registry / @furlpay/cli / 0.2.1

@furlpay/cli@0.2.1

FurlPay CLI — stablecoin payments, investing, travel booking, yield and webhook tooling from your terminal. MCP server included.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 6 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 10 file(s), 80.8 KB of source, external domains: furlpay.com

Source & flagged code

1 flagged

lib/commands.jsView file

Lines 13-53javascript

14// `furlpay login` — email OTP → session cookie (same flow as the web app).

15// `furlpay login --key sk_...` — store an API/webhook key (dev tooling only).

16async function login(args, flags) {

17 if (flags.key) {

18 const cfg = loadConfig();

19 saveConfig({ ...cfg, key: flags.key, secret: flags.secret || flags.key });

20 out.ok("Credentials saved to ~/.furlpay/config.json");

21 return;

22 }

24 const email = flags.email || (await prompt("Email: "));

25 if (!email.includes("@")) return out.fail("Enter a valid email address.");

27 // --code means a code was already issued (e.g. a prior start call) — sending

28 // a new one would invalidate it.

29 if (!flags.code) {

30 const spin = out.spinner("Sending one-time code…");

31 let start;

32 try {

33 // POST /api/auth/otp/start { to, channel } — devCode present in mock mode.

34 start = await api.call("POST", "/api/auth/otp/start", { flags, body: { to: email, channel: "email" } });

35 } finally {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

lib/commands.jsView on unpkg · L33

36 spin.stop();

37 }

38 if (start.devCode) console.log(c.dim(` (sandbox mock mode — your code is ${start.devCode})`));

39 else out.ok(`Code sent to ${email}`);

40 }

42 const code = flags.code || (await prompt("Enter code: "));

43 // POST /api/auth/otp/check mints the furlpay_session cookie on success.

44 const res = await api.rawRequest("POST", "/api/auth/otp/check", {

45 flags,

46 body: { to: email, code, channel: "email", login: true },

47 });

48 if (res.status !== 200 || !res.body.verified) {

49 return out.fail((res.body && res.body.error) || "Verification failed.");

50 }

51 const session = api.extractSession(res.headers["set-cookie"]);

52 if (!session) return out.fail("Server did not return a session cookie.");

53 api.storeSession(flags, session);

Source & flagged code

1 flagged · loading source

lib/commands.jsView file

33// POST /api/auth/otp/start { to, channel } — devCode present in mock mode. L34: start = await api.call("POST", "/api/auth/otp/start", { flags, body: { to: email, channel: "email" } }); L35: } finally { ... L179: const data = await api.call("GET", "/api/wallets", { flags }); L180: // Non-custodial: there is no private key to export — the Safe is on-chain. L181: console.log(JSON.stringify({ safeAddress: data.safeAddress, modules: data.modules, balances: data.balances }, null, 2)); ... L747: try { L748: body = JSON.parse(flags.data); L749: } catch { ... L755: console.log(typeof res.body === "string" ? res.body : JSON.stringify(res.body, null, 2)); L756: if (res.status >= 400) process.exitCode = 1; L757: }

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

lib/commands.jsView on unpkg · L33

Findings

1 High2 Medium3 Low

HighSandbox Evasion Gated Capabilitylib/commands.js

MediumNetwork

MediumStructural Risk Force Deep Review

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

1 flagged

lib/commands.jsView file

Lines 13-53javascript

14// `furlpay login` — email OTP → session cookie (same flow as the web app).

15// `furlpay login --key sk_...` — store an API/webhook key (dev tooling only).

16async function login(args, flags) {

17 if (flags.key) {

18 const cfg = loadConfig();

19 saveConfig({ ...cfg, key: flags.key, secret: flags.secret || flags.key });

20 out.ok("Credentials saved to ~/.furlpay/config.json");

21 return;

22 }

24 const email = flags.email || (await prompt("Email: "));

25 if (!email.includes("@")) return out.fail("Enter a valid email address.");

27 // --code means a code was already issued (e.g. a prior start call) — sending

28 // a new one would invalidate it.

29 if (!flags.code) {

30 const spin = out.spinner("Sending one-time code…");

31 let start;

32 try {

33 // POST /api/auth/otp/start { to, channel } — devCode present in mock mode.

34 start = await api.call("POST", "/api/auth/otp/start", { flags, body: { to: email, channel: "email" } });

35 } finally {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

lib/commands.jsView on unpkg · L33

36 spin.stop();

37 }

38 if (start.devCode) console.log(c.dim(` (sandbox mock mode — your code is ${start.devCode})`));

39 else out.ok(`Code sent to ${email}`);

40 }

42 const code = flags.code || (await prompt("Enter code: "));

43 // POST /api/auth/otp/check mints the furlpay_session cookie on success.

44 const res = await api.rawRequest("POST", "/api/auth/otp/check", {

45 flags,

46 body: { to: email, code, channel: "email", login: true },

47 });

48 if (res.status !== 200 || !res.body.verified) {

49 return out.fail((res.body && res.body.error) || "Verification failed.");

50 }

51 const session = api.extractSession(res.headers["set-cookie"]);

52 if (!session) return out.fail("Server did not return a session cookie.");

53 api.storeSession(flags, session);