registry / @enrichlayer/el-linear / 1.33.0

@enrichlayer/el-linear@1.33.0

A pragmatic CLI for Linear.app — deterministic team/label/member resolution, structured issue validation, configurable term enforcement, and a GraphQL escape hatch.

Static Scan Results

scanned 14d ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 127 file(s), 783 KB of source, external domains: api.linear.app, en.wikipedia.org, example.com, github.com, linear.app

Source & flagged code

3 flagged

dist/utils/output.jsView file

Lines 1-21javascript

1import { execFileSync } from "node:child_process";

2import { dispatch as dispatchSummary, drainSummaryFieldWarnings, formatLine, inferKindFromPayload, } from "./formatters/summary.js";

High

Child Process

Package source references child process execution.

dist/utils/output.jsView on unpkg · L1

3import { logger } from "./logger.js";

4import { sanitizeForLog } from "./sanitize-for-log.js";

5const warningBuffer = [];

6let rawMode = false;

7let quietMode = false;

8let jqFilter = null;

9let fieldsFilter = null;

10let outputFormat = "json";

11export function setRawMode(enabled) {

12 rawMode = enabled;

13}

14/**

15 * `--quiet` (write commands only): collapse the success payload to a single

16 * confirmation line via `formatLine`, bypassing both the JSON envelope and

17 * the summary block. Set in main.ts's preAction when the flag is present.

18 */

19export function setQuietMode(enabled) {

20 quietMode = enabled;

21}

dist/commands/init/oauth.jsView file

Lines 1-39javascript

1/**

2 * Wizard step for OAuth 2.0 (PKCE flow) authorization.

3 *

4 * Flow:

5 * 1. Read optional local/team OAuth app defaults, if present.

6 * 2. Otherwise present a "what is this?" intro pointing the user at

7 * Linear's OAuth app registration page, then prompt for `client_id`,

8 * optional `client_secret`, port, scopes.

9 * 3. Generate PKCE verifier + state, build the authorize URL.

10 * 4. Try to open the system browser; fall back to printing the URL.

11 * 5. Spin a localhost listener (or fall back to pasted-code prompt) to

dist/commands/gdoc.jsView file

Lines 1-21javascript

1import { execFileSync } from "node:child_process";

2import { extractDocId, parseGoogleDoc } from "../utils/gdoc-parser.js";

3import { handleAsyncCommand } from "../utils/output.js";

4export function setupGdocCommands(program) {

5 program

6 .command

Source & flagged code

3 flagged · loading source

dist/utils/output.jsView file

1import { execFileSync } from "node:child_process"; L2: import { dispatch as dispatchSummary, drainSummaryFieldWarnings, formatLine, inferKindFromPayload, } from "./formatters/summary.js";

High

Child Process

Package source references child process execution.

dist/utils/output.jsView on unpkg · L1

dist/commands/init/oauth.jsView file

19*/ L20: import { spawn } from "node:child_process"; L21: import { checkbox, input, password, select } from "@inquirer/prompts"; ... L30: const DEFAULT_PORT = 8765; L31: const REGISTRATION_URL = "https://linear.[redacted]"; L32: const VIEWER_QUERY = /* GraphQL */ ` ... L63: let args; L64: if (process.platform === "darwin") { L65: cmd = "open";

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/commands/init/oauth.jsView on unpkg · L19

dist/commands/gdoc.jsView file

1import { execFileSync } from "node:child_process"; L2: import { extractDocId, parseGoogleDoc } from "../utils/gdoc-parser.js"; ... L7: .description("Convert a Google Doc to Markdown (requires gws CLI).") L8: .addHelpText("after", "\nAccepts a Google Doc ID or full URL.\nRequires gws CLI: npm install -g @googleworkspace/cli") L9: .action(handleAsyncCommand(async (docIdOrUrl) => {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/commands/gdoc.jsView on unpkg · L1

Findings

4 High3 Medium4 Low

HighChild Processdist/utils/output.js

HighShell

HighSandbox Evasion Gated Capabilitydist/commands/init/oauth.js

HighRuntime Package Installdist/commands/gdoc.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

dist/utils/output.jsView file

Lines 1-21javascript

1import { execFileSync } from "node:child_process";

2import { dispatch as dispatchSummary, drainSummaryFieldWarnings, formatLine, inferKindFromPayload, } from "./formatters/summary.js";

High

Child Process

Package source references child process execution.

dist/utils/output.jsView on unpkg · L1

3import { logger } from "./logger.js";

4import { sanitizeForLog } from "./sanitize-for-log.js";

5const warningBuffer = [];

6let rawMode = false;

7let quietMode = false;

8let jqFilter = null;

9let fieldsFilter = null;

10let outputFormat = "json";

11export function setRawMode(enabled) {

12 rawMode = enabled;

13}

14/**

15 * `--quiet` (write commands only): collapse the success payload to a single

16 * confirmation line via `formatLine`, bypassing both the JSON envelope and

17 * the summary block. Set in main.ts's preAction when the flag is present.

18 */

19export function setQuietMode(enabled) {

20 quietMode = enabled;

21}

dist/commands/init/oauth.jsView file

Lines 1-39javascript

1/**

2 * Wizard step for OAuth 2.0 (PKCE flow) authorization.

3 *

4 * Flow:

5 * 1. Read optional local/team OAuth app defaults, if present.

6 * 2. Otherwise present a "what is this?" intro pointing the user at

7 * Linear's OAuth app registration page, then prompt for `client_id`,

8 * optional `client_secret`, port, scopes.

9 * 3. Generate PKCE verifier + state, build the authorize URL.

10 * 4. Try to open the system browser; fall back to printing the URL.

11 * 5. Spin a localhost listener (or fall back to pasted-code prompt) to

dist/commands/gdoc.jsView file

Lines 1-21javascript

1import { execFileSync } from "node:child_process";

2import { extractDocId, parseGoogleDoc } from "../utils/gdoc-parser.js";

3import { handleAsyncCommand } from "../utils/output.js";

4export function setupGdocCommands(program) {

5 program

6 .command