Loading npm security reports…

@glubean/cli@0.8.4: Suspicious npm security report (Warn) | LPM Firewall

registry / @glubean/cli / 0.8.4

@glubean/cli@0.8.4

The Glubean command-line tool. Run tests, sync results to Cloud, scaffold projects, manage environments.

Static Scan Results

scanned 15d ago · by rust-scanner

Static analysis flagged 15 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 40 file(s), 458 KB of source, external domains: api.example.com, api.glubean.com, dummyjson.com, github.com, glubean.com, registry.npmjs.org

Source & flagged code

6 flagged

dist/commands/init.jsView file

Lines 837-882javascript

837

838Create a scoped contract instance with \`contract.http.with()\`, then define endpoints:

839

840\`\`\`typescript

841import { contract } from "@glubean/sdk";

842import { api } from "../configure.js";

843

844const userApi = contract.http.with("user", {

845 client: api,

846 security: "bearer",

847});

848

849// @contract

850export const createUser = userApi("create-user", {

851 endpoint: "POST /users",

852 feature: "User Registration",

853 description: "Create a new user account",

854 cases: {

855 success: {

856 description: "Valid registration creates user and returns profile",

857 body: { email: "test@example.com", password: "secure123" },

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/commands/init.jsView on unpkg · L857

858 expect: { status: 201 },

859 },

860 duplicateEmail: {

861 description: "Already registered email is rejected",

862 body: { email: "existing@example.com", password: "secure123" },

Medium

Secret Pattern

Hardcoded password in dist/commands/init.js

dist/commands/init.jsView on unpkg · L862

863 expect: { status: 409 },

864 },

865 },

866});

867\`\`\`

868

869## Lifecycle

870

8711. Define: write contracts describing what the API should do

8722. Red: implementation does not satisfy the contract yet

8733. Green: implementation passes all contracts

8744. Iterate: add error cases, auth, schema validation

875

876## Rules

877

878- Fix the implementation, not the contract

879- Only change a contract when the business requirement changes

880- Use business language in descriptions, not technical jargon

881`;

882const GLUBEAN_SETUP_TEMPLATE = `/**

dist/lib/git.jsView file

Lines 1-23javascript

1/**

2 * Git helper utilities for the Glubean CLI.

3 */

4import { execFile } from "node:child_process";

5import { resolve, relative } from "node:path";

High

Child Process

Package source references child process execution.

dist/lib/git.jsView on unpkg · L3

6function

dist/version.jsView file

Lines 1-11javascript

1import { createRequire } from "node:module";

2import { dirname, resolve } from "node:path";

3import { fileURLToPath } from "node:url";

4const __dirname = dirname

dist/commands/config_mcp.jsView file

Lines 14-54javascript

14 const remove = options.remove ?? false;

15 if (remove) {

16 const target = options.target ?? (await promptTarget

dist/commands/upgrade.jsView file

Lines 23-63javascript

23 const res = await fetch(REGISTRY_URL, { signal: controller.signal });

24 clearTimeout(timeout);

25 if (res.ok) {

26 const data

Source & flagged code

6 flagged · loading source

dist/commands/init.jsView file

Source & flagged code

6 flagged

dist/commands/init.jsView file

Lines 837-882javascript

837

838Create a scoped contract instance with \`contract.http.with()\`, then define endpoints:

839

840\`\`\`typescript

841import { contract } from "@glubean/sdk";

842import { api } from "../configure.js";

843

844const userApi = contract.http.with("user", {

845 client: api,

846 security: "bearer",

847});

848

849// @contract

850export const createUser = userApi("create-user", {

851 endpoint: "POST /users",

852 feature: "User Registration",

853 description: "Create a new user account",

854 cases: {

855 success: {

856 description: "Valid registration creates user and returns profile",

857 body: { email: "test@example.com", password: "secure123" },

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/commands/init.jsView on unpkg · L857

858 expect: { status: 201 },

859 },

860 duplicateEmail: {

861 description: "Already registered email is rejected",

862 body: { email: "existing@example.com", password: "secure123" },

Medium

Secret Pattern

Hardcoded password in dist/commands/init.js

dist/commands/init.jsView on unpkg · L862

863 expect: { status: 409 },

864 },

865 },

866});

867\`\`\`

868

869## Lifecycle

870

8711. Define: write contracts describing what the API should do

8722. Red: implementation does not satisfy the contract yet

8733. Green: implementation passes all contracts

8744. Iterate: add error cases, auth, schema validation

875

876## Rules

877

878- Fix the implementation, not the contract

879- Only change a contract when the business requirement changes

880- Use business language in descriptions, not technical jargon

881`;

882const GLUBEAN_SETUP_TEMPLATE = `/**

dist/lib/git.jsView file

Lines 1-23javascript

1/**

2 * Git helper utilities for the Glubean CLI.

3 */

4import { execFile } from "node:child_process";

5import { resolve, relative } from "node:path";

High

Child Process

Package source references child process execution.

dist/lib/git.jsView on unpkg · L3

6function

dist/version.jsView file

Lines 1-11javascript

1import { createRequire } from "node:module";

2import { dirname, resolve } from "node:path";

3import { fileURLToPath } from "node:url";

4const __dirname = dirname

dist/commands/config_mcp.jsView file

Lines 14-54javascript

14 const remove = options.remove ?? false;

15 if (remove) {

16 const target = options.target ?? (await promptTarget

dist/commands/upgrade.jsView file

Lines 23-63javascript

23 const res = await fetch(REGISTRY_URL, { signal: controller.signal });

24 clearTimeout(timeout);

25 if (res.ok) {

26 const data

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code