registry / @daileyos/cli / 0.19.1

@daileyos/cli@0.19.1

Dailey OS CLI

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 86 file(s), 560 KB of source, external domains: checkout.stripe.com, cli.github.com, docs.dailey.cloud, new-site.dailey.cloud, oldsite.com, os.dailey.cloud

Source & flagged code

3 flagged

dist/commands/db.jsView file

Lines 778-818javascript

778 else {

779 if (!opts.sourceHost || !opts.sourceDb || !opts.sourceUser) {

780 console.error(chalk.red('Error: provide --source-url, or all of --source-host, --source-db, and --source-user.'));

781 process.exit(1);

782 }

783 source = {

784 host: opts.sourceHost,

785 port: opts.sourcePort ? Number(opts.sourcePort) : undefined,

786 database: opts.sourceDb,

787 user: opts.sourceUser,

788 };

789 }

790 // Password resolution order: env var, embedded URL password, hidden

791 // prompt. NEVER a --password flag (shell-history leak).

792 let password = process.env.DAILEY_MIGRATE_SOURCE_PASSWORD || source.password;

793 if (!password) {

794 if (!process.stdin.isTTY) {

795 console.error(chalk.red('Error: no source DB password. Set DAILEY_MIGRATE_SOURCE_PASSWORD or run interactively for a hidden prompt.'));

796 process.exit(1);

797 }

798 password = await promptLine('Source DB password: ', true);

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/commands/db.jsView on unpkg · L798

799 }

800 if (!password) {

801 console.error(chalk.red('Error: source DB password is required.'));

802 process.exit(1);

803 }

804 const submitSpinner = ora('Submitting migration & estimating...').start();

805 const created = await api(`/projects/${project.id}/migrations`, {

806 method: 'POST',

807 body: {

808 host: source.host,

809 port: source.port,

810 database: source.database,

811 user: source.user,

812 password,

813 allow_non_empty: opts.allowNonEmpty || undefined,

814 row_ceiling: opts.rowCeiling ? Number(opts.rowCeiling) : undefined,

815 },

816 });

817 // Drop the password from memory reference; do not log it anywhere.

818 password = '';

dist/commands/wordpress.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @daileyos/cli@0.19.0 matchedIdentity = npm:QGRhaWxleW9zL2NsaQ:0.19.0 similarity = 0.941 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/commands/wordpress.jsView on unpkg

src/commands/db.tsView file

Lines 892-932typescript

892 source = {

893 host: opts.sourceHost,

894 port: opts.sourcePort ? Number(opts.sourcePort) : undefined,

895 database: opts.sourceDb,

896 user: opts.sourceUser,

897 };

898 }

899

900 // Password resolution order: env var, embedded URL password, hidden

Source & flagged code

3 flagged · loading source

dist/commands/db.jsView file

798patternName = generic_password severity = medium line = 798 matchedText = password...ue);

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/commands/db.jsView on unpkg · L798

dist/commands/wordpress.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/commands/wordpress.jsView on unpkg

src/commands/db.tsView file

912patternName = generic_password severity = medium line = 912 matchedText = password...ue);

Medium

Secret Pattern

Hardcoded password in src/commands/db.ts

src/commands/db.tsView on unpkg · L912

Findings

1 High4 Medium6 Low

HighPrevious Version Dangerous Deltadist/commands/wordpress.js

MediumSecret Patterndist/commands/db.js

MediumNetwork

MediumEnvironment Vars

MediumSecret Patternsrc/commands/db.ts

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

3 flagged

dist/commands/db.jsView file

Lines 778-818javascript

778 else {

779 if (!opts.sourceHost || !opts.sourceDb || !opts.sourceUser) {

780 console.error(chalk.red('Error: provide --source-url, or all of --source-host, --source-db, and --source-user.'));

781 process.exit(1);

782 }

783 source = {

784 host: opts.sourceHost,

785 port: opts.sourcePort ? Number(opts.sourcePort) : undefined,

786 database: opts.sourceDb,

787 user: opts.sourceUser,

788 };

789 }

790 // Password resolution order: env var, embedded URL password, hidden

791 // prompt. NEVER a --password flag (shell-history leak).

792 let password = process.env.DAILEY_MIGRATE_SOURCE_PASSWORD || source.password;

793 if (!password) {

794 if (!process.stdin.isTTY) {

795 console.error(chalk.red('Error: no source DB password. Set DAILEY_MIGRATE_SOURCE_PASSWORD or run interactively for a hidden prompt.'));

796 process.exit(1);

797 }

798 password = await promptLine('Source DB password: ', true);

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/commands/db.jsView on unpkg · L798

799 }

800 if (!password) {

801 console.error(chalk.red('Error: source DB password is required.'));

802 process.exit(1);

803 }

804 const submitSpinner = ora('Submitting migration & estimating...').start();

805 const created = await api(`/projects/${project.id}/migrations`, {

806 method: 'POST',

807 body: {

808 host: source.host,

809 port: source.port,

810 database: source.database,

811 user: source.user,

812 password,

813 allow_non_empty: opts.allowNonEmpty || undefined,

814 row_ceiling: opts.rowCeiling ? Number(opts.rowCeiling) : undefined,

815 },

816 });

817 // Drop the password from memory reference; do not log it anywhere.

818 password = '';

dist/commands/wordpress.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/commands/wordpress.jsView on unpkg

src/commands/db.tsView file

Lines 892-932typescript

892 source = {

893 host: opts.sourceHost,

894 port: opts.sourcePort ? Number(opts.sourcePort) : undefined,

895 database: opts.sourceDb,

896 user: opts.sourceUser,

897 };

898 }

899

900 // Password resolution order: env var, embedded URL password, hidden