registry / @getpromptly/cli / 0.2.8

@getpromptly/cli@0.2.8

Developer prompt analytics CLI - capture and review AI coding sessions

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 29 file(s), 249 KB of source, external domains: api.getpromptly.xyz, app.getpromptly.xyz, cli.github.com, eu.i.posthog.com, vizra.ai

Source & flagged code

1 flagged

dist/commands/login.jsView file

Lines 7-47javascript

7 config.apiUrl = options.apiUrl;

8 }

9 const apiUrl = config.apiUrl || "https://api.getpromptly.xyz";

10 // Step 1: Request a device code from the API

11 console.log("Requesting login code...");

12 const deviceCode = crypto.randomBytes(16).toString("hex");

13 const initResponse = await fetch(`${apiUrl}/auth/device/init`, {

14 method: "POST",

15 headers: { "Content-Type": "application/json" },

16 body: JSON.stringify({ deviceCode }),

17 });

18 if (!initResponse.ok) {

19 const error = await initResponse.text();

20 console.log(`Login failed: ${error}`);

21 process.exit(1);

22 }

23 const { verificationUrl } = (await initResponse.json());

24 // Step 2: Open browser to verification URL

25 console.log("\nOpening browser for sign-in...");

26 console.log(`If it doesn't open, visit: ${verificationUrl}`);

27 try {

28 const open = (await import("open")).default;

29 await open(verificationUrl);

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/commands/login.jsView on unpkg · L27

30 }

31 catch {

32 console.log("Could not open browser automatically.");

33 }

34 // Step 3: Poll for completion

35 console.log("\nWaiting for sign-in...");

36 const startTime = Date.now();

37 const timeout = 5 * 60 * 1000; // 5 minutes

38 const pollInterval = 2000; // 2 seconds

39 while (Date.now() - startTime < timeout) {

40 await new Promise((resolve) => setTimeout(resolve, pollInterval));

41 const pollResponse = await fetch(`${apiUrl}/auth/device/poll`, {

42 method: "POST",

43 headers: { "Content-Type": "application/json" },

44 body: JSON.stringify({ deviceCode }),

45 });

46 if (pollResponse.status === 200) {

47 const data = (await pollResponse.json());

Source & flagged code

1 flagged · loading source

dist/commands/login.jsView file

27package = @getpromptly/cli; repositoryIdentity = promptly; dependency = open L27: try { L28: const open = (await import("open")).default; L29: await open(verificationUrl);

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/commands/login.jsView on unpkg · L27

Findings

1 High3 Medium5 Low

HighCopied Package Dependency Bridgedist/commands/login.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

Source & flagged code

1 flagged

dist/commands/login.jsView file

Lines 7-47javascript

7 config.apiUrl = options.apiUrl;

8 }

9 const apiUrl = config.apiUrl || "https://api.getpromptly.xyz";

10 // Step 1: Request a device code from the API

11 console.log("Requesting login code...");

12 const deviceCode = crypto.randomBytes(16).toString("hex");

13 const initResponse = await fetch(`${apiUrl}/auth/device/init`, {

14 method: "POST",

15 headers: { "Content-Type": "application/json" },

16 body: JSON.stringify({ deviceCode }),

17 });

18 if (!initResponse.ok) {

19 const error = await initResponse.text();

20 console.log(`Login failed: ${error}`);

21 process.exit(1);

22 }

23 const { verificationUrl } = (await initResponse.json());

24 // Step 2: Open browser to verification URL

25 console.log("\nOpening browser for sign-in...");

26 console.log(`If it doesn't open, visit: ${verificationUrl}`);

27 try {

28 const open = (await import("open")).default;

29 await open(verificationUrl);

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/commands/login.jsView on unpkg · L27

30 }

31 catch {

32 console.log("Could not open browser automatically.");

33 }

34 // Step 3: Poll for completion

35 console.log("\nWaiting for sign-in...");

36 const startTime = Date.now();

37 const timeout = 5 * 60 * 1000; // 5 minutes

38 const pollInterval = 2000; // 2 seconds

39 while (Date.now() - startTime < timeout) {

40 await new Promise((resolve) => setTimeout(resolve, pollInterval));

41 const pollResponse = await fetch(`${apiUrl}/auth/device/poll`, {

42 method: "POST",

43 headers: { "Content-Type": "application/json" },

44 body: JSON.stringify({ deviceCode }),

45 });

46 if (pollResponse.status === 200) {

47 const data = (await pollResponse.json());