registry / @fiber-dev-kit/cli / 0.1.1-rc.0

@fiber-dev-kit/cli@0.1.1-rc.0

Fiber Dev Kit CLI for running Fiber nodes quickly from npm

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 61.7 KB of source, external domains: testnet.ckbapp.dev

Source & flagged code

5 flagged

dist/fiber.jsView file

Lines 1-57javascript

1#!/usr/bin/env node

2"use strict";

3Object.defineProperty(exports, "__esModule", { value: true });

4const crypto = require("crypto");

5const fs =

Source & flagged code

5 flagged · loading source

dist/fiber.jsView file

10const path = require("path"); L11: const { spawn, spawnSync } = require("child_process"); L12: const pkgRoot = path.resolve(__dirname, "..");

High

Child Process

Package source references child process execution.

dist/fiber.jsView on unpkg · L10

5const fs = require("fs"); L6: const http = require("http"); L7: const https = require("https"); ... L10: const path = require("path"); L11: const { spawn, spawnSync } = require("child_process"); L12: const pkgRoot = path.resolve(__dirname, ".."); ... L17: const defaultConfigTemplate = "testnet.yml"; L18: const runtimeDir = path.resolve(process.env.FIBER_HOME || path.join(os.homedir(), ".fiber-node")); L19: const rpcUrlFile = path.join(runtimeDir, "rpc-url");

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/fiber.jsView on unpkg · L5

5const fs = require("fs"); L6: const http = require("http"); L7: const https = require("https"); ... L10: const path = require("path"); L11: const { spawn, spawnSync } = require("child_process"); L12: const pkgRoot = path.resolve(__dirname, ".."); L13: const defaultRpcHost = "127.0.0.1"; ... L17: const defaultConfigTemplate = "testnet.yml"; L18: const runtimeDir = path.resolve(process.env.FIBER_HOME || path.join(os.homedir(), ".fiber-node")); L19: const rpcUrlFile = path.join(runtimeDir, "rpc-url"); ... L21: const devkitStatePath = path.join(devkitDir, "state.json"); L22: const platformKey = `${process.platform}-${process.arch}`;

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/fiber.jsView on unpkg · L5

37package = @fiber-dev-kit/cli; repositoryIdentity = fiber-dev-kit; dependency = chalk L37: try { L38: const mod = await import("chalk"); L39: chalk = mod.default || chalk;

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/fiber.jsView on unpkg · L37

vendor/linux-x64/fnn-cliView file

•path = vendor/linux-x64/fnn-cli kind = native_binary sizeBytes = 14822376 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

vendor/linux-x64/fnn-cliView on unpkg

Findings

4 High4 Medium3 Low

HighChild Processdist/fiber.js

HighSame File Env Network Executiondist/fiber.js

HighSandbox Evasion Gated Capabilitydist/fiber.js

HighCopied Package Dependency Bridgedist/fiber.js

MediumNetwork

MediumEnvironment Vars

MediumShips Native Binaryvendor/linux-x64/fnn-cli

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowUrl Strings