registry / @catalyst-cloud/cli / 0.16.33
@catalyst-cloud/cli@0.16.33
⚠ Under reviewSet up Catalyst Cloud, check your tickets and manage your account from the command line.
Static Scan Results
scanned 12d ago · by rust-scannerStatic analysis completed at 65.0% confidence. No malicious behavior was detected; 13 low-signal pattern(s) were surfaced and cleared.
Static reason
No blocking static signals were detected.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
5 flaggedbin/launch.jsView file
61const noticeLast = deprecated && !noticeFirst;
L62: import("../dist/cli.js")
L63: .then((m) => m.main(argv))
Medium
Dynamic Require
Package source references dynamic require/import behavior.
bin/launch.jsView on unpkg · L61dist/onboard-runner-disk.jsView file
1Trigger-reachable persistence chain: manifest.bin -> bin/catalyst.js -> bin/launch.js -> dist/cli.js -> dist/onboard-next.js -> dist/onboard-runner-disk.js
L1: import { spawnSync } from "node:child_process";
L2: import { chmodSync, existsSync, mkdirSync, readFileSync, realpathSync, renameSync, statfsSync, writeFileSync } from "node:fs";
...
L30: return "host_disk_sample_invalid";
L31: const value = JSON.parse(text);
L32: if (typeof value !== "object" || value === null || Array.isArray(value))
...
L96: const read = spawnSync("docker", ["info", "--format", "{{.DockerRootDir}}"], { encoding: "utf8", timeout: 10_000, env });
L97: const root = read.status === 0 ? read.stdout.trim() : "";
L98: if (!isAbsolute(root))
...
L224: for (const domain of [`gui/${uid}`, `user/${uid}`])
L225: if (run("/bi
High
Trigger Reachable Persistence
A manifest entrypoint or package-local install chain reaches persistence behavior.
dist/onboard-runner-disk.jsFindings
2 High6 Medium5 Low
HighTrigger Reachable Persistencedist/onboard-runner-disk.js
HighSemantic Analysis Limiteddist/replica.js#virtual:normalized:round1
MediumDynamic Requirebin/launch.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/onboard-runner-disk.js
MediumShips Build Helpervendor/self-host/host-disk-sample.py
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @catalyst-cloud/cli@0.16.33.
See all versions of @catalyst-cloud/cli for other recorded verdicts.
- Review the evidence and your use of @catalyst-cloud/cli@0.16.33 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.