registry / @catalyst-cloud/cli / 0.16.4
@catalyst-cloud/cli@0.16.4
⚠ Under reviewSet up Catalyst Cloud, check your tickets and manage your account from the command line.
Static Scan Results
scanned 25d ago · by rust-scannerStatic analysis completed at 65.0% confidence. No malicious behavior was detected; 11 low-signal pattern(s) were surfaced and cleared.
Static reason
No blocking static signals were detected.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
3 flaggeddist/events.jsView file
8const eventsModule = "@catalyst-cloud/sdk/events";
L9: export const loadEventsSdk = () => import(eventsModule);
L10: /** Consecutive failed attempts after which `wait-for` reports an outage rather than waiting on. */
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/events.jsView on unpkg · L8vendor/self-host/linux-session-egress/session-egress.pyView file
•path = vendor/self-host/linux-session-egress/session-egress.py
kind = build_helper
sizeBytes = 12450
magicHex = [redacted]
Medium
Ships Build Helper
Package ships non-JavaScript build or shell helper files.
vendor/self-host/linux-session-egress/session-egress.pyView on unpkgdist/replica.js#virtual:normalized:round1View file
Findings
1 High5 Medium5 Low
HighSemantic Analysis Limiteddist/replica.js#virtual:normalized:round1
MediumDynamic Requiredist/events.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helpervendor/self-host/linux-session-egress/session-egress.py
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @catalyst-cloud/cli@0.16.4.
See all versions of @catalyst-cloud/cli for other recorded verdicts.
- Review the evidence and your use of @catalyst-cloud/cli@0.16.4 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.