registry / @fathnakbar/devops-cli / 1.0.1

@fathnakbar/devops-cli@1.0.1

⚠ Under review

DevOps multi-server deployment, Portainer stack orchestration, and environment management CLI

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 322 KB of source, external domains: api.example.com, api.staging.example.com, portainer.example.com

Source & flagged code

3 flagged

dist/index.jsView file

Lines 2400-2440javascript

2400 test: /^/,

2401 resolve(str, onError) {

2402 onError(`Unresolved plain scalar ${JSON.stringify(str)}`);

2403 return str;

2404 }

2405 };

2406 var schema = [map.map, seq.seq].concat(jsonScalars, jsonError);

2407 exports.schema = schema;

2408});

2409

2410// node_modules/yaml/dist/schema/yaml-1.1/binary.js

2411var require_binary = __commonJS((exports) => {

2412 var node_buffer = __require("buffer");

2413 var Scalar = require_Scalar();

2414 var stringifyString = require_stringifyString();

2415 var binary = {

2416 identify: (value) => value instanceof Uint8Array,

2417 default: false,

2418 tag: "tag:yaml.org,2002:binary",

2419 resolve(src, onError) {

2420 if (typeof node_buffer.Buffer === "function") {

2421 return node_buffer.Buffer.from(src, "base64");

2422 } else if (typeof atob === "function") {

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/index.jsView on unpkg · L2420

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg · L2420

High

Trigger Reachable Credential Exfiltration

A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.

dist/index.jsView on unpkg · L2420

2423 const str = atob(src.replace(/[\n\r]/g, ""));

2424 const buffer = new Uint8Array(str.length);

2425 for (let i = 0;i < str.length; ++i)

2426 buffer[i] = str.charCodeAt(i);

2427 return buffer;

2428 } else {

2429 onError("This environment does not support reading binary tags; either Buffer or atob is required");

2430 return src;

2431 }

2432 },

2433 stringify({ comment, type, value }, ctx, onComment, onChompKeep) {

2434 if (!value)

2435 return "";

2436 const buf = value;

2437 let str;

2438 if (typeof node_buffer.Buffer === "function") {

2439 str = buf instanceof node_buffer.Buffer ? buf.toString("base64") : node_buffer.Buffer.from(buf.buffer).toString("base64");

2440 } else if (typeof btoa === "function") {

Source & flagged code

3 flagged · loading source

dist/index.jsView file

2420if (typeof node_buffer.Buffer === "function") { L2421: return node_buffer.Buffer.from(src, "base64"); L2422: } else if (typeof atob === "function") { ... L4882: yield* this.next(token); L4883: yield* this.end(forceDoc, endOffset); L4884: } L4885: *next(token) { L4886: if (node_process.env.LOG_STREAM) L4887: console.dir(token, { depth: null }); ... L7004: ]; L7005: function findComposeFile(customPath, cwd = process.cwd()) { L7006: if (customPath) {

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code