registry / @culvii/cli / 0.0.6
@culvii/cli@0.0.6
Culvii CLI
Static Scan Results
scanned 3mo ago · by rust-scannerStatic analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
One or more suspicious static signals were detected.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedTelemetryUrlStrings
Source & flagged code
6 flaggeddist/index.jsView file
1#!/usr/bin/env node
L2: import {a as a$5}from'./chunk-JFIFRAAR.js';import {a as a$4,b as b$1,c as c$1}from'./chunk-KZG5CFSB.js';import {n,e,a as a$2,j as j$1,d,f,c,q,r,s,o,k,l}from'./chunk-LD5ISISS.js';im...
L3: `),d=[],o=!1;for(let s of a){if(s.trim().startsWith("entrypoints:")){o=!0;continue}if(o){let u=s.match(/^\s+-\s+(.+)$/);u?d.push(J.resolve(t,u[1].trim())):s.trim()&&!s.trim().start...
High
1#!/usr/bin/env node
L2: import {a as a$5}from'./chunk-JFIFRAAR.js';import {a as a$4,b as b$1,c as c$1}from'./chunk-KZG5CFSB.js';import {n,e,a as a$2,j as j$1,d,f,c,q,r,s,o,k,l}from'./chunk-LD5ISISS.js';im...
L3: `),d=[],o=!1;for(let s of a){if(s.trim().startsWith("entrypoints:")){o=!0;continue}if(o){let u=s.match(/^\s+-\s+(.+)$/);u?d.push(J.resolve(t,u[1].trim())):s.trim()&&!s.trim().start...
L4: `).filter(w=>w.includes("__culvii_dev_definitions__"));if(s.length===0){n([]);return}let u=[],c=new Set;for(let w of s)try{let p=JSON.parse(w);for(let y of p.__culvii_dev_definitio...
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/index.jsView on unpkg · L1•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior.
dist/index.js:
import {a as a$5}from'./chunk-JFIFRAAR.js';import {a as a$4,b as b$1,c as c$1}from'./chunk-KZG5CFSB.js';import {n,e,a as a$2,j as j$1,d,f,c,q,r,s,o,k,l}from'./chunk-LD5ISISS.js';im...
`),d=[],o=!1;for(let s of a){if(s.trim().startsWith("entrypoints:")){o=!0;continue}if(o){let u=s.match(/^\s+-\s+(.+)$/);u?d.push(J.resolve(t,u[1].trim())):s.trim()&&!s.trim().start...
Run: culvii rename ${N} ${G.slug} --resource-type ${L}`,"warn"):(t.onOrphan(N,L),n.delete(g),I++);}let E=[...k.entries()].sort(([,g],[,C])=>+(C.type==="surface")-+(g.type==="surfac...
`),d=[],o=!1;for(let s of a){if(s.trim().startsWith("entrypoints:")){o=!0;continue}if(o){let u=s.
Findings
5 High4 Medium5 Low
HighChild Processdist/index.js
HighSame File Env Network Executiondist/index.js
HighEntrypoint Foreign Package Code Overwritedist/index.js
HighCommand Output Exfiltrationdist/index.js
HighTrigger Reachable Command Output Exfiltrationdist/index.js
MediumDynamic Requiredist/lib/evaluator.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to @culvii/cli@0.0.6.
See all versions of @culvii/cli for other recorded verdicts.
- Review the evidence and your use of @culvii/cli@0.0.6 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.