registry / @getcodex/cli / 1.4.1

@getcodex/cli@1.4.1

CLI for the Codex editor.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicenseWildcardDependency

scanned 16 file(s), 79.4 KB of source, external domains: 127.0.0.1, codex.cane1712.dev, example.com

Source & flagged code

1 flagged

src/commands/auth.tsView file

Lines 1-21typescript

1import { exec } from "node:child_process";

2import { CodexClient, CodexOAuth, type CurrentUser } from "@getcodex/sdk";

3import { configPath, deleteConfig, patchConfig, readConfig } from "../config";

4import { printJson, printSuccess } from "../output";

6const CLI_CLIENT_ID = "codex_cli";

7const DEFAULT_BASE_URL = "https://codex.cane1712.dev";

9function generateVerifier(): string {

10 const buf = new Uint8Array(32);

11 crypto.getRandomValues(buf);

12 return Buffer.from(buf).toString("base64url");

13}

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

src/commands/auth.tsView on unpkg · L1

15async function s256(verifier: string): Promise<string> {

16 const data = new TextEncoder().encode(verifier);

17 const hash = await crypto.subtle.digest("SHA-256", data);

18 return Buffer.from(hash).toString("base64url");

19}

21function openBrowser(url: string): void {

Source & flagged code

1 flagged · loading source

src/commands/auth.tsView file

1import { exec } from "node:child_process"; L2: import { CodexClient, CodexOAuth, type CurrentUser } from "@getcodex/sdk"; ... L6: const CLI_CLIENT_ID = "codex_cli"; L7: const DEFAULT_BASE_URL = "https://codex.cane1712.dev"; L8: ... L11: crypto.getRandomValues(buf); L12: return Buffer.from(buf).toString("base64url"); L13: } ... L22: const cmd = L23: process.platform === "win32" L24: ? `start "" "${url}"` ... L69: } else {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

src/commands/auth.tsView on unpkg · L1

Findings

1 High4 Medium5 Low

HighSandbox Evasion Gated Capabilitysrc/commands/auth.ts

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumWildcard Dependency

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

1 flagged

src/commands/auth.tsView file

Lines 1-21typescript

1import { exec } from "node:child_process";

2import { CodexClient, CodexOAuth, type CurrentUser } from "@getcodex/sdk";

3import { configPath, deleteConfig, patchConfig, readConfig } from "../config";

4import { printJson, printSuccess } from "../output";

6const CLI_CLIENT_ID = "codex_cli";

7const DEFAULT_BASE_URL = "https://codex.cane1712.dev";

9function generateVerifier(): string {

10 const buf = new Uint8Array(32);

11 crypto.getRandomValues(buf);

12 return Buffer.from(buf).toString("base64url");

13}

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

src/commands/auth.tsView on unpkg · L1

15async function s256(verifier: string): Promise<string> {

16 const data = new TextEncoder().encode(verifier);

17 const hash = await crypto.subtle.digest("SHA-256", data);

18 return Buffer.from(hash).toString("base64url");

19}

21function openBrowser(url: string): void {