registry / @docana/cli / 0.6.0

@docana/cli@0.6.0

Docana CLI — manage agents, evals, documents, and conversations from your terminal

Static Scan Results

scanned 17h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

CryptoEnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 17 file(s), 228 KB of source, external domains: 127.0.0.1, anima-tst.virtual360.io, example.com, platform.docana.com

Source & flagged code

3 flagged

dist/index.jsView file

Lines 112-152javascript

112 p.cancel("Setup cancelled.");

113 process.exit(0);

114 }

115 authConfig = {

116 authMethod: "apiKey",

117 apiKey: apiKey,

118 // Drop any previous browser session; the key is the credential now.

119 accessToken: undefined,

120 refreshToken: undefined,

121 accessTokenExpiresAt: undefined,

122 };

123 }

124 saveConfig(authConfig);

125 p.outro(pc.green("Configuration saved successfully!"));

126});

127program

128 .command("whoami")

129 .description("Show current authentication status and configuration")

130 .action(async () => {

131 p.intro(pc.blue(" Current Configuration "));

132 const config = getConfig();

133 const authDescription = process.env.DOCANA_API_KEY

134 ? pc.green("API key (from DOCANA_API_KEY env)")

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

dist/index.jsView on unpkg · L132

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/index.jsView on unpkg · L132

135 : usesOAuth(config)

136 ? pc.green("Browser login (OAuth)")

137 : config.apiKey

138 ? pc.green("API key")

139 : pc.red("Not logged in");

140 p.note(`API URL: ${config.apiUrl || pc.dim("Not set")}\n` +

141 `Auth: ${authDescription}\n` +

142 `App ID: ${config.applicationId || pc.dim("Not set")}`, "Local Config");

143 const hasCredentials = usesOAuth(config) || Boolean(config.apiKey);

144 if (!hasCredentials || !config.apiUrl) {

145 p.log.warn("Missing API URL or credentials. Run `docana login` to configure.");

146 process.exit(1);

147 }

148 const s = p.spinner();

149 s.start("Verifying authentication with server...");

150 try {

151 const result = await api.whoami();

152 if (result.authorized) {

Lines 1866-1906javascript

1866 : config.applicationId;

1867 if (!appId) {

1868 p.log.error("Application ID is required. Pass -a <id> or run `docana login` to set a default.");

1869 process.exit(1);

1870 }

1871 const { spec, id }

Source & flagged code

3 flagged · loading source

dist/index.jsView file

132const config = getConfig(); L133: const authDescription = process.env.DOCANA_API_KEY L134: ? pc.green("API key (from DOCANA_API_KEY env)") ... L190: .action(async (options) => { L191: const currentWorkingDirectory = process.cwd(); L192: const existingManifestPath = findManifestPath(currentWorkingDirectory); ... L332: enabled: payload.routine.enabled, L333: metadata: payload.routine.metadata, L334: triggers: payload.routine.triggers, ... L650: for (let i = 0; i < normalized.length; i++) { L651: const char = normalized.charCodeAt(i); L652: hash = (hash << 5) - hash + char;

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code