@capgo/cli@8.24.6

⚠ Under review

A CLI to upload to capgo servers

Static Scan Results

scanned 4mo ago · by rust-scanner

Static analysis flagged 24 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 2.19 MB of source, external domains: accounts.google.com, androidpublisher.googleapis.com, api.appstoreconnect.apple.com, api.capgo.app, appstoreconnect.apple.com, capacitorjs.com, capgo.app, cli.github.com, console.capgo.app, developer.android.com, developer.mozilla.org, docs.npmjs.com, eu.i.posthog.com, files.capgo.app, github.com, json-schema.org, mths.be, oauth2.googleapis.com, plugin.capgo.app, rafeca.com, s3.amazonaws.com, schemas.android.com, semver.org, support.google.com, www.googleapis.com, www.w3.org

Oversized source lightweight scan

dist/index.js4.29 MB file, sampled 256 KB

NetworkChildProcessEnvironmentVarsHighEntropyStringsMinifiedUrlStringscapgo.appconsole.capgo.appdeveloper.android.comeu.i.posthog.comgithub.com

Source & flagged code

15 flagged

dist/src/sdk.jsView file

463patternName = private_key_rsa severity = critical line = 463 matchedText = `||Y==="...thm.

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/src/sdk.jsView on unpkg · L463

4`){if(Y)X+=O_("");let z=Q?H_(Q):void 0;if(Q&&z)X+=z_(z)}else if(H===` L5: `){if(Q&&H_(Q))X+=z_(Q);if(Y)X+=O_(Y)}}return X},lV0;var jN=s(()=>{EN();IN=`${mV0}8;;`,W_=new RegExp(`(?:\\${K_}(?<code>\\d+)m|\\${IN}(?<uri>.*)${AN})`,"y"),lV0=/\r?\n/});var U1=R(... L6: `),Y=0,Z=$;for(let U of Q){if(Z<=U.length)break;Z-=U.length+1,Y++}for(Y=Math.max(0,Math.min(Q.length-1,Y+J)),Z=Math.min(Z,Q[Y].length)+D;Z<0&&Y>0;)Y--,Z+=Q[Y].length+1;for(;Z>Q[Y].... L7: `),X=D.split(` L8: `),Q=Math.max(J.length,X.length),Y=[];for(let Z=0;Z<Q;Z++)J[Z]!==X[Z]&&Y.push(Z);return{lines:Y,numLinesBefore:J.length,numLinesAfter:X.length,numLines:Q}}function G$($){return $==... L9: `).map((F,U,G)=>{let q=Y?Y(F,U):F;return U===0?`${X}${q}`:U===G.length-1?`${Q}${q}`:`${J}${q}`}).join(` ... L14: `).slice(Y);this.output.wr

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/src/sdk.jsView on unpkg · L4

131Trigger-reachable chain: manifest.exports -> dist/src/sdk.js L131: `)}function rS0($){if($)process.env.DEBUG=$;else delete process.env.DEBUG}function oS0(){return process.env.DEBUG}function tS0($){$.inspectOpts={};let D=Object.keys(dd.inspectOpts)... L132: `).map((D)=>D.trim()).join(" ")};md.O=function($){return this.inspectOpts.colors=this.useColors,p3.inspect($,this.inspectOpts)}});var o3=R((WM$,ZL)=>{if(typeof process>"u"||process... L133: L134: see https://github.com/jprichardson/node-fs-extra/issues/269`,"Warning","fs-extra-WARN0001");let{srcStat:X,destStat:Q}=await oZ.checkPaths($,D,"copy",J);if(await oZ.checkParentPath... L135: L136: see https://github.com/jprichardson/node-fs-extra/issues/269`,"Warning","fs-extra-WARN0002");let{srcStat:X,destStat:Q}=aZ.checkPathsSync($,D,"copy",J

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/src/sdk.jsView on unpkg · L131

463patternName = private_key_rsa severity = critical line = 463 matchedText = `||Y==="...thm.

Critical

Secret Pattern

RSA private key in dist/src/sdk.js

dist/src/sdk.jsView on unpkg · L463

472patternName = private_key_rsa severity = critical line = 472 matchedText = `+" - T...in(`

Critical

Secret Pattern

RSA private key in dist/src/sdk.js

dist/src/sdk.jsView on unpkg · L472

650patternName = private_key_rsa severity = critical line = 650 matchedText = All pack... Y=`

Critical

Secret Pattern

RSA private key in dist/src/sdk.js

dist/src/sdk.jsView on unpkg · L650

273L274: see https://github.com/jprichardson/node-fs-extra/issues/269`);jF.checkPaths($,D,"copy",(Q,Y)=>{if(Q)return X(Q);let{srcStat:Z,destStat:F}=Y;jF.checkParentPaths($,Z,D,"copy",(U)=>{... L275: `)}J60.check=qi0;async function Wi0($){var D;if((D=$.app.extConfig.server)===null||D===void 0?void 0:D.url)return null;if(["",".","..","../","./"].includes($.app.webDir))return`"${...

High

Child Process

Package source references child process execution.

dist/src/sdk.jsView on unpkg · L273

311export default config; L312: `}});var kH,p9,fE,L60,B60,E60,R60,A60;var hE=s(()=>{kH=B$(M60(),1),p9=B$(eW(),1),fE=kH.loadConfig,L60=kH.writeConfig,B60=p9.findMonorepoRoot,E60=p9.findNXMonorepoRoot,R60=p9.isMono... L313: `)}var v60=($,D)=>{$.name="$ZodError",Object.defineProperty($,"_zod",{value:$._zod,enumerable:!1}),Object.defineProperty($,"issues",{value:D,enumerable:!1}),$.message=JSON.stringif...

High

Eval

Package source references dynamic code evaluation.

dist/src/sdk.jsView on unpkg · L311

133L134: see https://github.com/jprichardson/node-fs-extra/issues/269`,"Warning","fs-extra-WARN0001");let{srcStat:X,destStat:Q}=await oZ.checkPaths($,D,"copy",J);if(await oZ.checkParentPath... L135: L136: see https://github.com/jprichardson/node-fs-extra/issues/269`,"Warning","fs-extra-WARN0002");let{srcStat:X,destStat:Q}=aZ.checkPathsSync($,D,"copy",J);if(aZ.checkParentPathsSync($,... L137: `,finalEOL:J=!0,replacer:X=null,spaces:Q}={}){let Y=J?D:"",Z=JSON.stringify($,X,Q);if(Z===void 0)throw TypeError(`Converting ${typeof $} value to JSON is not supported`);return Z.r... L138: `)];for(let[G,q]of U.entries()){if(X+=q,YW.has(q)){let{groups:H}=new RegExp("(?:\\[(?<code>\\d+)m|\\]8;;(?<uri>.*)\x07)").exec(U.slice(G).join(""))||{groups:{}};if(H.code!==void 0)... ... L146: `);return W=Math

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/src/sdk.jsView on unpkg · L133

131`)}function rS0($){if($)process.env.DEBUG=$;else delete process.env.DEBUG}function oS0(){return process.env.DEBUG}function tS0($){$.inspectOpts={};let D=Object.keys(dd.inspectOpts)... L132: `).map((D)=>D.trim()).join(" ")};md.O=function($){return this.inspectOpts.colors=this.useColors,p3.inspect($,this.inspectOpts)}});var o3=R((WM$,ZL)=>{if(typeof process>"u"||process... L133: L134: see https://github.com/jprichardson/node-fs-extra/issues/269`,"Warning","fs-extra-WARN0001");let{srcStat:X,destStat:Q}=await oZ.checkPaths($,D,"copy",J);if(await oZ.checkParentPath... L135: L136: see https://github.com/jprichardson/node-fs-extra/issues/269`,"Warning","fs-extra-WARN0002");let{srcStat:X,destStat:Q}=aZ.checkPathsSync($,D,"copy",J);if(aZ.checkParentPathsSync($,... L137: `,finalEOL:J=!0,repl

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/src/sdk.jsView on unpkg · L131

125`)}),D}});var vm=R((Rw$,xm)=>{var I9=a("constants"),XP0=process.cwd,P3=null,QP0=process.env.GRACEFUL_FS_PLATFORM||process.platform;process.cwd=function(){if(!P3)P3=XP0.call(process... L126: GFS4: `),console.error($)};if(!A1[GD]){if(fM=global[GD]||[],bm(A1,fM),A1.close=function($){function D(J,X){return $.call(A1,J,function(Q){if(!Q)hm();if(typeof X==="function")X.appl... L127: `)}}});var OX=s(()=>{Pd()});async function l3($){try{let J=`https://registry.npmjs.org/${encodeURIComponent($.toLowerCase())}`,X=await fetch(J,{headers:{accept:"application/vnd.npm...

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

dist/src/sdk.jsView on unpkg · L125

108${L}`}});var Ff=R((Yf)=>{Object.defineProperty(Yf,"__esModule",{value:!0});Yf.WebAuthnUnknownError=Yf.WebAuthnError=void 0;Yf.isWebAuthnError=_B0;Yf.identifyRegistrationError=kB0;Y... L109: `);let M=await K.signMessage(new TextEncoder().encode(z),"utf8");if(!M||!(M instanceof Uint8Array))throw Error("@supabase/auth-js: Wallet signMessage() API returned an recognized v... L110: `)!=-1,X=this._styles,Q=X.length;while(Q--){var Y=d7[X[Q]];if(D=Y.open+D.replace(Y.closeRe,Y.open)+Y.close,J)D=D.replace(_20,function(Z){return Y.close+Z+Y.open})}return D}V$.setTh...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/src/sdk.jsView on unpkg · L108

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/src/sdk.jsView on unpkg · L4

dist/index.jsView file

•path = dist/index.js kind = oversized_source_file sizeBytes = 4501191 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/index.jsView on unpkg

•path = dist/index.js kind = oversized_cli_entrypoint sizeBytes = 4501191 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/index.jsView on unpkg

Source & flagged code

15 flagged · loading source

dist/src/sdk.jsView file

463patternName = private_key_rsa severity = critical line = 463 matchedText = `||Y==="...thm.

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/src/sdk.jsView on unpkg · L463

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/src/sdk.jsView on unpkg · L4

Findings

6 Critical7 High6 Medium5 Low

CriticalCritical Secretdist/src/sdk.js

CriticalRemote Asset Decode Executedist/src/sdk.js

CriticalTrigger Reachable Dangerous Capabilitydist/src/sdk.js

CriticalSecret Patterndist/src/sdk.js

HighChild Processdist/src/sdk.js

HighEvaldist/src/sdk.js

HighSame File Env Network Executiondist/src/sdk.js

HighCommand Output Exfiltrationdist/src/sdk.js

HighObfuscated Payload Loaderdist/src/sdk.js

HighObfuscated

HighOversized Source File

Affected versions and remediation

This report applies to @capgo/cli@8.24.6.

See all versions of @capgo/cli for other recorded verdicts.

Review the evidence and your use of @capgo/cli@8.24.6 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-07-05 13:32:52.036Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.