registry / @flydocs/cli / 1.0.6
@flydocs/cli@1.0.6
FlyDocs AI CLI — install, setup, and manage FlyDocs projects
Static Scan Results
scanned 4mo ago · by rust-scannerStatic analysis flagged 16 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
One or more suspicious static signals were detected.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
8 flaggeddist/cli.jsView file
822// src/lib/env-checks.ts
L823: import { execFile } from "child_process";
L824: import { promisify } from "util";
High
6866const { promisify: promisify4 } = await import("util");
L6867: const execAsync = promisify4(execFile4);
L6868: await execAsync("python3", [scriptPath, "pull"], {
High
6953const credContent = await readFile20(
L6954: join28(process.env.HOME ?? "", ".flydocs", "credentials"),
L6955: "utf-8"
...
L6961: }
L6962: const { execFile: execFile4 } = await import("child_process");
L6963: const { promisify: promisify4 } = await import("util");
...
L6965: for (const [name, entry] of Object.entries(ws.repos ?? {})) {
L6966: const repoDir = entry.path ? resolve4(parentDir, entry.path) : join28(parentDir, name);
L6967: const configPath = join28(repoDir, ".flydocs", "config.json");
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
Findings
7 High4 Medium5 Low
HighChild Processdist/cli.js
HighShelldist/cli.js
HighSame File Env Network Executiondist/cli.js
HighCredential Exfiltrationdist/cli.js
HighSandbox Evasion Gated Capabilitydist/cli.js
HighRuntime Package Installdist/cli.js
HighPayload In Excluded Dirtemplate/.claude/hooks/repo_context.py
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helpertemplate/.claude/hooks/repo_context.py
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to @flydocs/cli@1.0.6.
See all versions of @flydocs/cli for other recorded verdicts.
- Review the evidence and your use of @flydocs/cli@1.0.6 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.