registry / @f5-sales-demo/xcsh / 19.54.0

@f5-sales-demo/xcsh@19.54.0

Coding agent CLI with read, bash, edit, write tools and session management

Static Scan Results

scanned 2d ago · by rust-scanner

Static analysis flagged 19 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 770 file(s), 8.30 MB of source, external domains: 127.0.0.1, addons.mozilla.org, api.anthropic.com, api.coingecko.com, api.crossref.org, api.discogs.com, api.exa.ai, api.github.com, api.kimi.com, api.npmjs.org, api.nuget.org, api.openai.com, api.opencorporates.com, api.osv.dev, api.parallel.ai, api.perplexity.ai, api.rawg.io, api.search.brave.com, api.semanticscholar.org, api.smithery.ai, api.snapcraft.io, api.stackexchange.com, api.synthetic.new, api.tavily.com, api.w3.org, api.z.ai, artifacthub.io, arxiv.org, astral.sh, aur.archlinux.org, auth.example.com, auth.kimi.com, cdnjs.cloudflare.com, chatgpt.com, cheat.sh, choosealicense.com, chromewebstore.google.com, cli.github.com, clojars.org, cloudcode-pa.googleapis.com, community.chocolatey.org, covers.openlibrary.org, crates.io, daily-cloudcode-pa.googleapis.com, daily-cloudcode-pa.sandbox.googleapis.com, data.sec.gov, dev.to, docs.rs, doi.org, eprint.iacr.org

Oversized source lightweight scan

src/internal-urls/docs-index.generated.ts8.60 MB file, sampled 256 KB

FilesystemChildProcessMinifiedUrlStrings127.0.0.1api.anthropic.comauth.kimi.comgateway.ai.cloudflare.comgistpreview.github.io

Source & flagged code

10 flagged

src/internal-urls/terraform-index.generated.tsView file

Lines 601-641typescript

601 requires: [],

602 },

603 import_syntax: "terraform import xcsh_certificate_chain.example namespace/name",

604 },

605 cloud_connect: {

606 category: "networking",

607 description: "Establishing connectivity to cloud provider networks",

608 required: ["name", "namespace"],

609 minimal_config:

610 'resource "xcsh_cloud_connect" "example" {\n name = "example-cloud-connect"\n namespace = "staging"\n\n labels = {\n environment = "production"\n managed_by = "terraform"\n }\n\n annotations = {\n "owner" = "platform-team"\n }\n\n aws_provider {\n }\n aws_tgw_site {\n }\n cred {\n }\n}',

611 dependencies: {

612 requires: [],

613 },

614 import_syntax: "terraform import xcsh_cloud_connect.example namespace/name",

615 },

616 cloud_credentials: {

617 category: "authentication",

618 description: "Api to create cloud_credentials object. configuration",

619 required: ["name", "namespace"],

620 minimal_config:

621 'resource "xcsh_cloud_credentials" "example" {\n name = "example-cloud-credentials"\n namespace = "staging"\n\n labels = {\n environment = "production"\n managed_by = "terraform"\n }\n\n annotations = {\n "owner" = "platform-team"\n }\n\n aws_secret_key {\n access_key = "AKIAIOSFODNN7EXAMPLE"\n secret_key {\n clear_secret_info {\n url = "string:///d0phbmVzc2VjcmV0a2V5"\n }\n }\n }\n}',

Critical

Critical Secret

Package contains a critical-looking secret pattern.

src/internal-urls/terraform-index.generated.ts

622 dependencies: {

623 requires: [],

624 },

625 import_syntax: "terraform import xcsh_cloud_credentials.example namespace/name",

626 },

627 cloud_elastic_ip: {

628 category: "cloud-resources",

629 description: "Cloud Elastic IP creates Cloud Elastic IP object Object is attached to a site",

630 required: ["name", "namespace", "item_count"],

631 minimal_config:

632 'resource "xcsh_cloud_elastic_ip" "example" {\n name = "example-cloud-elastic-ip"\n namespace = "staging"\n\n labels = {\n environment = "production"\n managed_by = "terraform"\n }\n\n annotations = {\n "owner" = "platform-team"\n }\n\n site_ref {\n }\n}',

633 dependencies: {

634 requires: [],

635 },

636 import_syntax: "terraform import xcsh_cloud_elastic_ip.example namespace/name",

637 },

638 cloud_link: {

639 category: "networking",

640 description: "New CloudLink with configured parameters",

641 required: ["name", "namespace"],

src/tools/browser.tsView file

Lines 1164-1204typescript

1164 const endX = toBox.x + toBox.width / 2;

1165 const endY = toBox.y + toBox.height / 2;

1166 await untilAborted(signal, () => page.mouse.move(startX, startY));

src/tools/renderers.tsView file

Lines 45-83typescript

45 inline?: boolean;

46};

48export const toolRenderers: Record<string, ToolRenderer> = {

49 ask: askToolRenderer as ToolRenderer,

50 ast_grep: astGrepToolRenderer as ToolRenderer,

src/utils/shell-snapshot.tsView file

Lines 1-24typescript

1/**

2 * Shell environment snapshot for preserving user aliases, functions, and options.

3 *

4 * Creates a snapshot file that captures the user's shell environment from their

5 * .bashrc/.zshrc, which can be sourced before each command to provide a familiar

6 * shell experience.

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

src/utils/shell-snapshot.tsView on unpkg · L4

7 */

8import * as fs

src/stt/setup.tsView file

Lines 1-23typescript

1import { detectRecordingTools } from "./recorder";

2import { resolvePython } from "./transcriber";

4const isWindows = process.platform === "win32";

6export interface STTDependencyStatus {

src/ipy/prelude.pyView file

•path = src/ipy/prelude.py kind = build_helper sizeBytes = 34987 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

src/ipy/prelude.pyView on unpkg

src/internal-urls/docs-index.generated.tsView file

•path = src/internal-urls/docs-index.generated.ts kind = oversized_source_file sizeBytes = 9015288 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

src/internal-urls/docs-index.generated.tsView on unpkg

src/main.tsView file

•matchType = previous_version_dangerous_delta matchedPackage = @f5-sales-demo/xcsh@19.55.0 matchedIdentity = npm:QGY1LXNhbGVzLWRlbW8veGNzaA:19.55.0 similarity = 0.983 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/main.tsView on unpkg

src/tools/python.tsView file

Lines 558-598typescript

558 timeout?: number;

559}

560

561/** Format a status event as a single line for display. */

562function formatStatusEvent(event: PythonStatusEvent, theme: Theme, width: number): string {

563

Source & flagged code

10 flagged · loading source

src/internal-urls/terraform-index.generated.tsView file

621patternName = aws_access_key severity = critical line = 621 matchedText = 'resourc...n}',

Critical

Critical Secret

Package contains a critical-looking secret pattern.

src/internal-urls/terraform-index.generated.tsView on unpkg · L621

621patternName = aws_access_key severity = critical line = 621 matchedText = 'resourc...n}',

Critical

Secret Pattern

AWS access key ID in src/internal-urls/terraform-index.generated.ts

src/internal-urls/terraform-index.generated.tsView on unpkg · L621

src/tools/browser.tsView file

1184try { L1185: return await new Function(`return (async () => (${source}))();`)(); L1186: } catch {

Low

Eval

Package source references a known benign dynamic code generation pattern.

src/tools/browser.tsView on unpkg · L1184

src/tools/renderers.tsView file

65// eslint-disable-next-line @typescript-eslint/no-require-imports L66: return require("./read").readToolRenderer as ToolRenderer; L67: },

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/tools/renderers.tsView on unpkg · L65

src/utils/shell-snapshot.tsView file

4* Creates a snapshot file that captures the user's shell environment from their L5: * .bashrc/.zshrc, which can be sourced before each command to provide a familiar L6: * shell experience. ... L26: function getShellConfigFile(shell: string): string { L27: const home = os.homedir(); L28: if (shell.includes("zsh")) return path.join(home, ".zshrc"); ... L52: typeset -f > /dev/null 2>&1 L53: # Get user function names - filter system/private ones L54: typeset +f 2>/dev/null | grep -vE '^(_|__)' | grep -vE '${commonToolsRegex}' | while read func; do ... L61: declare -f > /dev/null 2>&1 L62: # Get user function names - filter system/private ones, use base64 for special chars L63: declare -F 2>/dev/null | cut -d' ' -f3 | grep -vE '^(_|__)' | grep -vE '${commonToolsRegex}' | while read func; do

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

src/utils/shell-snapshot.tsView on unpkg · L4

src/stt/setup.tsView file

3L4: const isWindows = process.platform === "win32"; L5: ... L14: const recorderHint = isWindows L15: ? "PowerShell fallback available. For better quality: install SoX or FFmpeg." L16: : "Install SoX: sudo apt install sox, or FFmpeg: sudo apt install ffmpeg"; ... L18: const pythonCmd = resolvePython(); L19: const pythonHint = "Install Python 3.8+ from https://python.org"; L20: ... L23: const check = Bun.spawnSync([pythonCmd, "-c", "import whisper"], { L24: stdout: "pipe", L25: stderr: "pipe",

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

src/stt/setup.tsView on unpkg · L3

src/ipy/prelude.pyView file

•path = src/ipy/prelude.py kind = build_helper sizeBytes = 34987 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

src/ipy/prelude.pyView on unpkg

src/internal-urls/docs-index.generated.tsView file

•path = src/internal-urls/docs-index.generated.ts kind = oversized_source_file sizeBytes = 9015288 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

src/internal-urls/docs-index.generated.tsView on unpkg

src/main.tsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/main.tsView on unpkg

src/tools/python.tsView file

578patternName = generic_password severity = medium line = 578 matchedText = pwd: "...

Medium

Secret Pattern

Hardcoded password in src/tools/python.ts

src/tools/python.tsView on unpkg · L578

Findings

2 Critical3 High7 Medium7 Low

CriticalCritical Secretsrc/internal-urls/terraform-index.generated.ts

CriticalSecret Patternsrc/internal-urls/terraform-index.generated.ts

HighSandbox Evasion Gated Capabilitysrc/stt/setup.ts

HighOversized Source Filesrc/internal-urls/docs-index.generated.ts

HighPrevious Version Dangerous Deltasrc/main.ts

MediumDynamic Requiresrc/tools/renderers.ts

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencesrc/utils/shell-snapshot.ts

MediumShips Build Helpersrc/ipy/prelude.py

MediumStructural Risk Force Deep Review

MediumSecret Patternsrc/tools/python.ts

LowScripts Present

LowEvalsrc/tools/browser.ts

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

Source & flagged code

10 flagged

src/internal-urls/terraform-index.generated.tsView file

Lines 601-641typescript

601 requires: [],

602 },

603 import_syntax: "terraform import xcsh_certificate_chain.example namespace/name",

604 },

605 cloud_connect: {

606 category: "networking",

607 description: "Establishing connectivity to cloud provider networks",

608 required: ["name", "namespace"],

609 minimal_config:

611 dependencies: {

612 requires: [],

613 },

614 import_syntax: "terraform import xcsh_cloud_connect.example namespace/name",

615 },

616 cloud_credentials: {

617 category: "authentication",

618 description: "Api to create cloud_credentials object. configuration",

619 required: ["name", "namespace"],

620 minimal_config:

Critical

Critical Secret

Package contains a critical-looking secret pattern.

src/internal-urls/terraform-index.generated.ts

622 dependencies: {

623 requires: [],

624 },

625 import_syntax: "terraform import xcsh_cloud_credentials.example namespace/name",

626 },

627 cloud_elastic_ip: {

628 category: "cloud-resources",

629 description: "Cloud Elastic IP creates Cloud Elastic IP object Object is attached to a site",

630 required: ["name", "namespace", "item_count"],

631 minimal_config:

633 dependencies: {

634 requires: [],

635 },

636 import_syntax: "terraform import xcsh_cloud_elastic_ip.example namespace/name",

637 },

638 cloud_link: {

639 category: "networking",

640 description: "New CloudLink with configured parameters",

641 required: ["name", "namespace"],

src/tools/browser.tsView file

Lines 1164-1204typescript

1164 const endX = toBox.x + toBox.width / 2;

1165 const endY = toBox.y + toBox.height / 2;

1166 await untilAborted(signal, () => page.mouse.move(startX, startY));

src/tools/renderers.tsView file

Lines 45-83typescript

45 inline?: boolean;

46};

48export const toolRenderers: Record<string, ToolRenderer> = {

49 ask: askToolRenderer as ToolRenderer,

50 ast_grep: astGrepToolRenderer as ToolRenderer,

src/utils/shell-snapshot.tsView file

Lines 1-24typescript

1/**

2 * Shell environment snapshot for preserving user aliases, functions, and options.

3 *

4 * Creates a snapshot file that captures the user's shell environment from their

5 * .bashrc/.zshrc, which can be sourced before each command to provide a familiar

6 * shell experience.

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

src/utils/shell-snapshot.tsView on unpkg · L4

7 */

8import * as fs

src/stt/setup.tsView file

Lines 1-23typescript

1import { detectRecordingTools } from "./recorder";

2import { resolvePython } from "./transcriber";

4const isWindows = process.platform === "win32";

6export interface STTDependencyStatus {

src/ipy/prelude.pyView file

•path = src/ipy/prelude.py kind = build_helper sizeBytes = 34987 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

src/ipy/prelude.pyView on unpkg

src/internal-urls/docs-index.generated.tsView file

•path = src/internal-urls/docs-index.generated.ts kind = oversized_source_file sizeBytes = 9015288 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

src/internal-urls/docs-index.generated.tsView on unpkg

src/main.tsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/main.tsView on unpkg

src/tools/python.tsView file

Lines 558-598typescript

558 timeout?: number;

559}

560

561/** Format a status event as a single line for display. */

562function formatStatusEvent(event: PythonStatusEvent, theme: Theme, width: number): string {

563