registry / @chainabit/cli / 1.0.2

@chainabit/cli@1.0.2

Chainabit CLI — the terminal control plane for workspaces, AI, connectors, and automation

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

NoLicense

scanned 1 file(s), 161 KB of source, external domains: api.chainabit.com, app.chainabit.com, chainabit.com, github.com

Source & flagged code

4 flagged

bin/chainabit.cjsView file

Lines 1-34javascript

1#!/usr/bin/env node

2var rr=Object.create;var Ve=Object.defineProperty;var ir=Object.getOwnPropertyDescriptor;var or=Object.getOwnPropertyNames;var ar=Object.getPrototypeOf,cr=Object.prototype.hasOwnProperty;var lr=(e,t)=>{for(var r in t)Ve(e,r,{get:t[r],enumerable:!0})},en=(e,t,r,i)=>{if(t&&typeof t=="object"||typeof t=="function")for(let n of or(t))!cr.call(e,n)&&n!==r&&Ve(e,n,{get:()=>t[n],enumerable:!(i=ir(t,n))||i.enumerable});return e};var N=(e,t,r)=>(r=e!=null?rr(ar(e)):{},en(t||!e||!e.__esModule?Ve(r,"default",{value:e,enumerable:!0}):r,e)),dr=e=>en(Ve({},"__esModule",{value:!0}),e);var Hi={};lr(Hi,{create ...

3`,{encoding:"utf-8",mode:384}),St(ye,384)}function we(e){if(e)return e;if(process.env.CHAINABIT_BASE_URL)return process.env.CHAINABIT_BASE_URL;if(process.env.CHAINABIT__API_BASE_URL){let t=process.env.CHAINABIT__API_BASE_URL.replace(/\/+$/,"");return new URL(t).pathname==="/"?`${t}/api/v1`:t}return $e().apiUrl}function rn(){let e=process.env.CHAINABIT_APP_BASE_URL??null;if(!e)return null;try{let t=new URL(e);return`${t.protocol}//${t.host}`}catch{return null}}function X(){return process.env.CHAINABIT_TOKEN?process.env.CHAINABIT_TOKEN:$e().token}function on(){return $e().refreshToken}function x ...

4`,{encoding:"utf-8",mode:384})}function Ce(){return ye}var ur=3,pr=1e3,K=class{baseUrl;token;constructor(t,r){this.baseUrl=we(t).replace(/\/+$/,""),this.token=r??X()}headers(t,r=!0){let i={Accept:"application/json"};if(r&&(i["Content-Type"]="application/json"),this.token&&(i.Authorization=`Bearer ${this.token}`),t)for(let[n,s]of Object.entries(t))i[n]=s;return i}async get(t,r,i){let n=`${this.baseUrl}${t}`;if(r){let s=new URLSearchParams(r);n+=`?${s.toString()}`}return this.request(n,{method:"GET"},i)}async post(t,r,i){let n=`${this.baseUrl}${t}`;return this.request(n,{method:"POST",body:r!==v ...

5${T("\u2717",`${V}${Ne}`)} ${T(e,V)}`),r&&r.length>0){console.error(""),console.error(T(" Suggestions:",`${V}`));for(let i of r)console.error(` ${T("\xB7",B)} ${i.message}`),i.command&&console.error(

6 [ ${e} ]`);for(let a of t)console.log(` | ${a}`);console.log("");return}let i=Math.max(e.length,...t.map(a=>a.length),36)+2,n=`\u256D${"\u2500".repeat(i)}\u256E`,s=`\u251C${"\u2500".repeat(i)}\u2524`,o=`\u2570${"\u2500".repeat(i)}

7`)),this}succeed(t){return this.stop("\u2713",kr,t)}fail(t){return this.stop("\u2717",vr,t)}warn(t){return this.stop("\u26A0",Sr,t)}info(t){return this.stop("\xB7",xr,t)}render(){let t=fn[this.frameIndex%fn.length];this.frameIndex++,process.stdout.write(`\r${Cr}${t}${hn} ${this.label}`)}};async function F(e,t,r){let i=new Re(e);r?.jsonMode||i.start();try{let n=await t();return r?.jsonMode||i.succeed(r?.successLabel),n}catch(n){throw r?.jsonMode||i.fail(),n}}function yn(e){let t=e.split(/\r?\n/).map(s=>s.trimEnd()).filter(s=>s.length>0);if(t.length===0)return null;let r,i="message",n=[];for(let ...

8`)}}async function*_e(e){if(!e.body)return;let t=e.body.getReader(),r=new TextDecoder("utf-8"),i="";for(;;){let{done:s,value:o}=await t.read();if(s)break;for(i+=r.decode(o,{stream:!0});;){let a=i.indexOf(`

10`);if(a===-1)break;let c=i.slice(0,a);i=i.slice(a+2);let l=yn(c);l&&(yield l)}}let n=yn(i);n&&(yield n)}var Rr={isLocal:!1,isDebug:!1,commandStartMs:Date.now()};function $n(e){Object.assign(Rr,e)}var hs=N(require("os"));var Rt=require("commander");var It=N(require("readline")),An=require("child_process");var Ge=N(require("fs")),wn=N(require("path"));async function Ie(e){let t=At(e.directValue),r=At(e.envVar),i=At(e.filePath);if(+!!t+ +!!e.stdin+ +!!r+ +!!i>1&&$(`Use only one ${e.label} source at a time: direct value, --${e.label}-stdin, --${e.label}-env, or --${e.label}-file.`,e.jsonMode),t)re ...

11`):process.stdout.write(n+`

High

Child Process

Package source references child process execution.

bin/chainabit.cjsView on unpkg · L9

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

bin/chainabit.cjsView on unpkg · L1

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

bin/chainabit.cjsView on unpkg · L1

12`)})}function _r(e,t){t.command("device").description("Start browser device-approval flow explicitly.").option("--no-open","Do not auto-open the browser").action(async r=>{let i=e.opts().json??!1,n=e.opts().apiUrl,s=new K(n);await

13`):(pe("API key created \u2014 save this now, it will not be shown again",[`Token ${T(u.token,V)}`,`Preview ${u.tokenPreview}`,`Scopes ${Array.isArray(u.scopes)&&u.scopes.length>0?u.scopes.join(", "):"execution:run"}`,`Kind ${u.tokenKind??"account_bearer"}`,`Expires ${u.expiresAt}`]),z(`export CHAINABIT_TOKEN=${u.tokenPreview.replace(/\*+/,"\u2026")}`),z("chainabit workspace use <workspace-id>"))}catch(l){throw l instanceof U&&$(l.message,s),l}}),r.command("list").description("List all API keys for the current account.").action(async i=>{let n=e.opts().json??!1,s=e.opts().apiUrl,o=X ...

14`):(pe("API key created \u2014 save this now, it will not be shown again",[`Token ${T(u.token,V)}`,`Preview ${u.tokenPreview}`,`Scopes ${Array.isArray(u.scopes)&&u.scopes.length>0?u.scopes.join(", "

17COMMANDS

18 login Authenticate with your Chainabit account. Omit flags for browser login.

19 logout Clear stored credentials and invalidate the server session.

20 whoami Show the currently authenticated user.

21 refresh Force-refresh the stored access token.

22 token Print the raw access token (for piping).

23 device Start browser device-approval flow explicitly.

24developer-token Manage API keys for CI/CD and project automation (create, list, revoke).

25 keys Alias for developer-token.

26 register Create a new Chainabit account.

28Quick starts:

29 chainabit auth login # browser login (default in TTY)

30 chainabit auth login --no-open # print URL + code, no auto-browser

31 chainabit auth login --token-env CHAINABIT_TOKEN # non-interactive

32 chainabit auth whoami

33 chainabit auth token | pbcopy # copy token to clipboard (macOS)

34 chainabit auth keys create "ci-deploy" --ttl 90 --scope execution:run

Long lines were clipped for display.

Source & flagged code

4 flagged · loading source

bin/chainabit.cjsView file

9L10: `);if(a===-1)break;let c=i.slice(0,a);i=i.slice(a+2);let l=yn(c);l&&(yield l)}}let n=yn(i);n&&(yield n)}var Rr={isLocal:!1,isDebug:!1,commandStartMs:Date.now()};function $n(e){Obje... L11: `):process.stdout.write(n+`

High

Child Process

Package source references child process execution.

bin/chainabit.cjsView on unpkg · L9

1#!/usr/bin/env node L2: var rr=Object.create;var Ve=Object.defineProperty;var ir=Object.getOwnPropertyDescriptor;var or=Object.getOwnPropertyNames;var ar=Object.getPrototypeOf,cr=Object.prototype.hasOwnPr... L3: `,{encoding:"utf-8",mode:384}),St(ye,384)}function we(e){if(e)return e;if(process.env.CHAINABIT_BASE_URL)return process.env.CHAINABIT_BASE_URL;if(process.env.CHAINABIT__API_BASE_UR... L4: `,{encoding:"utf-8",mode:384})}function Ce(){return ye}var ur=3,pr=1e3,K=class{baseUrl;token;constructor(t,r){this.baseUrl=we(t).replace(/\/+$/,""),this.token=r??X()}headers(t,r=!0... ... L9: L10: `);if(a===-1)break;let c=i.slice(0,a);i=i.slice(a+2);let l=yn(c);l&&(yield l)}}let n=yn(i);n&&(yield n)}var Rr={isLocal:!1,isDebug:!1,commandStartMs:Date.now()};function $n(e){Obje... L11: `):process.stdout.write(n+`

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

bin/chainabit.cjsView on unpkg · L1

1#!/usr/bin/env node L2: var rr=Object.create;var Ve=Object.defineProperty;var ir=Object.getOwnPropertyDescriptor;var or=Object.getOwnPropertyNames;var ar=Object.getPrototypeOf,cr=Object.prototype.hasOwnPr... L3: `,{encoding:"utf-8",mode:384}),St(ye,384)}function we(e){if(e)return e;if(process.env.CHAINABIT_BASE_URL)return process.env.CHAINABIT_BASE_URL;if(process.env.CHAINABIT__API_BASE_UR... L4: `,{encoding:"utf-8",mode:384})}function Ce(){return ye}var ur=3,pr=1e3,K=class{baseUrl;token;constructor(t,r){this.baseUrl=we(t).replace(/\/+$/,""),this.token=r??X()}headers(t,r=!0... L5: ${T("\u2717",`${V}${Ne}`)} ${T(e,V)}`),r&&r.length>0){console.error(""),console.error(T(" Suggestions:",`${V}`));for(let i of r)console.error(` ${T("\xB7",B)} ${i.message}`),i.co... ... L9: L10: `);if(a===-1)break;let c=i.slice(0,a);i=i.slice(a+2);let l=yn(c);l&&(yield l)}}let n=yn(i);n&&(yield n)}var Rr={isLocal:!1,isDebug:!1,commandStartMs:Date.now()};function $n(e){Obje... L11: `):process.stdout.write(n+`

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

bin/chainabit.cjsView on unpkg · L1

14patternName = generic_password severity = medium line = 14 matchedText = `):(pe("...Br=`

Medium

Secret Pattern

Package contains a possible secret pattern.

bin/chainabit.cjsView on unpkg · L14

Findings

3 High4 Medium6 Low

HighChild Processbin/chainabit.cjs

HighSame File Env Network Executionbin/chainabit.cjs

HighCommand Output Exfiltrationbin/chainabit.cjs

MediumSecret Patternbin/chainabit.cjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

4 flagged

bin/chainabit.cjsView file

Lines 1-34javascript

1#!/usr/bin/env node

11`):process.stdout.write(n+`

High

Child Process

Package source references child process execution.

bin/chainabit.cjsView on unpkg · L9

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

bin/chainabit.cjsView on unpkg · L1

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

bin/chainabit.cjsView on unpkg · L1

17COMMANDS

18 login Authenticate with your Chainabit account. Omit flags for browser login.

19 logout Clear stored credentials and invalidate the server session.

20 whoami Show the currently authenticated user.

21 refresh Force-refresh the stored access token.

22 token Print the raw access token (for piping).

23 device Start browser device-approval flow explicitly.

24developer-token Manage API keys for CI/CD and project automation (create, list, revoke).