@hs-x/cli@0.3.7
HS-X CLI — init, validate, connect, dev, deploy, promote, rollback, doctor, sync. Installs the `hs-x` command.
Static Scan Results
scanned 3mo ago · by rust-scannerStatic analysis completed at 65.0% confidence. No malicious behavior was detected; 10 low-signal pattern(s) were surfaced and cleared.
Static reason
No blocking static signals were detected.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
4 flaggeddist/dev/compat-shim.jsView file
31export async function loadDevStack() {
L32: const portManager = await import('@hubspot/local-dev-lib/portManager');
L33: const config = await import('@hubspot/local-dev-lib/config');
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/dev/compat-shim.jsView on unpkg · L3135const loggerMod = await import('@hubspot/local-dev-lib/logger');
L36: const importRuntime = new Function('specifier', 'return import(specifier)');
L37: const parsing = await importRuntime('@hubspot/project-parsing-lib/translate');
Low
Eval
Package source references a known benign dynamic code generation pattern.
dist/dev/compat-shim.jsView on unpkg · L35dist/commands/deploy.jsView file
1import { spawn } from 'node:child_process';
L2: import { createHash, randomBytes } from 'node:crypto';
L3: import { cp, lstat, mkdir, mkdtemp, readFile, readdir, realpath, rename, rmdir, stat, unlink, writeFile, } from 'node:fs/promises';
L4: import { createServer } from 'node:http';
L5: import { tmpdir } from 'node:os';
...
L57: const explicitFlag = resolveFlag(input.argv, '--account-id');
L58: const fromFlag = explicitFlag ?? process.env.HSX_ACCOUNT_ID;
L59: if (fromFlag && fromFlag.length > 0) {
...
L137: }
L138: return { exitCode: 10 };
L139: }
...
L216: headers: { 'content-type': 'application/x-www-form-urlencoded' },
Findings
2 High3 Medium5 Low
HighCredential Exfiltrationdist/commands/deploy.js
HighTrigger Reachable Credential Exfiltrationdist/commands/deploy.js
MediumDynamic Requiredist/dev/compat-shim.js
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowEvaldist/dev/compat-shim.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @hs-x/cli@0.3.7.
See all versions of @hs-x/cli for other recorded verdicts.
- Review the evidence and your use of @hs-x/cli@0.3.7 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.