registry / @docana/cli / 0.1.1

@docana/cli@0.1.1

Docana CLI — manage agents, evals, documents, and conversations from your terminal

Static Scan Results

scanned 16h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

CryptoEnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 12 file(s), 187 KB of source, external domains: anima-tst.virtual360.io, platform.docana.com

Source & flagged code

3 flagged

dist/index.jsView file

Lines 30-70javascript

30 if (topic === "ai") {

31 console.log(AI_AGENT_HELP_MARKDOWN);

32 return;

33 }

34 if (!topic) {

35 program.outputHelp();

36 return;

37 }

38 const matchingCommand = program.commands.find((commandItem) => commandItem.name() === topic || commandItem.aliases().includes(topic));

39 if (!matchingCommand) {

40 p.log.error(`Unknown help topic: ${topic}`);

41 process.exit(1);

42 }

43 matchingCommand.outputHelp();

44});

45program

46 .command("login")

47 .description("Configure CLI with API URL and Key")

48 .action(async () => {

49 p.intro(pc.bgBlue(pc.white(" Docana Agent CLI Setup ")));

50 const config = getConfig();

51 const apiUrl = await p.text({

52 message: "Docana API URL",

53 initialValue: config.apiUrl,

54 placeholder: "http://localhost:3000",

55 });

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

dist/index.jsView on unpkg · L50

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/index.jsView on unpkg · L50

56 if (p.isCancel(apiUrl)) {

57 p.cancel("Setup cancelled.");

58 process.exit(0);

59 }

60 const apiKey = await p.password({

61 message: "Docana API Key (Personal Access Token)",

62 });

63 if (p.isCancel(apiKey)) {

64 p.cancel("Setup cancelled.");

65 process.exit(0);

66 }

67 const applicationIdStr = await p.text({

68 message: "Default Application ID (optional)",

69 initialValue: config.applicationId?.toString() || "",

70 });

Lines 1787-1827javascript

1787 : config.applicationId;

1788 if (!appId) {

1789 p.log.error("Application ID is required. Pass -a <id> or run `docana login` to set a default.");

1790 process.exit(1);

1791 }

1792 const { spec, id }

Source & flagged code

3 flagged · loading source

dist/index.jsView file

50const config = getConfig(); L51: const apiUrl = await p.text({ L52: message: "Docana API URL", L53: initialValue: config.apiUrl, L54: placeholder: "http://localhost:3000", L55: }); ... L139: .action(async (options) => { L140: const currentWorkingDirectory = process.cwd(); L141: const existingManifestPath = findManifestPath(currentWorkingDirectory); ... L281: enabled: payload.routine.enabled, L282: metadata: payload.routine.metadata, L283: triggers: payload.routine.triggers,

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code