Static Scan Results
scanned 9d ago · by rust-scannerStatic analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
One or more suspicious static signals were detected.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
4 flagged · loading sourcebin/dosu.jsView file
735import { EventEmitter } from "node:events";
L736: import childProcess from "node:child_process";
L737: import path from "node:path";
High
1227}
L1228: const execArgv = process2.execArgv ?? [];
L1229: if (execArgv.includes("-e") || execArgv.includes("--eval") || execArgv.includes("-p") || execArgv.includes("--print")) {
High
735import { EventEmitter } from "node:events";
L736: import childProcess from "node:child_process";
L737: import path from "node:path";
...
L2123: try {
L2124: const data = readFileSync(path2, "utf-8");
L2125: return JSON.parse(data);
...
L2164: }
L2165: function getSupabaseURL() {
L2166: return process.env.SUPABASE_URL_OVERRIDE ?? "https://wldmetsoicvieidlsqrb.supabase.co" ?? "";
...
L16574: } catch {
L16575: throw new Error(`unknown tool '${toolId}'. Use 'dosu mcp list' to see available tools`);
L16576: }
High
Remote Agent Bridge
Source exposes local file and command tools to a remote model endpoint.
bin/dosu.jsView on unpkg · L73535CommanderError = class CommanderError extends Error {
L36: constructor(exitCode, code, message) {
L37: super(message);
...
L735: import { EventEmitter } from "node:events";
L736: import childProcess from "node:child_process";
L737: import path from "node:path";
...
L818: this._outputConfiguration = {
L819: writeOut: (str) => process2.stdout.write(str),
L820: writeErr: (str) => process2.stderr.write(str),
...
L2103: function getConfigDir() {
L2104: const dirName = process.env.DOSU_DEV === "true" ? "dosu-cli-dev" : "dosu-cli";
L2105: const xdgConfig = process.env.XDG_CONFIG_HOME;
Low
Findings
3 High3 Medium5 Low
HighChild Processbin/dosu.js
HighShellbin/dosu.js
HighRemote Agent Bridgebin/dosu.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowWeak Cryptobin/dosu.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings