@deploid/cli: Suspicious npm security report (Warn)

Loading npm security reports…

Static Scan Results

scanned 11h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 30 file(s), 287 KB of source, external domains: adoptium.net, api.github.com, appstoreconnect.apple.com, capacitorjs.com, console.firebase.google.com, developer.android.com, developer.apple.com, httpbin.org, www.apple.com, www.google.com, www.googleapis.com

Source & flagged code

4 flagged

dist/internal/core/devices.jsView file

Lines 1-20javascript

1import { spawnSync } from 'node:child_process';

2export function listAndroidDevices() {

High

Child Process

Package source references child process execution.

dist/internal/core/devices.jsView on unpkg · L1

3 const result = spawnSync('adb', ['devices'], {

4 encoding: 'utf8',

5 stdio: ['ignore', 'pipe', 'pipe']

6 });

7 if (result.status !== 0) {

8 const reason = (result.stderr || '').trim() || 'adb devices failed';

9 throw new Error(reason);

10 }

11 return (result.stdout || '')

12 .split('\n')

13 .map((line) => line.trim())

14 .filter((line) => line && !line.startsWith('List of devices'))

15 .map((line) => {

16 const [id, state = 'unknown'] = line.split('\t');

17 return { id, state };

18 });

19}

20//# sourceMappingURL=devices.js.map

dist/internal/plugins/packaging-capacitor/index.jsView file

Lines 1-21javascript

1import { execa, execaCommand } from 'execa';

2import fs from 'node:fs';

High

Shell

Package source references shell execution.

dist/internal/plugins/packaging-capacitor/index.jsView on unpkg · L1

3import path from 'node:path';

dist/internal/core/plugin-loader.jsView file

Lines 1-31javascript

1import { existsSync } from 'node:fs';

2import path from 'node:path';

3import { pathToFileURL } from 'node:url';

4export async function

Source & flagged code

4 flagged · loading source

dist/internal/core/devices.jsView file

@deploid/cli: Suspicious npm security report (Warn) | LPM Firewall

@deploid/cli@2.1.1

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Behavioral surface

Source & flagged code