registry / @framedash/cli / 0.1.3

@framedash/cli@0.1.3

Framedash CLI tool for CI/CD pipelines, analytics queries, and coding agent integration.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 8 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 31 file(s), 136 KB of source, external domains: 127.0.0.1, app.framedash.dev

Source & flagged code

1 flagged

dist/commands/login.jsView file

Lines 1-21javascript

1import { spawn } from "node:child_process";

2import { parseArgs } from "node:util";

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/commands/login.jsView on unpkg · L1

3import { GLOBAL_OPTIONS, resolveBaseAndFormat } from "../lib/config.js";

4import { error, log, success } from "../lib/logger.js";

5import { startLoopbackServer } from "../lib/oauth/loopback-server.js";

6import { computeS256CodeChallenge, generateCodeVerifier, generateState, } from "../lib/oauth/pkce.js";

7import { CLI_OAUTH_CLIENT_ID, exchangeAuthorizationCode, revokeToken, toStoredEntry, } from "../lib/oauth/token-endpoint.js";

8import { credentialsFilePath, saveStoredEntry } from "../lib/oauth/token-store.js";

9const HELP = `Usage: framedash login [options]

11Sign in interactively via your browser (OAuth 2.1 authorization code + PKCE).

12Tokens are stored in ${"~"}/.config/framedash/credentials.json (honors

13XDG_CONFIG_HOME; the same path is used on Windows) and refreshed

14automatically. Commands use the stored login only when no API key is given

15(--api-key / --api-key-file / FRAMEDASH_API_KEY take precedence).

17For CI and other non-interactive use, do NOT use login: set the

18FRAMEDASH_API_KEY environment variable to a project API key instead.

20Options:

21 --scopes <scopes> Space-delimited scopes to request

Source & flagged code

1 flagged · loading source

dist/commands/login.jsView file

1import { spawn } from "node:child_process"; L2: import { parseArgs } from "node:util"; ... L23: --no-browser Do not try to open the browser; print the URL only L24: --base-url <url> API base URL (default: https://app.framedash.dev) L25: -h, --help Show help`; ... L38: let args; L39: if (process.platform === "win32") { L40: command = "rundll32";

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/commands/login.jsView on unpkg · L1

Findings

1 High3 Medium4 Low

HighSandbox Evasion Gated Capabilitydist/commands/login.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

1 flagged

dist/commands/login.jsView file

Lines 1-21javascript

1import { spawn } from "node:child_process";

2import { parseArgs } from "node:util";

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/commands/login.jsView on unpkg · L1

3import { GLOBAL_OPTIONS, resolveBaseAndFormat } from "../lib/config.js";

4import { error, log, success } from "../lib/logger.js";

5import { startLoopbackServer } from "../lib/oauth/loopback-server.js";

6import { computeS256CodeChallenge, generateCodeVerifier, generateState, } from "../lib/oauth/pkce.js";

7import { CLI_OAUTH_CLIENT_ID, exchangeAuthorizationCode, revokeToken, toStoredEntry, } from "../lib/oauth/token-endpoint.js";

8import { credentialsFilePath, saveStoredEntry } from "../lib/oauth/token-store.js";

9const HELP = `Usage: framedash login [options]

11Sign in interactively via your browser (OAuth 2.1 authorization code + PKCE).

12Tokens are stored in ${"~"}/.config/framedash/credentials.json (honors

13XDG_CONFIG_HOME; the same path is used on Windows) and refreshed

14automatically. Commands use the stored login only when no API key is given

15(--api-key / --api-key-file / FRAMEDASH_API_KEY take precedence).

17For CI and other non-interactive use, do NOT use login: set the

18FRAMEDASH_API_KEY environment variable to a project API key instead.

20Options:

21 --scopes <scopes> Space-delimited scopes to request