@capgo/cli@8.25.9

⚠ Under review

A CLI to upload to capgo servers

Static Scan Results

scanned 4mo ago · by rust-scanner

Static analysis flagged 24 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 2.19 MB of source, external domains: accounts.google.com, androidpublisher.googleapis.com, api.appstoreconnect.apple.com, api.capgo.app, appstoreconnect.apple.com, capacitorjs.com, capgo.app, cli.github.com, console.capgo.app, developer.android.com, developer.mozilla.org, docs.npmjs.com, eu.i.posthog.com, files.capgo.app, github.com, json-schema.org, mths.be, oauth2.googleapis.com, plugin.capgo.app, rafeca.com, s3.amazonaws.com, schemas.android.com, semver.org, support.google.com, www.googleapis.com, www.w3.org

Oversized source lightweight scan

dist/index.js4.31 MB file, sampled 256 KB

NetworkChildProcessEnvironmentVarsHighEntropyStringsMinifiedUrlStringscapgo.appconsole.capgo.appdeveloper.android.comeu.i.posthog.comgithub.com

Source & flagged code

15 flagged

dist/src/sdk.jsView file

463patternName = private_key_rsa severity = critical line = 463 matchedText = `||Y==="...thm.

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/src/sdk.jsView on unpkg · L463

4`){if(Y)X+=K_("");let z=Q?O_(Q):void 0;if(Q&&z)X+=V_(z)}else if(H===` L5: `){if(Q&&O_(Q))X+=V_(Q);if(Y)X+=K_(Y)}}return X},oV0;var PN=e(()=>{IN();TN=`${iV0}8;;`,z_=new RegExp(`(?:\\${w_}(?<code>\\d+)m|\\${TN}(?<uri>.*)${CN})`,"y"),oV0=/\r?\n/});var U1=R(... L6: `),Y=0,Z=$;for(let U of Q){if(Z<=U.length)break;Z-=U.length+1,Y++}for(Y=Math.max(0,Math.min(Q.length-1,Y+J)),Z=Math.min(Z,Q[Y].length)+D;Z<0&&Y>0;)Y--,Z+=Q[Y].length+1;for(;Z>Q[Y].... L7: `),X=D.split(` L8: `),Q=Math.max(J.length,X.length),Y=[];for(let Z=0;Z<Q;Z++)J[Z]!==X[Z]&&Y.push(Z);return{lines:Y,numLinesBefore:J.length,numLinesAfter:X.length,numLines:Q}}function W$($){return $==... L9: `).map((F,U,G)=>{let q=Y?Y(F,U):F;return U===0?`${X}${q}`:U===G.length-1?`${Q}${q}`:`${J}${q}`}).join(` ... L14: `).slice(Y);this.output.wr

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/src/sdk.jsView on unpkg · L4

131Trigger-reachable chain: manifest.exports -> dist/src/sdk.js L131: `)}function eS0($){if($)process.env.DEBUG=$;else delete process.env.DEBUG}function $x0(){return process.env.DEBUG}function Dx0($){$.inspectOpts={};let D=Object.keys(ld.inspectOpts)... L132: `).map((D)=>D.trim()).join(" ")};cd.O=function($){return this.inspectOpts.colors=this.useColors,a3.inspect($,this.inspectOpts)}});var e3=R((IM$,GL)=>{if(typeof process>"u"||process... L133: L134: see https://github.com/jprichardson/node-fs-extra/issues/269`,"Warning","fs-extra-WARN0001");let{srcStat:X,destStat:Q}=await sZ.checkPaths($,D,"copy",J);if(await sZ.checkParentPath... L135: L136: see https://github.com/jprichardson/node-fs-extra/issues/269`,"Warning","fs-extra-WARN0002");let{srcStat:X,destStat:Q}=$F.checkPathsSync($,D,"copy",J

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/src/sdk.jsView on unpkg · L131

463patternName = private_key_rsa severity = critical line = 463 matchedText = `||Y==="...thm.

Critical

Secret Pattern

RSA private key in dist/src/sdk.js

dist/src/sdk.jsView on unpkg · L463

472patternName = private_key_rsa severity = critical line = 472 matchedText = `+" - T...in(`

Critical

Secret Pattern

RSA private key in dist/src/sdk.js

dist/src/sdk.jsView on unpkg · L472

650patternName = private_key_rsa severity = critical line = 650 matchedText = All pack... Y=`

Critical

Secret Pattern

RSA private key in dist/src/sdk.js

dist/src/sdk.jsView on unpkg · L650

273L274: see https://github.com/jprichardson/node-fs-extra/issues/269`);PF.checkPaths($,D,"copy",(Q,Y)=>{if(Q)return X(Q);let{srcStat:Z,destStat:F}=Y;PF.checkParentPaths($,Z,D,"copy",(U)=>{... L275: `)}Q60.check=Vi0;async function Ki0($){var D;if((D=$.app.extConfig.server)===null||D===void 0?void 0:D.url)return null;if(["",".","..","../","./"].includes($.app.webDir))return`"${...

High

Child Process

Package source references child process execution.

dist/src/sdk.jsView on unpkg · L273

311export default config; L312: `}});var hH,p9,gE,E60,R60,A60,I60,j60;var mE=e(()=>{hH=E$(B60(),1),p9=E$(XH(),1),gE=hH.loadConfig,E60=hH.writeConfig,R60=p9.findMonorepoRoot,A60=p9.findNXMonorepoRoot,I60=p9.isMono... L313: `)}var k60=($,D)=>{$.name="$ZodError",Object.defineProperty($,"_zod",{value:$._zod,enumerable:!1}),Object.defineProperty($,"issues",{value:D,enumerable:!1}),$.message=JSON.stringif...

High

Eval

Package source references dynamic code evaluation.

dist/src/sdk.jsView on unpkg · L311

133L134: see https://github.com/jprichardson/node-fs-extra/issues/269`,"Warning","fs-extra-WARN0001");let{srcStat:X,destStat:Q}=await sZ.checkPaths($,D,"copy",J);if(await sZ.checkParentPath... L135: L136: see https://github.com/jprichardson/node-fs-extra/issues/269`,"Warning","fs-extra-WARN0002");let{srcStat:X,destStat:Q}=$F.checkPathsSync($,D,"copy",J);if($F.checkParentPathsSync($,... L137: `,finalEOL:J=!0,replacer:X=null,spaces:Q}={}){let Y=J?D:"",Z=JSON.stringify($,X,Q);if(Z===void 0)throw TypeError(`Converting ${typeof $} value to JSON is not supported`);return Z.r... L138: `)];for(let[G,q]of U.entries()){if(X+=q,GW.has(q)){let{groups:H}=new RegExp("(?:\\[(?<code>\\d+)m|\\]8;;(?<uri>.*)\x07)").exec(U.slice(G).join(""))||{groups:{}};if(H.code!==void 0)... ... L146: `);return W=Math

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/src/sdk.jsView on unpkg · L133

131`)}function eS0($){if($)process.env.DEBUG=$;else delete process.env.DEBUG}function $x0(){return process.env.DEBUG}function Dx0($){$.inspectOpts={};let D=Object.keys(ld.inspectOpts)... L132: `).map((D)=>D.trim()).join(" ")};cd.O=function($){return this.inspectOpts.colors=this.useColors,a3.inspect($,this.inspectOpts)}});var e3=R((IM$,GL)=>{if(typeof process>"u"||process... L133: L134: see https://github.com/jprichardson/node-fs-extra/issues/269`,"Warning","fs-extra-WARN0001");let{srcStat:X,destStat:Q}=await sZ.checkPaths($,D,"copy",J);if(await sZ.checkParentPath... L135: L136: see https://github.com/jprichardson/node-fs-extra/issues/269`,"Warning","fs-extra-WARN0002");let{srcStat:X,destStat:Q}=$F.checkPathsSync($,D,"copy",J);if($F.checkParentPathsSync($,... L137: `,finalEOL:J=!0,repl

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/src/sdk.jsView on unpkg · L131

125`)}),D}});var km=R((fw$,_m)=>{var I9=s("constants"),UP0=process.cwd,_3=null,GP0=process.env.GRACEFUL_FS_PLATFORM||process.platform;process.cwd=function(){if(!_3)_3=UP0.call(process... L126: GFS4: `),console.error($)};if(!R1[GD]){if(gM=global[GD]||[],mm(R1,gM),R1.close=function($){function D(J,X){return $.call(R1,J,function(Q){if(!Q)gm();if(typeof X==="function")X.appl... L127: `)}}});var OX=e(()=>{xd()});async function r3($){try{let J=`https://registry.npmjs.org/${encodeURIComponent($.toLowerCase())}`,X=await fetch(J,{headers:{accept:"application/vnd.npm...

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

dist/src/sdk.jsView on unpkg · L125

108${L}`}});var Gf=R((Ff)=>{Object.defineProperty(Ff,"__esModule",{value:!0});Ff.WebAuthnUnknownError=Ff.WebAuthnError=void 0;Ff.isWebAuthnError=hB0;Ff.identifyRegistrationError=bB0;F... L109: `);let M=await K.signMessage(new TextEncoder().encode(z),"utf8");if(!M||!(M instanceof Uint8Array))throw Error("@supabase/auth-js: Wallet signMessage() API returned an recognized v... L110: `)!=-1,X=this._styles,Q=X.length;while(Q--){var Y=d7[X[Q]];if(D=Y.open+D.replace(Y.closeRe,Y.open)+Y.close,J)D=D.replace(h20,function(Z){return Y.close+Z+Y.open})}return D}K$.setTh...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/src/sdk.jsView on unpkg · L108

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/src/sdk.jsView on unpkg · L4

dist/index.jsView file

•path = dist/index.js kind = oversized_source_file sizeBytes = 4520833 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/index.jsView on unpkg

•path = dist/index.js kind = oversized_cli_entrypoint sizeBytes = 4520833 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/index.jsView on unpkg

Source & flagged code

15 flagged · loading source

dist/src/sdk.jsView file

463patternName = private_key_rsa severity = critical line = 463 matchedText = `||Y==="...thm.

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/src/sdk.jsView on unpkg · L463

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/src/sdk.jsView on unpkg · L4

Findings

6 Critical7 High6 Medium5 Low

CriticalCritical Secretdist/src/sdk.js

CriticalRemote Asset Decode Executedist/src/sdk.js

CriticalTrigger Reachable Dangerous Capabilitydist/src/sdk.js

CriticalSecret Patterndist/src/sdk.js

HighChild Processdist/src/sdk.js

HighEvaldist/src/sdk.js

HighSame File Env Network Executiondist/src/sdk.js

HighCommand Output Exfiltrationdist/src/sdk.js

HighObfuscated Payload Loaderdist/src/sdk.js

HighObfuscated

HighOversized Source File

Affected versions and remediation

This report applies to @capgo/cli@8.25.9.

See all versions of @capgo/cli for other recorded verdicts.

Review the evidence and your use of @capgo/cli@8.25.9 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-07-09 16:34:05.574Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.