registry / @graphit/cli / 0.2.107

@graphit/cli@0.2.107

Graphit CLI - Build custom dashboards from any AI coding assistant

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 37 file(s), 221 KB of source, external domains: 127.0.0.1, api.graphit-app.com, graphit-app.com, registry.npmjs.org, securetoken.googleapis.com

Source & flagged code

4 flagged

dist/auth/token.jsView file

Lines 1-23javascript

1import { readCredentials, writeCredentials } from "./credentials.js";

2const FIREBASE_TOKEN_URL = "https://securetoken.googleapis.com/v1/token";

3const FIREBASE_API_KEY = process.env.GRAPHIT_FIREBASE_API_KEY || "AIzaSyCxahikMb2o0BroW1gqn2aWNad6S6-n-gI";

High

High Secret

Source & flagged code

4 flagged · loading source

dist/auth/token.jsView file

3patternName = google_api_key severity = high line = 3 matchedText = const FI...gI";

High

High Secret

Package contains a high-severity secret pattern.

dist/auth/token.jsView on unpkg · L3

3patternName = google_api_key severity = high line = 3 matchedText = const FI...gI";

High

Secret Pattern

Google API key in dist/auth/token.js

dist/auth/token.jsView on unpkg · L3

dist/update-check.jsView file

7import { findOutdatedSkillInstalls, formatSkillStalenessBanner, } from "./sk[redacted]"; L8: const require = createRequire(import.meta.url); L9: const pkg = require("../package.json");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/update-check.jsView on unpkg · L7

bin/graphit.cmdView file

•path = bin/graphit.cmd kind = build_helper sizeBytes = 431 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/graphit.cmdView on unpkg

Findings

2 High5 Medium5 Low

HighHigh Secretdist/auth/token.js

HighSecret Patterndist/auth/token.js

MediumDynamic Requiredist/update-check.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperbin/graphit.cmd

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

dist/update-check.jsView file

Lines 1-27javascript

1import { existsSync, mkdirSync, readFileSync, realpathSync, writeFileSync } from "fs";

2import { spawnSync } from "child_process";

3import { homedir } from "os";

4import { dirname, join, sep } from "path";

5import { fileURLToPath } from "url";

6import { createRequire } from "module";

7import { findOutdatedSkillInstalls, formatSkillStalenessBanner, } from "./skill-version.js";

8const require = createRequire(import.meta.url);

9const pkg = require("../package.json");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/update-check.jsView on unpkg · L7

10const REGISTRY_URL = "https://registry.npmjs.org/@graphit/cli/latest";

11const CACHE_DIR = join(homedir(), ".graphit");

12const CACHE_FILE = join(CACHE_DIR, "update-check.json");

13const MIGRATION_NOTICE_FILE = join(CACHE_DIR, "migration-notice.json");

14const TTL_MS = 24 * 60 * 60 * 1000;

15// Project #246: the cache file is user-writable, so a corrupt/tampered value

16// (valid JSON, wrong type) must not crash the CLI. Validate the shape before use

17// and treat anything invalid as a cache miss - mirrors the SEC hardening already

18// applied in scripts/plugin-status.mjs (isStrictSemver / isValidVersionCache).

19const SEMVER_RE = /^\d+\.\d+\.\d+$/;

20function isValidCacheEntry(value) {

21 if (typeof value !== "object" || value === null)

22 return false;

23 const v = value;

24 return (typeof v.latestVersion === "string" &&

25 SEMVER_RE.test(v.latestVersion) &&

26 typeof v.checkedAt === "number");

27}