registry / @guapocado/cli / 0.0.4

@guapocado/cli@0.0.4

CLI for the Guapocado billing platform. Manage billing configs, sync with Stripe, and generate typed code from your billing schema.

Static Scan Results

scanned 8d ago · by rust-scanner

Static analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 19 file(s), 252 KB of source, external domains: api.guapocado.dev

Source & flagged code

2 flagged

dist/chunk-OFWLPRBY.jsView file

Lines 1-34javascript

1#!/usr/bin/env node

2import {

3 fromCanonical,

4 toCanonical,

5 validateCanonical

6} from "./chunk-XZMS4J6K.js";

8// src/billing-config.ts

9import { execFileSync } from "child_process";

10import { existsSync, readFileSync, statSync } from "fs";

11import { createRequire } from "module";

12import { basename, dirname, resolve } from "path";

13import { pathToFileURL } from "url";

14import consola from "consola";

15var require2 = createRequire(import.meta.url);

16var CONFIG_MARKER = "GUAPOCADO_CONFIG_JSON:";

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/chunk-OFWLPRBY.jsView on unpkg · L14

17var CONFIG_FILES = [

18 { kind: "ts", name: "billing.config.ts" },

19 { kind: "json", name: "billing.config.json" },

20 { kind: "canonical-json", name: "guapocado.billing.json" },

21 { kind: "yaml", name: "guapocado.billing.yaml" }

22];

23function detectConfigInDir(dir) {

24 for (const { kind, name } of CONFIG_FILES) {

25 const path = resolve(dir, name);

26 if (existsSync(path)) return { kind, path };

27 }

28 return null;

29}

30function classifyConfigFile(path) {

31 const base = basename(path);

32 if (base.endsWith(".ts")) return { kind: "ts", path };

33 if (base === "guapocado.billing.json") return { kind: "canonical-json", path };

34 if (base.endsWith(".yaml") || base.endsWith(".yml")) return { kind: "yaml", path };

dist/login-CRWDZ5VM.jsView file

Lines 1-33javascript

1#!/usr/bin/env node

2import {

3 hintGitignore

4} from "./chunk-EHIUCFS6.js";

5import {

6 ensureLocalCredentialsDir,

7 readStoredConfig,

8 upsertWorkspaceKey,

9 writeStoredConfig

10} from "./chunk-Y5X6L6N2.js";

Source & flagged code

2 flagged · loading source

dist/chunk-OFWLPRBY.jsView file

14import consola from "consola"; L15: var require2 = createRequire(import.meta.url); L16: var CONFIG_MARKER = "GUAPOCADO_CONFIG_JSON:";

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/chunk-OFWLPRBY.jsView on unpkg · L14

dist/login-CRWDZ5VM.jsView file

13// src/commands/login.ts L14: import { spawn } from "child_process"; L15: import { defineCommand } from "citty"; ... L17: function openBrowser(url) { L18: const command = process.platform === "darwin" ? "open" : process.platform === "win32" ? "cmd" : "xdg-open"; L19: const args = process.platform === "win32" ? ["/c", "start", "", url] : [url]; ... L41: async run({ args }) { L42: const baseUrl = "https://api.guapocado.dev"; L43: if (args.key) { ... L58: headers: { "content-type": "application/json" }, L59: body: JSON.stringify({ target: "both" }) L60: });

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/login-CRWDZ5VM.jsView on unpkg · L13

Findings

1 High4 Medium4 Low

HighSandbox Evasion Gated Capabilitydist/login-CRWDZ5VM.js

MediumDynamic Requiredist/chunk-OFWLPRBY.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

dist/chunk-OFWLPRBY.jsView file

Lines 1-34javascript

1#!/usr/bin/env node

2import {

3 fromCanonical,

4 toCanonical,

5 validateCanonical

6} from "./chunk-XZMS4J6K.js";

8// src/billing-config.ts

9import { execFileSync } from "child_process";

10import { existsSync, readFileSync, statSync } from "fs";

11import { createRequire } from "module";

12import { basename, dirname, resolve } from "path";

13import { pathToFileURL } from "url";

14import consola from "consola";

15var require2 = createRequire(import.meta.url);

16var CONFIG_MARKER = "GUAPOCADO_CONFIG_JSON:";

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/chunk-OFWLPRBY.jsView on unpkg · L14

17var CONFIG_FILES = [

18 { kind: "ts", name: "billing.config.ts" },

19 { kind: "json", name: "billing.config.json" },

20 { kind: "canonical-json", name: "guapocado.billing.json" },

21 { kind: "yaml", name: "guapocado.billing.yaml" }

22];

23function detectConfigInDir(dir) {

24 for (const { kind, name } of CONFIG_FILES) {

25 const path = resolve(dir, name);

26 if (existsSync(path)) return { kind, path };

27 }

28 return null;

29}

30function classifyConfigFile(path) {

31 const base = basename(path);

32 if (base.endsWith(".ts")) return { kind: "ts", path };

33 if (base === "guapocado.billing.json") return { kind: "canonical-json", path };

34 if (base.endsWith(".yaml") || base.endsWith(".yml")) return { kind: "yaml", path };

dist/login-CRWDZ5VM.jsView file

Lines 1-33javascript

1#!/usr/bin/env node

2import {

3 hintGitignore

4} from "./chunk-EHIUCFS6.js";

5import {

6 ensureLocalCredentialsDir,

7 readStoredConfig,

8 upsertWorkspaceKey,

9 writeStoredConfig

10} from "./chunk-Y5X6L6N2.js";