registry / @bikli/cli / 1.1.2

@bikli/cli@1.1.2

Static Scan Results

scanned 6d ago · by rust-scanner

Static analysis flagged 13 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 4 file(s), 19.1 KB of source, external domains: github.com

Source & flagged code

6 flagged

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/bikli.jsView file

8const readline = require("node:readline"); L9: const { spawnSync } = require("node:child_process"); L10: const {

High

Child Process

Package source references child process execution.

bin/bikli.jsView on unpkg · L8

lib/install.js#virtual:normalized:round1View file

27function managementUrl() { L28: return (process.env.BIKLI_MANAGEMENT_URL || DEFAULT_MANAGEMENT_URL || "").trim(); L29: } L30: L31: // "Management: Connected" is the agent"s own wording for an enrolled, live\n// peer; anything else means it still needs a key.\nfunction isConnected() {\n if (!isInstalled()) r... L32: // when cutting a release; a digest that does not describe the URL only blocks ... L39: const tag = version.startsWith("v") ? version : `v${version}`; L40: return `https://github.com/paisabasic-dot/bikli/releases/download/${tag}/bikli-cli.exe`; L41: }

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

lib/install.js#virtual:normalized:round1View on unpkg · L27

vendor/bikli-cli.exeView file

•path = vendor/bikli-cli.exe kind = native_binary sizeBytes = 11765482 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

vendor/bikli-cli.exeView on unpkg

lib/install.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @bikli/cli@1.1.1 matchedIdentity = npm:QGJpa2xpL2NsaQ:1.1.1 similarity = 0.750 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/install.jsView on unpkg

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/bikli.jsView file

8const readline = require("node:readline"); L9: const { spawnSync } = require("node:child_process"); L10: const {

High

Child Process

Package source references child process execution.

bin/bikli.jsView on unpkg · L8

Findings

4 High5 Medium4 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processbin/bikli.js

HighSame File Env Network Executionlib/install.js#virtual:normalized:round1

HighPrevious Version Dangerous Deltalib/install.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumShips Native Binaryvendor/bikli-cli.exe

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings