registry / @boxes-dev/cli / 1.0.802

@boxes-dev/cli@1.0.802

Boxes.dev CLI (standalone, includes bundled Node runtime)

Static Scan Results

scanned 1h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

UrlStrings

Manifest

NoLicense

scanned 2 file(s), 8.06 KB of source, external domains: deploy-dev.boxes.dev, deploy.boxes.dev

Source & flagged code

4 flagged

package.jsonView file

Lines 1-34json

2 "name": "@boxes-dev/cli",

3 "version": "1.0.802",

4 "description": "Boxes.dev CLI (standalone, includes bundled Node runtime)",

5 "license": "UNLICENSED",

6 "publishConfig": {

7 "access": "public"

8 },

9 "bin": {

10 "dvb": "./bin/dvb",

11 "dvbd": "./bin/dvbd"

12 },

13 "files": [

14 "bin/dvb",

15 "bin/dvbd",

16 "scripts/postinstall.cjs",

17 "scripts/postinstall.mjs"

18 ],

19 "scripts": {

20 "postinstall": "node scripts/postinstall.cjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L20

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L20

21 },

22 "engines": {

23 "node": ">=18"

24 },

25 "os": [

26 "darwin",

27 "linux"

28 ],

29 "cpu": [

30 "arm64",

31 "x64"

32 ]

33}

scripts/postinstall.cjsView file

Lines 1-19javascript

1// CJS wrapper for postinstall — spawns the ESM postinstall script.

2// npm postinstall runs with the package's Node, which may be 18+ without

3// native ESM support in all contexts. This wrapper ensures compatibility.

4const { execFileSync } = require("node:child_process");

5const path = require("node:path");

High

Child Process

Package source references child process execution.

scripts/postinstall.cjsView on unpkg · L3

scripts/postinstall.mjsView file

Lines 1-33javascript

1/**

2 * @boxes-dev/cli postinstall script.

3 *

4 * Downloads the platform-specific standalone archive from deploy.boxes.dev,

5 * verifies its SHA256 checksum, extracts it, validates it, and promotes it

6 * to ~/.devbox/standalone/current/.

7 */

9import fs from "node:fs";

10import path from "node:path";

Source & flagged code

4 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.cjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/postinstall.cjsView file

3// native ESM support in all contexts. This wrapper ensures compatibility. L4: const { execFileSync } = require("node:child_process"); L5: const path = require("node:path");

High

Child Process

Package source references child process execution.

scripts/postinstall.cjsView on unpkg · L3

scripts/postinstall.mjsView file

13import { pipeline } from "node:stream/promises"; L14: import { execFileSync } from "node:child_process"; L15: ... L22: // override via DEVBOX_STANDALONE_MANIFEST_URL env var. L23: const DEFAULT_MANIFEST_URL = "https://deploy.boxes.dev/cli/latest.json"; L24: const DEV_MANIFEST_URL = "https://deploy-dev.boxes.dev/cli/latest.json"; ... L27: // Explicit override for testing. L28: if (process.env.DEVBOX_STANDALONE_MANIFEST_URL) { L29: return process.env.DEVBOX_STANDALONE_MANIFEST_URL;

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

scripts/postinstall.mjsView on unpkg · L13

Findings

4 High3 Medium4 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processscripts/postinstall.cjs

HighShell

HighSame File Env Network Executionscripts/postinstall.mjs

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowFilesystem

LowUrl Strings

LowNo License

Source & flagged code

4 flagged

package.jsonView file

Lines 1-34json

2 "name": "@boxes-dev/cli",

3 "version": "1.0.802",

4 "description": "Boxes.dev CLI (standalone, includes bundled Node runtime)",

5 "license": "UNLICENSED",

6 "publishConfig": {

7 "access": "public"

8 },

9 "bin": {

10 "dvb": "./bin/dvb",

11 "dvbd": "./bin/dvbd"

12 },

13 "files": [

14 "bin/dvb",

15 "bin/dvbd",

16 "scripts/postinstall.cjs",

17 "scripts/postinstall.mjs"

18 ],

19 "scripts": {

20 "postinstall": "node scripts/postinstall.cjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L20

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L20

21 },

22 "engines": {

23 "node": ">=18"

24 },

25 "os": [

26 "darwin",

27 "linux"

28 ],

29 "cpu": [

30 "arm64",

31 "x64"

32 ]

33}

scripts/postinstall.cjsView file

Lines 1-19javascript

1// CJS wrapper for postinstall — spawns the ESM postinstall script.

2// npm postinstall runs with the package's Node, which may be 18+ without

3// native ESM support in all contexts. This wrapper ensures compatibility.

4const { execFileSync } = require("node:child_process");

5const path = require("node:path");

High

Child Process

Package source references child process execution.

scripts/postinstall.cjsView on unpkg · L3

scripts/postinstall.mjsView file

Lines 1-33javascript

1/**

2 * @boxes-dev/cli postinstall script.

3 *

4 * Downloads the platform-specific standalone archive from deploy.boxes.dev,

5 * verifies its SHA256 checksum, extracts it, validates it, and promotes it

6 * to ~/.devbox/standalone/current/.

7 */

9import fs from "node:fs";

10import path from "node:path";