registry / @guapocado/cli / 0.0.7

@guapocado/cli@0.0.7

CLI for the Guapocado billing platform. Manage billing configs, sync with Stripe, and generate typed code from your billing schema.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 19 file(s), 256 KB of source, external domains: api.guapocado.dev

Source & flagged code

3 flagged

dist/chunk-4NT564I2.jsView file

Lines 1-33javascript

1#!/usr/bin/env node

2import {

3 fromCanonical,

4 validateCanonical

5} from "./chunk-XZMS4J6K.js";

7// src/billing-config.ts

8import { execFileSync } from "child_process";

9import { existsSync, readFileSync, statSync } from "fs";

10import { createRequire } from "module";

11import { basename, dirname, resolve } from "path";

12import { pathToFileURL } from "url";

13import consola from "consola";

14var require2 = createRequire(import.meta.url);

15var CONFIG_MARKER = "GUAPOCADO_CONFIG_JSON:";

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/chunk-4NT564I2.jsView on unpkg · L13

16var CONFIG_FILES = [

17 { kind: "ts", name: "billing.config.ts" },

18 { kind: "json", name: "billing.config.json" },

19 { kind: "canonical-json", name: "guapocado.billing.json" },

20 { kind: "yaml", name: "guapocado.billing.yaml" }

21];

22function detectConfigInDir(dir) {

23 for (const { kind, name } of CONFIG_FILES) {

24 const path = resolve(dir, name);

25 if (existsSync(path)) return { kind, path };

26 }

27 return null;

28}

29function classifyConfigFile(path) {

30 const base = basename(path);

31 if (base.endsWith(".ts")) return { kind: "ts", path };

32 if (base === "guapocado.billing.json") return { kind: "canonical-json", path };

33 if (base.endsWith(".yaml") || base.endsWith(".yml")) return { kind: "yaml", path };

dist/login-H4BCJCKM.jsView file

Lines 1-35javascript

1#!/usr/bin/env node

2import {

3 hintGitignore

4} from "./chunk-2MVQGE3D.js";

5import {

6 ensureLocalCredentialsDir,

7 migrateLegacyEnvironments,

8 normalizeEnvironmentName,

9 readStoredConfig,

10 upsertWorkspaceKey,

11 writeStoredConfig

dist/chunk-CGZCFESO.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @guapocado/cli@0.0.4 matchedIdentity = npm:QGd1YXBvY2Fkby9jbGk:0.0.4 similarity = 0.579 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/chunk-CGZCFESO.jsView on unpkg

Source & flagged code

3 flagged · loading source

dist/chunk-4NT564I2.jsView file

13import consola from "consola"; L14: var require2 = createRequire(import.meta.url); L15: var CONFIG_MARKER = "GUAPOCADO_CONFIG_JSON:";

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/chunk-4NT564I2.jsView on unpkg · L13

dist/login-H4BCJCKM.jsView file

15// src/commands/login.ts L16: import { spawn } from "child_process"; L17: import { defineCommand } from "citty"; ... L19: function openBrowser(url) { L20: const command = process.platform === "darwin" ? "open" : process.platform === "win32" ? "cmd" : "xdg-open"; L21: const args = process.platform === "win32" ? ["/c", "start", "", url] : [url]; ... L43: async run({ args }) { L44: const baseUrl = "https://api.guapocado.dev"; L45: if (args.key) { ... L63: headers: { "content-type": "application/json" }, L64: body: JSON.stringify({ target: "both" }) L65: });

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/login-H4BCJCKM.jsView on unpkg · L15

dist/chunk-CGZCFESO.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/chunk-CGZCFESO.jsView on unpkg

Findings

2 High4 Medium4 Low

HighSandbox Evasion Gated Capabilitydist/login-H4BCJCKM.js

HighPrevious Version Dangerous Deltadist/chunk-CGZCFESO.js

MediumDynamic Requiredist/chunk-4NT564I2.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

dist/chunk-4NT564I2.jsView file

Lines 1-33javascript

1#!/usr/bin/env node

2import {

3 fromCanonical,

4 validateCanonical

5} from "./chunk-XZMS4J6K.js";

7// src/billing-config.ts

8import { execFileSync } from "child_process";

9import { existsSync, readFileSync, statSync } from "fs";

10import { createRequire } from "module";

11import { basename, dirname, resolve } from "path";

12import { pathToFileURL } from "url";

13import consola from "consola";

14var require2 = createRequire(import.meta.url);

15var CONFIG_MARKER = "GUAPOCADO_CONFIG_JSON:";

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/chunk-4NT564I2.jsView on unpkg · L13

16var CONFIG_FILES = [

17 { kind: "ts", name: "billing.config.ts" },

18 { kind: "json", name: "billing.config.json" },

19 { kind: "canonical-json", name: "guapocado.billing.json" },

20 { kind: "yaml", name: "guapocado.billing.yaml" }

21];

22function detectConfigInDir(dir) {

23 for (const { kind, name } of CONFIG_FILES) {

24 const path = resolve(dir, name);

25 if (existsSync(path)) return { kind, path };

26 }

27 return null;

28}

29function classifyConfigFile(path) {

30 const base = basename(path);

31 if (base.endsWith(".ts")) return { kind: "ts", path };

32 if (base === "guapocado.billing.json") return { kind: "canonical-json", path };

33 if (base.endsWith(".yaml") || base.endsWith(".yml")) return { kind: "yaml", path };

dist/login-H4BCJCKM.jsView file

Lines 1-35javascript

1#!/usr/bin/env node

2import {

3 hintGitignore

4} from "./chunk-2MVQGE3D.js";

5import {

6 ensureLocalCredentialsDir,

7 migrateLegacyEnvironments,

8 normalizeEnvironmentName,

9 readStoredConfig,

10 upsertWorkspaceKey,

11 writeStoredConfig

dist/chunk-CGZCFESO.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/chunk-CGZCFESO.jsView on unpkg