registry / @culvii/cli / 0.0.4
@culvii/cli@0.0.4
Culvii CLI
Static Scan Results
scanned 3mo ago · by rust-scannerStatic analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
One or more suspicious static signals were detected.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedTelemetryUrlStrings
Source & flagged code
5 flaggeddist/index.jsView file
1#!/usr/bin/env node
L2: import {a as a$5}from'./chunk-JFIFRAAR.js';import {a as a$4,b as b$1,c as c$1}from'./chunk-KZG5CFSB.js';import {n,e,a as a$2,j as j$1,d,f,c,q,r,s,o,k,l}from'./chunk-V3GXICAW.js';im...
L3: `),u=[],o=!1;for(let a of s){if(a.trim().startsWith("entrypoints:")){o=!0;continue}if(o){let l=a.match(/^\s+-\s+(.+)$/);l?u.push(X.resolve(e,l[1].trim())):a.trim()&&!a.trim().start...
High
1#!/usr/bin/env node
L2: import {a as a$5}from'./chunk-JFIFRAAR.js';import {a as a$4,b as b$1,c as c$1}from'./chunk-KZG5CFSB.js';import {n,e,a as a$2,j as j$1,d,f,c,q,r,s,o,k,l}from'./chunk-V3GXICAW.js';im...
L3: `),u=[],o=!1;for(let a of s){if(a.trim().startsWith("entrypoints:")){o=!0;continue}if(o){let l=a.match(/^\s+-\s+(.+)$/);l?u.push(X.resolve(e,l[1].trim())):a.trim()&&!a.trim().start...
L4: `).filter(w=>w.includes("__culvii_dev_definitions__"));if(a.length===0){n([]);return}let l=[],c=new Set;for(let w of a)try{let p=JSON.parse(w);for(let y of p.__culvii_dev_definitio...
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/index.jsView on unpkg · L11#!/usr/bin/env node
L2: import {a as a$5}from'./chunk-JFIFRAAR.js';import {a as a$4,b as b$1,c as c$1}from'./chunk-KZG5CFSB.js';import {n,e,a as a$2,j as j$1,d,f,c,q,r,s,o,k,l}from'./chunk-V3GXICAW.js';im...
L3: `),u=[],o=!1;for(let a of s){if(a.trim().startsWith("entrypoints:")){o=!0;continue}if(o){let l=a.match(/^\s+-\s+(.+)$/);l?u.push(X.resolve(e,l[1].trim())):a.trim()&&!a.trim().start...
Findings
4 High4 Medium5 Low
HighChild Processdist/index.js
HighSame File Env Network Executiondist/index.js
HighCommand Output Exfiltrationdist/index.js
HighTrigger Reachable Command Output Exfiltrationdist/index.js
MediumDynamic Requiredist/lib/evaluator.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to @culvii/cli@0.0.4.
See all versions of @culvii/cli for other recorded verdicts.
- Review the evidence and your use of @culvii/cli@0.0.4 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.