registry / @cloudgrid-io/cli / 0.15.14

@cloudgrid-io/cli@0.15.14

The CloudGrid CLI — put your apps and agents on the grid.

Static Scan Results

scanned 4h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 8 file(s), 694 KB of source, external domains: api.cloudgrid.io, api.example.com, code.claude.com, console.cloudgrid.io, github.com, registry.npmjs.org

Source & flagged code

4 flagged

dist/index.jsView file

2815import { Command as Command4 } from "commander"; L2816: import { execSync } from "child_process"; L2817: import { existsSync as existsSync25, mkdirSync as mkdirSync10, readdirSync as readdirSync4, writeFileSync as writeFileSync14, rmSync as rmSync3 } from "fs";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L2815

52// src/utils.ts L53: import { execa } from "execa"; L54: import chalk from "chalk";

High

Shell

Package source references shell execution.

dist/index.jsView on unpkg · L52

19151if (!existsSync38(path)) { L19152: process.stderr.write(`Error: completion script not found at ${path}. Reinstall the CLI. L19153: `); ... L19162: import { Command as Command82 } from "commander"; L19163: import { execSync as execSync3 } from "child_process"; L19164: import * as net3 from "net"; L19165: import chalk8 from "chalk";

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L19151

completions/cloudgrid.fishView file

•path = completions/cloudgrid.fish kind = build_helper sizeBytes = 2405 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

completions/cloudgrid.fishView on unpkg

Source & flagged code

4 flagged · loading source

dist/index.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code