registry / @holostaff/cli / 0.9.6
@holostaff/cli@0.9.6
⚠ Under reviewHolostaff CLI — scan, instrument, and embed copilots in your codebase
Static Scan Results
scanned 3mo ago · by rust-scannerStatic analysis flagged 12 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
5 flaggeddist/instrument/openPullRequest.jsView file
18*/
L19: import { execFile } from 'node:child_process';
L20: import { promisify } from 'node:util';
High
Child Process
Package source references child process execution.
dist/instrument/openPullRequest.jsView on unpkg · L18dist/deploy/editsKey.jsView file
1/**
L2: * Stable SHA-1 hash of customerEdits — pair for the server's
Low
Weak Crypto
Package source references weak cryptographic algorithms.
dist/deploy/editsKey.jsView on unpkg · L1dist/commands/simulateCiRunner.jsView file
•
Findings
1 Critical4 High2 Medium5 Low
CriticalPrevious Version Dangerous Deltadist/commands/simulateCiRunner.js
HighChild Processdist/instrument/openPullRequest.js
HighShell
HighCommand Output Exfiltrationdist/commands/simulateCiRunner.js
HighTrigger Reachable Command Output Exfiltrationdist/commands/simulateCiRunner.js
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowWeak Cryptodist/deploy/editsKey.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @holostaff/cli@0.9.6.
See all versions of @holostaff/cli for other recorded verdicts.
- Review the evidence and your use of @holostaff/cli@0.9.6 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.