registry / @fiber-dev-kit/cli / 0.1.1-rc.0

@fiber-dev-kit/cli@0.1.1-rc.0

Fiber Dev Kit CLI for running Fiber nodes quickly from npm

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 61.7 KB of source, external domains: testnet.ckbapp.dev

Source & flagged code

5 flagged

dist/fiber.jsView file

Lines 1-57javascript

1#!/usr/bin/env node

2"use strict";

3Object.defineProperty(exports, "__esModule", { value: true });

4const crypto = require("crypto");

5const fs = require("fs");

6const http = require("http");

7const https = require("https");

8const net = require("net");

9const os = require("os");

10const path = require("path");

11const { spawn, spawnSync } = require("child_process");

12const pkgRoot = path.resolve(__dirname, "..");

High

Child Process

Package source references child process execution.

dist/fiber.jsView on unpkg · L10

13const defaultRpcHost = "127.0.0.1";

14const defaultRpcPort = 8227;

15const defaultRpcUrl = `http://${defaultRpcHost}:${defaultRpcPort}`;

16const defaultPassword = "password";

17const defaultConfigTemplate = "testnet.yml";

18const runtimeDir = path.resolve(process.env.FIBER_HOME || path.join(os.homedir(), ".fiber-node"));

19const rpcUrlFile = path.join(runtimeDir, "rpc-url");

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/fiber.jsView on unpkg · L5

20const devkitDir = path.resolve(process.env.FIBER_DEV_KIT_HOME || path.join(os.homedir(), ".fiber-dev-kit"));

21const devkitStatePath = path.join(devkitDir, "state.json");

22const platformKey = `${process.platform}-${process.arch}`;

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/fiber.jsView on unpkg · L5

23const ckbShannons = 100000000n;

24const defaultCkbRpcUrl = "https://testnet.ckbapp.dev/";

25const nodeAliases = ["a", "b", "c", "d", "e"];

26let chalk = plainChalk();

27function plainChalk() {

28 const passthrough = (...values) => values.join(" ");

29 let proxy;

30 proxy = new Proxy(passthrough, {

31 get: () => proxy,

32 apply: (_, __, values) => values.join(" ")

33 });

34 return proxy;

35}

36async function loadChalk() {

37 try {

38 const mod = await import("chalk");

39 chalk = mod.default || chalk;

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/fiber.jsView on unpkg · L37

40 }

41 catch (_) {

42 chalk = plainChalk();

43 }

44}

45function title(value) {

46 return chalk.bold(value);

47}

48function dim(value) {

49 return chalk.dim(value);

50}

51function label(value) {

52 return chalk.dim(value);

53}

54function valueText(value) {

55 return chalk.cyan(value);

56}

57function commandText(value) {

vendor/linux-x64/fnn-cliView file

•path = vendor/linux-x64/fnn-cli kind = native_binary sizeBytes = 14822376 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

vendor/linux-x64/fnn-cliView on unpkg

Source & flagged code

5 flagged · loading source

dist/fiber.jsView file

10const path = require("path"); L11: const { spawn, spawnSync } = require("child_process"); L12: const pkgRoot = path.resolve(__dirname, "..");

High

Child Process

Package source references child process execution.

dist/fiber.jsView on unpkg · L10

5const fs = require("fs"); L6: const http = require("http"); L7: const https = require("https"); ... L10: const path = require("path"); L11: const { spawn, spawnSync } = require("child_process"); L12: const pkgRoot = path.resolve(__dirname, ".."); ... L17: const defaultConfigTemplate = "testnet.yml"; L18: const runtimeDir = path.resolve(process.env.FIBER_HOME || path.join(os.homedir(), ".fiber-node")); L19: const rpcUrlFile = path.join(runtimeDir, "rpc-url");

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/fiber.jsView on unpkg · L5

5const fs = require("fs"); L6: const http = require("http"); L7: const https = require("https"); ... L10: const path = require("path"); L11: const { spawn, spawnSync } = require("child_process"); L12: const pkgRoot = path.resolve(__dirname, ".."); L13: const defaultRpcHost = "127.0.0.1"; ... L17: const defaultConfigTemplate = "testnet.yml"; L18: const runtimeDir = path.resolve(process.env.FIBER_HOME || path.join(os.homedir(), ".fiber-node")); L19: const rpcUrlFile = path.join(runtimeDir, "rpc-url"); ... L21: const devkitStatePath = path.join(devkitDir, "state.json"); L22: const platformKey = `${process.platform}-${process.arch}`;

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/fiber.jsView on unpkg · L5

37package = @fiber-dev-kit/cli; repositoryIdentity = fiber-dev-kit; dependency = chalk L37: try { L38: const mod = await import("chalk"); L39: chalk = mod.default || chalk;

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/fiber.jsView on unpkg · L37

vendor/linux-x64/fnn-cliView file

•path = vendor/linux-x64/fnn-cli kind = native_binary sizeBytes = 14822376 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

vendor/linux-x64/fnn-cliView on unpkg

Findings

4 High4 Medium3 Low

HighChild Processdist/fiber.js

HighSame File Env Network Executiondist/fiber.js

HighSandbox Evasion Gated Capabilitydist/fiber.js

HighCopied Package Dependency Bridgedist/fiber.js

MediumNetwork

MediumEnvironment Vars

MediumShips Native Binaryvendor/linux-x64/fnn-cli

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowUrl Strings

Source & flagged code

5 flagged

dist/fiber.jsView file

Lines 1-57javascript

1#!/usr/bin/env node

2"use strict";

3Object.defineProperty(exports, "__esModule", { value: true });

4const crypto = require("crypto");

5const fs = require("fs");

6const http = require("http");

7const https = require("https");

8const net = require("net");

9const os = require("os");

10const path = require("path");

11const { spawn, spawnSync } = require("child_process");

12const pkgRoot = path.resolve(__dirname, "..");

High

Child Process

Package source references child process execution.

dist/fiber.jsView on unpkg · L10

13const defaultRpcHost = "127.0.0.1";

14const defaultRpcPort = 8227;

15const defaultRpcUrl = `http://${defaultRpcHost}:${defaultRpcPort}`;

16const defaultPassword = "password";

17const defaultConfigTemplate = "testnet.yml";

18const runtimeDir = path.resolve(process.env.FIBER_HOME || path.join(os.homedir(), ".fiber-node"));

19const rpcUrlFile = path.join(runtimeDir, "rpc-url");

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/fiber.jsView on unpkg · L5

20const devkitDir = path.resolve(process.env.FIBER_DEV_KIT_HOME || path.join(os.homedir(), ".fiber-dev-kit"));

21const devkitStatePath = path.join(devkitDir, "state.json");

22const platformKey = `${process.platform}-${process.arch}`;

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/fiber.jsView on unpkg · L5

23const ckbShannons = 100000000n;

24const defaultCkbRpcUrl = "https://testnet.ckbapp.dev/";

25const nodeAliases = ["a", "b", "c", "d", "e"];

26let chalk = plainChalk();

27function plainChalk() {

28 const passthrough = (...values) => values.join(" ");

29 let proxy;

30 proxy = new Proxy(passthrough, {

31 get: () => proxy,

32 apply: (_, __, values) => values.join(" ")

33 });

34 return proxy;

35}

36async function loadChalk() {

37 try {

38 const mod = await import("chalk");

39 chalk = mod.default || chalk;

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/fiber.jsView on unpkg · L37

40 }

41 catch (_) {

42 chalk = plainChalk();

43 }

44}

45function title(value) {

46 return chalk.bold(value);

47}

48function dim(value) {

49 return chalk.dim(value);

50}

51function label(value) {

52 return chalk.dim(value);

53}

54function valueText(value) {

55 return chalk.cyan(value);

56}

57function commandText(value) {

vendor/linux-x64/fnn-cliView file

•path = vendor/linux-x64/fnn-cli kind = native_binary sizeBytes = 14822376 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

vendor/linux-x64/fnn-cliView on unpkg