registry / @dexto/tui / 1.9.1

@dexto/tui@1.9.1

Interactive terminal UI for Dexto CLI

Static Scan Results

scanned 8d ago · by rust-scanner

Static analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 398 file(s), 2.29 MB of source, external domains: docs.dexto.ai, example.com, github.com, openrouter.ai

Source & flagged code

2 flagged

dist/interactive-commands/documentation-commands.cjsView file

Lines 22-62javascript

22 // file that has been converted to a CommonJS file using a Babel-

23 // compatible transform (i.e. "__esModule" has not been set), then set

24 // "default" to the CommonJS "module.exports" for node compatibility.

25 isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,

26 mod

27));

28var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);

29var documentation_commands_exports = {};

30__export(documentation_commands_exports, {

31 documentationCommands: () => documentationCommands

32});

33module.exports = __toCommonJS(documentation_commands_exports);

34var import_command_output = require("./utils/command-output.js");

35const documentationCommands = [

36 {

37 name: "docs",

38 description: "Open Dexto documentation in browser",

39 usage: "/docs",

40 category: "Documentation",

41 aliases: ["doc"],

42 handler: async (_args, _agent, _ctx) => {

43 const docsUrl = "https://docs.dexto.ai/docs/category/getting-started";

44 try {

45 const { spawn } = await import("child_process");

46 const command = process.platform === "darwin" ? "open" : process.platform === "win32" ? "start" : "xdg-open";

47 spawn(command, [docsUrl], { detached: true, stdio: "ignore" });

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/interactive-commands/documentation-commands.cjsView on unpkg · L42

48 return true;

49 } catch {

50 return import_command_output.CommandOutputHelper.error(

51 new Error(`Could not open browser. Visit: ${docsUrl}`),

52 "Failed to open documentation"

53 );

54 }

55 }

56 }

57];

58// Annotate the CommonJS export names for ESM import in node:

590 && (module.exports = {

60 documentationCommands

61});

dist/assets/sounds/powerup.wavView file

•path = dist/assets/sounds/powerup.wav kind = high_entropy_blob sizeBytes = 24740 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/assets/sounds/powerup.wavView on unpkg

Source & flagged code

2 flagged · loading source

dist/interactive-commands/documentation-commands.cjsView file

42handler: async (_args, _agent, _ctx) => { L43: const docsUrl = "https://docs.dexto.ai/docs/category/getting-started"; L44: try { L45: const { spawn } = await import("child_process"); L46: const command = process.platform === "darwin" ? "open" : process.platform === "win32" ? "start" : "xdg-open"; L47: spawn(command, [docsUrl], { detached: true, stdio: "ignore" });

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/interactive-commands/documentation-commands.cjsView on unpkg · L42

dist/assets/sounds/powerup.wavView file

•path = dist/assets/sounds/powerup.wav kind = high_entropy_blob sizeBytes = 24740 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/assets/sounds/powerup.wavView on unpkg

Findings

2 High2 Medium5 Low

HighSandbox Evasion Gated Capabilitydist/interactive-commands/documentation-commands.cjs

HighShips High Entropy Blobdist/assets/sounds/powerup.wav

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

dist/interactive-commands/documentation-commands.cjsView file

Lines 22-62javascript

22 // file that has been converted to a CommonJS file using a Babel-

23 // compatible transform (i.e. "__esModule" has not been set), then set

24 // "default" to the CommonJS "module.exports" for node compatibility.

25 isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,

26 mod

27));

28var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);

29var documentation_commands_exports = {};

30__export(documentation_commands_exports, {

31 documentationCommands: () => documentationCommands

32});

33module.exports = __toCommonJS(documentation_commands_exports);

34var import_command_output = require("./utils/command-output.js");

35const documentationCommands = [

36 {

37 name: "docs",

38 description: "Open Dexto documentation in browser",

39 usage: "/docs",

40 category: "Documentation",

41 aliases: ["doc"],

42 handler: async (_args, _agent, _ctx) => {

43 const docsUrl = "https://docs.dexto.ai/docs/category/getting-started";

44 try {

45 const { spawn } = await import("child_process");

46 const command = process.platform === "darwin" ? "open" : process.platform === "win32" ? "start" : "xdg-open";

47 spawn(command, [docsUrl], { detached: true, stdio: "ignore" });

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/interactive-commands/documentation-commands.cjsView on unpkg · L42

48 return true;

49 } catch {

50 return import_command_output.CommandOutputHelper.error(

51 new Error(`Could not open browser. Visit: ${docsUrl}`),

52 "Failed to open documentation"

53 );

54 }

55 }

56 }

57];

58// Annotate the CommonJS export names for ESM import in node:

590 && (module.exports = {

60 documentationCommands

61});

dist/assets/sounds/powerup.wavView file

•path = dist/assets/sounds/powerup.wav kind = high_entropy_blob sizeBytes = 24740 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/assets/sounds/powerup.wavView on unpkg