registry / @genex-ai/cli-demo / 0.37.0

@genex-ai/cli-demo@0.37.0

⚠ Under review

Set up your ~/.claude workspace, authorize, create a game project, generate AI assets, and publish (genex CLI).

Static Scan Results

scanned 41m ago · by rust-scanner

Static analysis flagged 10 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 20 file(s), 455 KB of source, external domains: 127.0.0.1, demo-api.glotech.world, demo-web.glotech.world, registry.npmjs.org, www.npmjs.com

Source & flagged code

3 flagged

dist/index.jsView file

Lines 1-30javascript

1#!/usr/bin/env node

3// src/commands/init.ts

4import path8 from "path";

6// src/config.ts

7import fs from "fs";

8import os from "os";

9import path from "path";

10import { fileURLToPath } from "url";

11var DEFAULT_AUTH_URL = "https://demo-web.glotech.world";

12var DEFAULT_API_URL = "https://demo-api.glotech.world";

13var DEFAULT_COLYSEUS_URL = "wss://demo-colyseus.glotech.world";

14var ENV_TOKEN_KEY = "GENEX_TOKEN";

15var AUTH_URL_ENV = "GENEX_AUTH_URL";

16var API_URL_ENV = "GENEX_API_URL";

17var COLYSEUS_URL_ENV = "GENEX_COLYSEUS_URL";

18function getAuthUrl(override) {

19 const raw = override || process.env[AUTH_URL_ENV] || DEFAULT_AUTH_URL;

20 return raw.replace(/\/+$/, "");

21}

22function getApiUrl(override) {

23 const raw = override || process.env[API_URL_ENV] || DEFAULT_API_URL;

24 return raw.replace(/\/+$/, "");

25}

26function getColyseusUrl(override) {

27 const raw = override || process.env[COLYSEUS_URL_ENV] || DEFAULT_COLYSEUS_URL;

28 return raw.replace(/\/+$/, "");

29}

30function getGenexDir() {

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/index.jsView on unpkg · L10

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg · L10

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/index.jsView on unpkg · L10

Source & flagged code

3 flagged · loading source

dist/index.jsView file

10import { fileURLToPath } from "url"; L11: var DEFAULT_AUTH_URL = "https://demo-web.glotech.world"; L12: var DEFAULT_API_URL = "https://demo-api.glotech.world"; ... L18: function getAuthUrl(override) { L19: const raw = override || process.env[AUTH_URL_ENV] || DEFAULT_AUTH_URL; L20: return raw.replace(/\/+$/, ""); ... L30: function getGenexDir() { L31: return path.join(os.homedir(), ".genex"); L32: } ... L43: const here = path.dirname(fileURLToPath(import.meta.url)); L44: const pkg = JSON.parse( L45: fs.readFileSync(path.resolve(here, "..", "package.json"), "utf8")

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/index.jsView on unpkg · L10

10Trigger-reachable chain: manifest.bin -> dist/index.js L10: import { fileURLToPath } from "url"; L11: var DEFAULT_AUTH_URL = "https://demo-web.glotech.world"; L12: var DEFAULT_API_URL = "https://demo-api.glotech.world"; ... L18: function getAuthUrl(override) { L19: const raw = override || process.env[AUTH_URL_ENV] || DEFAULT_AUTH_URL; L20: return raw.replace(/\/+$/, ""); ... L30: function getGenexDir() { L31: return path.join(os.homedir(), ".genex"); L32: } ... L43: const here = path.dirname(fileURLToPath(import.meta.url)); L44: const pkg = JSON.parse( L45: fs.readFileSync(path.resolve(here, "..", "package.json"), "utf8")

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg · L10

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/index.jsView on unpkg · L10

Findings

2 Critical3 Medium5 Low

CriticalCredential Exfiltrationdist/index.js

CriticalTrigger Reachable Dangerous Capabilitydist/index.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowWeak Cryptodist/index.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

dist/index.jsView file

Lines 1-30javascript

1#!/usr/bin/env node

3// src/commands/init.ts

4import path8 from "path";

6// src/config.ts

7import fs from "fs";

8import os from "os";

9import path from "path";

10import { fileURLToPath } from "url";

11var DEFAULT_AUTH_URL = "https://demo-web.glotech.world";

12var DEFAULT_API_URL = "https://demo-api.glotech.world";

13var DEFAULT_COLYSEUS_URL = "wss://demo-colyseus.glotech.world";

14var ENV_TOKEN_KEY = "GENEX_TOKEN";

15var AUTH_URL_ENV = "GENEX_AUTH_URL";

16var API_URL_ENV = "GENEX_API_URL";

17var COLYSEUS_URL_ENV = "GENEX_COLYSEUS_URL";

18function getAuthUrl(override) {

19 const raw = override || process.env[AUTH_URL_ENV] || DEFAULT_AUTH_URL;

20 return raw.replace(/\/+$/, "");

21}

22function getApiUrl(override) {

23 const raw = override || process.env[API_URL_ENV] || DEFAULT_API_URL;

24 return raw.replace(/\/+$/, "");

25}

26function getColyseusUrl(override) {

27 const raw = override || process.env[COLYSEUS_URL_ENV] || DEFAULT_COLYSEUS_URL;

28 return raw.replace(/\/+$/, "");

29}

30function getGenexDir() {

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/index.jsView on unpkg · L10

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg · L10

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/index.jsView on unpkg · L10