registry / @catalyst-cloud/cli / 0.16.14
@catalyst-cloud/cli@0.16.14
⚠ Under reviewSet up Catalyst Cloud, check your tickets and manage your account from the command line.
Static Scan Results
scanned 24d ago · by rust-scannerStatic analysis completed at 65.0% confidence. No malicious behavior was detected; 13 low-signal pattern(s) were surfaced and cleared.
Static reason
No blocking static signals were detected.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
5 flaggeddist/events.jsView file
8const eventsModule = "@catalyst-cloud/sdk/events";
L9: export const loadEventsSdk = () => import(eventsModule);
L10: /** Consecutive failed attempts after which `wait-for` reports an outage rather than waiting on. */
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/events.jsView on unpkg · L8dist/onboard-runner-custody.jsView file
1Trigger-reachable persistence chain: manifest.bin -> bin/catalyst.js -> bin/launch.js -> dist/cli.js -> dist/onboard-runtime.js -> dist/onboard-runner.js -> dist/onboard-runner-custody.js
L1: import fs from "node:fs";
L2: import { createHash, createPrivateKey, createPublicKey, generateKeyPairSync, randomBytes } from "node:crypto";
L3: import { execFile } from "node:child_process";
L4: import { userInfo } from "node:os";
...
L17: }
L18: /** Only our fixed installer errors may reach output; never forward command stderr or causes. */
L19: export function darwinThoughtsInstallRefusal(error) {
...
L160: try {
L161: value = JSON.parse(bytes.toString("utf8"));
L162: }
...
L272: catch {
L273: return fail("private_key_custody_invalid");
High
Trigger Reachable Persistence
A manifest entrypoint or package-local install chain reaches persistence behavior.
Findings
2 High6 Medium5 Low
HighTrigger Reachable Persistencedist/onboard-runner-custody.js
HighSemantic Analysis Limiteddist/replica.js#virtual:normalized:round1
MediumDynamic Requiredist/events.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/onboard-runner-custody.js
MediumShips Build Helpervendor/self-host/linux-session-egress/session-egress.py
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @catalyst-cloud/cli@0.16.14.
See all versions of @catalyst-cloud/cli for other recorded verdicts.
- Review the evidence and your use of @catalyst-cloud/cli@0.16.14 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.