Scan Results

scanned 3d ago · by rust-scanner

Static analysis flagged 15 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 5 file(s), 409 KB of source, external domains: central.arbi.work, docs.anthropic.com, docs.openclaw.ai

Source & flagged code

6 flagged

package.jsonView file

Lines 1-40json

2 "name": "@arbidocs/cli",

3 "version": "0.3.99",

4 "description": "CLI tool for interacting with ARBI — login, manage workspaces, upload documents, query the RAG assistant",

5 "main": "dist/index.js",

6 "bin": {

7 "arbi": "dist/index.js"

8 },

9 "files": [

10 "dist",

11 "scripts",

12 "SKILL.md",

13 "CHANGELOG.md"

14 ],

15 "scripts": {

16 "build": "tsup",

17 "test": "vitest run",

18 "test:integration": "vitest run src/integration.test.ts",

19 "typecheck": "tsc --noEmit",

20 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L20

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L20

21 "preuninstall": "node scripts/preuninstall.js"

22 },

23 "dependencies": {

24 "@arbidocs/sdk": "0.3.99",

25 "@arbidocs/client": "0.3.99",

26 "@arbidocs/tui": "0.3.99",

27 "@inquirer/prompts": "^8.5.2",

28 "chalk": "^5.6.2",

29 "commander": "^15.0.0"

30 },

31 "devDependencies": {

32 "@types/node": "^25.9.0",

33 "tsup": "^8.4.0",

34 "typescript": "^6.0.3",

35 "vitest": "^4.0.18"

36 },

37 "license": "MIT",

38 "publishConfig": {

39 "access": "public"

40 },

dist/index.jsView file

Lines 1-30javascript

1#!/usr/bin/env node

2'use strict';

4var prompts = require('@inquirer/prompts');

5var commander = require('commander');

6var fs5 = require('fs');

7var path5

scripts/bench-upload.mjsView file

Lines 3-43javascript

3 * bench-upload.mjs

4 *

5 * Benchmark arbi upload speed: legacy multipart vs direct-to-MinIO (--s3).

6 *

7 * Generates fresh unique PDFs into a temp dir, creates a disposable workspace

8 * per run (so server-

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/index.jsView file

10var sdk = require('@arbidocs/sdk'); L11: var child_process = require('child_process'); L12: var client = require('@arbidocs/client');

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L10

3753Your arbi version is out of date (${"0.3.99"} \u2192 ${latest}). Updating...`); L3754: child_process.execSync("npm install -g @arbidocs/cli@latest", { stdio: "inherit" }); L3755: showChangelog("0.3.99", latest);

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L3753

10var sdk = require('@arbidocs/sdk'); L11: var child_process = require('child_process'); L12: var client = require('@arbidocs/client'); ... L87: function getCacheFile() { L88: const configDir = process.env.ARBI_CONFIG_DIR ?? path5__default.default.join(os2__default.default.homedir(), ".arbi"); L89: return path5__default.default.join(configDir, "completions.json"); ... L99: const content = fs5__default.default.readFileSync(getCacheFile(), "utf-8"); L100: const cache = JSON.parse(content); L101: return cache.workspaces.map((w) => w.id); ... L269: const shell = process.env.SHELL || ""; L270: if (shell.includes("zsh")) return path5.join(os2.homedir(), ".zshrc"); L271: return path5.join(os2.homedir(), ".bashrc");

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/index.jsView on unpkg · L10

scripts/bench-upload.mjsView file

23Cross-file remote execution chain: scripts/bench-upload.mjs spawns dist/index.js; helper contains network access plus dynamic code execution. L23: L24: import { spawn } from 'node:child_process' L25: import { writeFileSync, mkdtempSync, rmSync } from 'node:fs' ... L134: L135: return Buffer.from(header + body + xref, 'utf8') L136: } ... L144: }) L145: let stdout = '' L146: let stderr = '' ... L211: if (r.code !== 0) { L212: process.stderr.write(stripAnsi(r.stdout)) L213: process.stderr.write(stripAnsi(r.stderr))

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

scripts/bench-upload.mjsView on unpkg · L23

Findings

5 High5 Medium5 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/index.js

HighShell

HighCross File Remote Execution Contextscripts/bench-upload.mjs

HighRuntime Package Installdist/index.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/index.js

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

6 flagged

package.jsonView file

Lines 1-40json

2 "name": "@arbidocs/cli",

3 "version": "0.3.99",

4 "description": "CLI tool for interacting with ARBI — login, manage workspaces, upload documents, query the RAG assistant",

5 "main": "dist/index.js",

6 "bin": {

7 "arbi": "dist/index.js"

8 },

9 "files": [

10 "dist",

11 "scripts",

12 "SKILL.md",

13 "CHANGELOG.md"

14 ],

15 "scripts": {

16 "build": "tsup",

17 "test": "vitest run",

18 "test:integration": "vitest run src/integration.test.ts",

19 "typecheck": "tsc --noEmit",

20 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L20

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L20

21 "preuninstall": "node scripts/preuninstall.js"

22 },

23 "dependencies": {

24 "@arbidocs/sdk": "0.3.99",

25 "@arbidocs/client": "0.3.99",

26 "@arbidocs/tui": "0.3.99",

27 "@inquirer/prompts": "^8.5.2",

28 "chalk": "^5.6.2",

29 "commander": "^15.0.0"

30 },

31 "devDependencies": {

32 "@types/node": "^25.9.0",

33 "tsup": "^8.4.0",

34 "typescript": "^6.0.3",

35 "vitest": "^4.0.18"

36 },

37 "license": "MIT",

38 "publishConfig": {

39 "access": "public"

40 },

dist/index.jsView file

Lines 1-30javascript

1#!/usr/bin/env node

2'use strict';

4var prompts = require('@inquirer/prompts');

5var commander = require('commander');

6var fs5 = require('fs');

7var path5

scripts/bench-upload.mjsView file

Lines 3-43javascript

3 * bench-upload.mjs

4 *

5 * Benchmark arbi upload speed: legacy multipart vs direct-to-MinIO (--s3).

6 *

7 * Generates fresh unique PDFs into a temp dir, creates a disposable workspace

8 * per run (so server-

Lines 3733-3773javascript

3733 skipSection = false;

3734 }

3735 if (skipSection) continue;

3736 sections.push(line);

3737 }

3738 const result = sections.join("\n").replace(/\n{3,}/g, "\n\n").trim();

3739 return result || null;

3740}

3741function showChangelog(fromVersion, toVersion) {

3742 const changelog = readChangelog(fromVersion, toVersion);

3743 if (changelog) {

3744 console.log("\n" + changelog);

3745 }

3746}

3747async function checkForUpdates(autoUpdate) {

3748 try {

3749 const latest = getLatestVersion();

3750 if (!latest || latest === "0.3.99") return;

3751 if (autoUpdate) {

3752 warn(`

3753Your arbi version is out of date (${"0.3.99"} \u2192 ${latest}). Updating...`);

3754 child_process.execSync("npm install -g @arbidocs/cli@latest", { stdio: "inherit" });

3755 showChangelog("0.3.99", latest);

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L3753

3756 console.log(`Updated to ${latest}.`);

3757 } else {

3758 warn(

3759 `

3760Your arbi version is out of date (${"0.3.99"} \u2192 ${latest}).

3761Run "arbi update" to upgrade, or "arbi update auto" to always stay up to date.`

3762 );

3763 }

3764 } catch {

3765 }

3766}

3767var NAG_FILE = path5__default.default.join(os2__default.default.homedir(), ".arbi", "last-update-hint.json");

3768var NAG_INTERVAL_MS = 24 * 60 * 60 * 1e3;

3769function shouldShowNag(latest) {

3770 if (process.env.ARBI_JSON === "1") return false;

3771 if (process.argv.includes("--json")) return false;

3772 try {

3773 const data = JSON.parse(fs5__default.default.readFileSync(NAG_FILE, "utf8"));