registry / @catena/cli / 0.0.3

@catena/cli@0.0.3

Catena CLI for agent runtimes

Static Scan Results

scanned 8d ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 5 file(s), 451 KB of source, external domains: 127.0.0.1, api.catena.com, basescan.org, github.com, registry.npmjs.org, sepolia.basescan.org, www.apache.org

Source & flagged code

4 flagged

dist/index.mjsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import{defineCommand as e,renderUsage as t,runMain as n}from"citty";import*as r from"valibot";import*as i from"node:crypto";import{createECDH as a,createHash as o,randomBytes as s}from"node:crypto";import{execFile as c,spawn as l}from"node:child_process";import{chmodSync as u,existsSync as d,mkdirSync as f,readFileSync as p,renameSync as m,rmSync as h,statSync as g,writeFileSync as _}from"node:fs";import{homedir as v}from"node:os";import{dirname as y,join as b}from"node:path";import{createServer as x}from"node:http";import S from"semver";var C=Object.create,w=Object.defineProperty,T=Object.get ...

3`}var en=class{runSecurity;constructor(e={}){if((e.platform??process.platform)!==`darwin`)throw Error(`macOS Keychain credential storage is only supported on macOS`);this.runSecurity=e.runSecurity??Gt}async save(e,t){let n=Ot(t),r=Rt(e),i=await this.resolveLegacyChunkCount(r,64);if(await this.savePassword(r,Nt(n)),!Pt(await this.resolveDirectPassword(r),n))throw Error(`macOS Keychain credential save verification failed`);await this.deleteChunks(r,i)}async resolve(e){let t=Rt(e),n=await this.resolveKeychainItem(t);return n===null?null:n.kind===`direct`?n.payload:this.resolveLegacyPayload(t,n.ma ...

High

Child Process

Package source references child process execution.

dist/index.mjsView on unpkg · L1

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.mjsView on unpkg · L1

4`,{encoding:`utf-8`,mode:384}),m(n,t)}function xn(e,t){hn(e);let n=r.parse(un,t);on(n.bank_url,`profile "${e}" bank_url`);let i=vn();bn({...i,profiles:{...i.profiles,[e]:n}})}function Sn(e){return e.status===`linked`

6CLI version: ${e}

8Examples below use \`npx -y @catena/cli@latest ...\` so agents fetch the current

9CLI. If \`catena\` is already installed, use \`catena ...\` with the same

10arguments. Every non-\`link\` command resolves credentials from the selected

11profile and prints JSON on stdout; errors and upgrade notices go to stderr. The

12\`guide\` command is documentation, so it prints this Markdown guide on stdout.

14Every command supports \`--help\`; use it for exact syntax, choices, and

15defaults rather than guessing. This guide covers what \`--help\` cannot: when to

16run each command, how ids flow between them, and how to read the results.

18## Setup

201. Run \`npx -y @catena/cli@latest whoami\`. If it returns an agent, you are

21 linked and can continue.

Long lines were clipped for display.

Lines 289-329javascript

289* in the Software without restriction, including without limitation the rights

290* to use, copy, modify, merge, publish, distribute, sublicense, and/or sell

291* copies of the Software, and to permit persons to whom the Software is

292* furnished to do so, subject to the following conditions:

293*

294* The above copyright notice and this permission notice shall be included in all

295* copies or substantial portions of

Source & flagged code

4 flagged · loading source

dist/index.mjsView file

High

Child Process

Package source references child process execution.

dist/index.mjsView on unpkg · L1

1#!/usr/bin/env node L2: import{defineCommand as e,renderUsage as t,runMain as n}from"citty";import*as r from"valibot";import*as i from"node:crypto";import{createECDH as a,createHash as o,randomBytes as s}... L3: `}var en=class{runSecurity;constructor(e={}){if((e.platform??process.platform)!==`darwin`)throw Error(`macOS Keychain credential storage is only supported on macOS`);this.runSecuri... L4: `,{encoding:`utf-8`,mode:384}),m(n,t)}function xn(e,t){hn(e);let n=r.parse(un,t);on(n.bank_url,`profile "${e}" bank_url`);let i=vn();bn({...i,profiles:{...i.profiles,[e]:n}})}funct...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.mjsView on unpkg · L1

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.mjsView on unpkg · L1

309`)}else{if(!t)throw Error(`Required argument 'tag' is missed`);return this.encodeStruct({type:t,rawData:r.BufferSourceConverter.toArrayBuffer(e)})}}static encodeStruct(e){let t=e.t... L310: `)}};U.CertificateTag=`CERTIFICATE`,U.CrlTag=`CRL`,U.CertificateRequestTag=`CERTIFICATE REQUEST`,U.PublicKeyTag=`PUBLIC KEY`,U.PrivateKeyTag=`PRIVATE KEY`;var W=class e extends ve{... L311: `);case`asn`:return t.AsnConvert.toString(n);case`hex`:return r.Convert.ToHex(n);case`base64`:return r.Convert.ToBase64(n);case`base64url`:return r.Convert.ToBase64Url(n);case`text...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.mjsView on unpkg · L309

Findings

3 High4 Medium4 Low

HighChild Processdist/index.mjs

HighSame File Env Network Executiondist/index.mjs

HighCommand Output Exfiltrationdist/index.mjs

MediumDynamic Requiredist/index.mjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings