registry / @deploya-app/cli / 0.1.0

@deploya-app/cli@0.1.0

Deploy static sites to Deploya from a terminal or AI agent

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 7 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 7 file(s), 19.2 KB of source, external domains: app.deploya.ru

Source & flagged code

1 flagged

src/config.jsView file

Lines 1-26javascript

1'use strict';

3const fs = require('node:fs');

4const os = require('node:os');

5const path = require('node:path');

7const DEFAULT_APP_URL = 'https://app.deploya.ru';

9function configDirectory() {

10 if (process.env.DEPLOYA_CONFIG_DIR) return path.resolve(process.env.DEPLOYA_CONFIG_DIR);

11 if (process.platform === 'win32' && process.env.APPDATA) return path.join(process.env.APPDATA, 'Deploya');

12 return path.join(os.homedir(), '.config', 'deploya');

13}

15function userConfigPath() {

16 return path.join(configDirectory(), 'config.json');

17}

19function readJson(file) {

20 try { return JSON.parse(fs.readFileSync(file, 'utf8')); }

21 catch { return {}; }

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

src/config.jsView on unpkg · L6

22}

24function writeJsonAtomic(file, value, secret = false) {

25 fs.mkdirSync(path.dirname(file), { recursive: true });

26 const temporary = `${file}.${process.pid}.tmp`;

Source & flagged code

1 flagged · loading source

src/config.jsView file

6L7: const DEFAULT_APP_URL = 'https://app.deploya.ru'; L8: L9: function configDirectory() { L10: if (process.env.DEPLOYA_CONFIG_DIR) return path.resolve(process.env.DEPLOYA_CONFIG_DIR); L11: if (process.platform === 'win32' && process.env.APPDATA) return path.join(process.env.APPDATA, 'Deploya'); L12: return path.join(os.homedir(), '.config', 'deploya'); L13: } ... L19: function readJson(file) { L20: try { return JSON.parse(fs.readFileSync(file, 'utf8')); } L21: catch { return {}; }

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

src/config.jsView on unpkg · L6

Findings

1 High3 Medium3 Low

HighSandbox Evasion Gated Capabilitysrc/config.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

1 flagged

src/config.jsView file

Lines 1-26javascript

1'use strict';

3const fs = require('node:fs');

4const os = require('node:os');

5const path = require('node:path');

7const DEFAULT_APP_URL = 'https://app.deploya.ru';

9function configDirectory() {

10 if (process.env.DEPLOYA_CONFIG_DIR) return path.resolve(process.env.DEPLOYA_CONFIG_DIR);

11 if (process.platform === 'win32' && process.env.APPDATA) return path.join(process.env.APPDATA, 'Deploya');

12 return path.join(os.homedir(), '.config', 'deploya');

13}

15function userConfigPath() {

16 return path.join(configDirectory(), 'config.json');

17}

19function readJson(file) {

20 try { return JSON.parse(fs.readFileSync(file, 'utf8')); }

21 catch { return {}; }

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

src/config.jsView on unpkg · L6

22}

24function writeJsonAtomic(file, value, secret = false) {

25 fs.mkdirSync(path.dirname(file), { recursive: true });

26 const temporary = `${file}.${process.pid}.tmp`;