registry / @depot/cli / 0.0.1-cli.2.101.67

@depot/cli@0.0.1-cli.2.101.67

Depot CLI

Static Scan Results

scanned 9d ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 87.4 KB of source, external domains: nodejs.org, registry.npmjs.org, yarnpkg.com

Source & flagged code

7 flagged

package.jsonView file

Lines 10-32json

10 "bin": {

11 "depot": "bin/depot"

12 },

13 "main": "lib/main.js",

14 "types": "lib/main.d.ts",

15 "optionalDependencies": {

16 "@depot/cli-darwin-arm64": "0.0.1-cli.2.101.67",

17 "@depot/cli-darwin-x64": "0.0.1-cli.2.101.67",

18 "@depot/cli-linux-arm": "0.0.1-cli.2.101.67",

19 "@depot/cli-linux-arm64": "0.0.1-cli.2.101.67",

20 "@depot/cli-linux-ia32": "0.0.1-cli.2.101.67",

21 "@depot/cli-linux-x64": "0.0.1-cli.2.101.67",

22 "@depot/cli-win32-arm64": "0.0.1-cli.2.101.67",

23 "@depot/cli-win32-ia32": "0.0.1-cli.2.101.67",

24 "@depot/cli-win32-x64": "0.0.1-cli.2.101.67"

25 },

26 "publishConfig": {

27 "access": "public"

28 },

29 "scripts": {

30 "postinstall": "node install.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L30

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L30

31 }

32}

install.jsView file

Lines 5-45javascript

5var __getOwnPropNames = Object.getOwnPropertyNames;

6var __getProtoOf = Object.getPrototypeOf;

7var __hasOwnProp = Object.prototype.hasOwnProperty;

8var __copyProps = (to, from, except, desc) => {

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

install.jsView file

25// src/install.ts L26: var child_process = __toESM(require("child_process")); L27: var fs = __toESM(require("fs"));

High

Child Process

Package source references child process execution.

install.jsView on unpkg · L25

25// src/install.ts L26: var child_process = __toESM(require("child_process")); L27: var fs = __toESM(require("fs")); L28: var https = __toESM(require("https")); L29: var os2 = __toESM(require("os")); ... L35: var path = __toESM(require("path")); L36: var DEPOT_BINARY_PATH = process.env.DEPOT_BINARY_PATH || DEPOT_BINARY_PATH; L37: var isValidBinaryPath = (x) => !!x;

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

install.jsView on unpkg · L25

25Cross-file remote execution chain: install.js spawns lib/main.js; helper contains network access plus dynamic code execution. L25: // src/install.ts L26: var child_process = __toESM(require("child_process")); L27: var fs = __toESM(require("fs")); L28: var https = __toESM(require("https")); L29: var os2 = __toESM(require("os")); ... L35: var path = __toESM(require("path")); L36: var DEPOT_BINARY_PATH = process.env.DEPOT_BINARY_PATH || DEPOT_BINARY_PATH; L37: var isValidBinaryPath = (x) => !!x; ... L54: let subpath; L55: let platformKey = `${process.platform} ${os.arch()} ${os.endianness()}`; L56: if (platformKey in knownWindowsPackages) { ... L72: // src/install.ts

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

install.jsView on unpkg · L25

172fs.writeFileSync(path2.join(installDir, "package.json"), "{}"); L173: child_process.execSync( L174: `npm install --loglevel=error --prefer-offline --no-audit --progress=false ${pkg}@${versionFromPackageJSON}`, L175: { cwd: installDir, stdio: "pipe", env }

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

install.jsView on unpkg · L172

25// src/install.ts L26: var child_process = __toESM(require("child_process")); L27: var fs = __toESM(require("fs"));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

install.jsView on unpkg · L25

Findings

5 High5 Medium4 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processinstall.js

HighSame File Env Network Executioninstall.js

HighCross File Remote Execution Contextinstall.js

HighRuntime Package Installinstall.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requireinstall.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

7 flagged

package.jsonView file

Lines 10-32json

10 "bin": {

11 "depot": "bin/depot"

12 },

13 "main": "lib/main.js",

14 "types": "lib/main.d.ts",

15 "optionalDependencies": {

16 "@depot/cli-darwin-arm64": "0.0.1-cli.2.101.67",

17 "@depot/cli-darwin-x64": "0.0.1-cli.2.101.67",

18 "@depot/cli-linux-arm": "0.0.1-cli.2.101.67",

19 "@depot/cli-linux-arm64": "0.0.1-cli.2.101.67",

20 "@depot/cli-linux-ia32": "0.0.1-cli.2.101.67",

21 "@depot/cli-linux-x64": "0.0.1-cli.2.101.67",

22 "@depot/cli-win32-arm64": "0.0.1-cli.2.101.67",

23 "@depot/cli-win32-ia32": "0.0.1-cli.2.101.67",

24 "@depot/cli-win32-x64": "0.0.1-cli.2.101.67"

25 },

26 "publishConfig": {

27 "access": "public"

28 },

29 "scripts": {

30 "postinstall": "node install.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L30

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L30

31 }

32}

install.jsView file

Lines 5-45javascript

5var __getOwnPropNames = Object.getOwnPropertyNames;

6var __getProtoOf = Object.getPrototypeOf;

7var __hasOwnProp = Object.prototype.hasOwnProperty;

8var __copyProps = (to, from, except, desc) => {

Lines 152-192javascript

152 let offset = 0;

153 subpath = `package/${subpath}`;

154 while (offset < buffer.length) {

155 let name = str(offset, 100);

156 let size = parseInt(str(offset + 124, 12), 8);

157 offset += 512;

158 if (!isNaN(size)) {

159 if (name === subpath)

160 return buffer.subarray(offset, offset + size);

161 offset += size + 511 & ~511;

162 }

163 }

164 throw new Error(`Could not find ${JSON.stringify(subpath)} in archive`);

165}

166function installUsingNPM(pkg, subpath, binPath) {

167 const env = { ...process.env, npm_config_global: void 0 };

168 const libDir = path2.dirname(require.resolve("@depot/cli"));

169 const installDir = path2.join(libDir, "npm-install");

170 fs.mkdirSync(installDir);

171 try {

172 fs.writeFileSync(path2.join(installDir, "package.json"), "{}");

173 child_process.execSync(

174 `npm install --loglevel=error --prefer-offline --no-audit --progress=false ${pkg}@${versionFromPackageJSON}`,

175 { cwd: installDir, stdio: "pipe", env }

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

install.jsView on unpkg · L172

176 );

177 const installedBinPath = path2.join(installDir, "node_modules", pkg, subpath);

178 fs.renameSync(installedBinPath, binPath);

179 } finally {

180 try {

181 removeRecursive(installDir);

182 } catch {

183 }

184 }

185}

186function removeRecursive(dir) {

187 for (const entry of fs.readdirSync(dir)) {

188 const entryPath = path2.join(dir, entry);

189 let stats;

190 try {

191 stats = fs.lstatSync(entryPath);

192 } catch {