registry / @clickzetta/cz-cli / 1.0.19

@clickzetta/cz-cli@1.0.19

AI-Agent-friendly CLI for ClickZetta Lakehouse

Static Scan Results

scanned 2mo ago · by rust-scanner

Static analysis flagged 5 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystem

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 4 file(s), 20.1 KB of source

Source & flagged code

2 flagged

package.jsonView file

Lines 1-30json

2 "name": "@clickzetta/cz-cli",

3 "version": "1.0.19",

4 "description": "AI-Agent-friendly CLI for ClickZetta Lakehouse",

5 "bin": {

6 "cz-cli": "bin/run.js",

7 "cz-agent": "bin/agent.js"

8 },

9 "scripts": {

10 "postinstall": "node bin/postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L10

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L10

11 },

12 "files": [

13 "bin/"

14 ],

15 "optionalDependencies": {

16 "@clickzetta/cz-cli-darwin-arm64": "1.0.19",

17 "@clickzetta/cz-cli-darwin-x64": "1.0.19",

18 "@clickzetta/cz-cli-linux-arm64": "1.0.19",

19 "@clickzetta/cz-cli-linux-x64": "1.0.19",

20 "@clickzetta/cz-cli-win32-x64": "1.0.19"

21 },

22 "license": "MIT",

23 "repository": {

24 "type": "git",

25 "url": "https://github.com/clickzetta/cz-cli.git"

26 },

27 "keywords": [

28 "clickzetta",

29 "lakehouse",

30 "cli",

Source & flagged code

2 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code