registry  /  @bonsai-ai/cli  /  0.4.19

@bonsai-ai/cli@0.4.19

Bonsai CLI - The command line interface for Bonsai

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNativeBindingsNetworkShell
Supply chain
HighEntropyStringsMinifiedObfuscatedUrlStrings
Manifest
NoLicense
scanned 1 file(s), 1.55 MB of source, external domains: api.statsigcdn.com, api.trybons.ai, api.workos.com, cloudflare-dns.com, codeload.github.com, docs.statsig.com, docs.trybons.ai, fburl.com, featureassets.org, feross.org, gist.githubusercontent.com, github.com, go.trybons.ai, json-schema.org, prodregistryv2.org, raw.githubusercontent.com, react.dev, reactjs.org, registry.npmjs.org, statsigapi.net, todo.sr.ht

Source & flagged code

6 flagged · loading source
dist/cli.jsView file
100%s L101: `)}),hl=(D,Q,F)=>{if(typeof Q==="string")F=Q,Q=null;try{try{return JSON.parse(D,Q)}catch(J){throw xj0(D,Q),J}}catch(J){J.message=J.message.replace(/\n/g,"");let Z=J.message.match(/... L102: `);for(var Q=0;D[Q]&&D[Q].trim().match(/^(#|$)/);Q++);var F=D.length;for(var J=Q+1;J<F&&D[J].trim();J++);return D.slice(Q,J).join(" ").trim()}});var Fd=j((SR1,DA0)=>{DA0.exports={t...
High
Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L100
127`)}function rF1(D){if(D)process.env.DEBUG=D;else delete process.env.DEBUG}function sF1(){return process.env.DEBUG}function aF1(D){D.inspectOpts={};let Q=Object.keys(Hq0.inspectOpts... L128: `).map((Q)=>Q.trim()).join(" ")};Yq0.O=function(D){return this.inspectOpts.colors=this.useColors,_I.inspect(D,this.inspectOpts)}});var Zv=j((Dk1,Jv)=>{if(typeof process>"u"||proces... L129: `+C0.replace(/^Error(:[^\n]*)?\n/,""))});return K0.prototype=Object.create(g.prototype),K0.prototype.constructor=K0,K0.prototype.toString=function(){return this.message===void 0?th...
High
Shell

Package source references shell execution.

dist/cli.jsView on unpkg · L127
86In order to be iterable, non-array objects must have a [Symbol.iterator]() method.`)}var k=!0,s=!1,x;return{s:function(){V=z[Symbol.iterator]()},n:function(){var J0=V.next();return... L87: In order to be iterable, non-array objects must have a [Symbol.iterator]() method.`)}function Uu(z,C){if(!z)return;if(typeof z==="string")return tO(z,C);var V=Object.prototype.toSt... L88: `),y1=I1.length>1?I1[1]:null;return y1}function H8(){return T8}function nD(H1){var I1=J8(H1);if(I1!==null)HD.push(I1)}function l4(H1){if(HD.length>0){var I1=HD.pop(),y1=J8(H1);if(y... ... L93: `,X=" "]=J.match(sR0)||J.match(rR0)||[,"",""],q=JSON.parse(J,Q);if(q&&typeof q==="object")q[oR0]=Z,q[iR0]=X;return q}catch(Z){if(typeof D!=="string"&&!Buffer.isBuffer(D)){let X=Ar... L94: `,ql="\r",Yl=function(){function D(Q){this.string=Q;var F=[0];for(var J=0;J<Q.length;)switch(Q[J]){case vG:J+=vG.length,F.push(J);break;case ql:if(J+=ql.length,Q[J]===vG)J+=vG.leng... L95: `);else F+=Z;return F}var Tl=!1,wl=/\r\n|[\n\r\u2028\u2029]/;function Tj0(D,Q,F){let J=Object.assign({column:0,line:-1},D.start),Z=Object.assign({},J,D.end),{linesAbove:X=2,linesBe... ... L100: %s L101: `)}),hl=(D,Q,F)=>{if(typeof Q==="string")F=
High
Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli.jsView on unpkg · L86
86In order to be iterable, non-array objects must have a [Symbol.iterator]() method.`)}var k=!0,s=!1,x;return{s:function(){V=z[Symbol.iterator]()},n:function(){var J0=V.next();return... L87: In order to be iterable, non-array objects must have a [Symbol.iterator]() method.`)}function Uu(z,C){if(!z)return;if(typeof z==="string")return tO(z,C);var V=Object.prototype.toSt... L88: `),y1=I1.length>1?I1[1]:null;return y1}function H8(){return T8}function nD(H1){var I1=J8(H1);if(I1!==null)HD.push(I1)}function l4(H1){if(HD.length>0){var I1=HD.pop(),y1=J8(H1);if(y... L89: `);if(!/^\s*at /.test(D[0])&&/^\s*at /.test(D[1]))D=D.slice(1);let F=!1,J=null,Z=[];return D.forEach((X)=>{if(X=X.replace(/\\/g,"/"),this._internals.some((Y)=>Y.test(X)))return;let... ... L100: %s L101: `)}),hl=(D,Q,F)=>{if(typeof Q==="string")F=Q,Q=null;try{try{return JSON.parse(D,Q)}catch(J){throw xj0(D,Q),J}}catch(J){J.message=J.message.replace(/\n/g,"");let Z=J.message.match(/... L102: `);for(var Q=0;D[Q]&&D[Q].trim().match(/^(#|$)/);Q++);var F=D.length;for(var J=Q+1;J<F&&D[J].trim();J++);return D.slice(Q,J).join(" ").trim()}});var Fd=j((SR1,DA0)=>{DA0.exports={t...
High
Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/cli.jsView on unpkg · L86
106|| (${q} === "string" && ${Z} && ${Z} == +${Z} && !(${Z} % 1))`).assign(Y,TD._`+${Z}`);return;case"boolean":J.elseIf(TD._`${Z} === "false" || ${Z} === 0 || ${Z} === null`).assign(Y... L107: || ${q} === "boolean" || ${Z} === null`).assign(Y,TD._`[${Z}]`)}}}function Vv0({gen:D,parentData:Q,parentDataProperty:F},J){D.if(TD._`${Q} !== undefined`,()=>D.assign(TD._`${Q}[${F... L108: missingProperty: ${J},
Medium
Dynamic Require

Package source references dynamic require/import behavior.

dist/cli.jsView on unpkg · L106
dist/yoga.wasmView file
•path = dist/yoga.wasm kind = wasm_module sizeBytes = 88658 magicHex = [redacted]
Medium
Ships Wasm Module

Package ships WebAssembly modules.

dist/yoga.wasmView on unpkg

Findings

4 High5 Medium5 Low
HighChild Processdist/cli.js
HighShelldist/cli.js
HighSame File Env Network Executiondist/cli.js
HighCommand Output Exfiltrationdist/cli.js
MediumDynamic Requiredist/cli.js
MediumNetwork
MediumEnvironment Vars
MediumShips Wasm Moduledist/yoga.wasm
MediumStructural Risk Force Deep Review
LowFilesystem
LowObfuscated
LowHigh Entropy Strings
LowUrl Strings
LowNo License