registry / @iamken/cloudtunnel / 0.1.3

@iamken/cloudtunnel@0.1.3

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 6 file(s), 50.1 KB of source, external domains: api.cloudflare.com, dash.cloudflare.com, github.com

Source & flagged code

2 flagged

dist/index.jsView file

Lines 34-74javascript

34// src/commands/login.ts

35import * as clack from "@clack/prompts";

37// src/ui/output.ts

38import pc from "picocolors";

39import Table from "cli-table3";

40import { cancel, intro, isCancel, note, outro, select, spinner } from "@clack/prompts";

41function redactToken(token) {

42 if (!token) return "";

43 const last4 = token.length > 4 ? token.slice(-4) : token;

44 return `\u2022\u2022\u2022\u2022${last4}`;

45}

46var say = {

47 info: (msg) => console.log(msg),

48 ok: (msg) => console.log(pc.green(`\u2713 ${msg}`)),

49 warn: (msg) => console.warn(pc.yellow(`! ${msg}`)),

50 dim: (msg) => console.log(pc.dim(msg)),

51 step: (msg) => console.log(pc.cyan(`\u2192 ${msg}`))

52};

53var dim = (s) => pc.dim(s);

54function formatRoute(host, target) {

55 return `${pc.green(pc.bold(`https://${host}`))} ${pc.dim("\u2192")} ${pc.cyan(target)}`;

56}

57function printTable(head, rows) {

58 const table = new Table({

59 head: head.map((h) => pc.bold(h)),

60 style: { head: [], border: [] }

61 });

62 for (const row of rows) table.push(row);

63 console.log(table.toString());

64}

65async function selectOne(message, items, label) {

66 const value = await select({

67 message,

68 options: items.map((item, i) => ({ value: String(i), label: label(item) }))

69 });

70 if (isCancel(value)) {

71 cancel("Cancelled.");

72 throw new CliError("Cancelled.", { exitCode: 130 });

73 }

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L54

74 return items[Number(value)];

•matchType = previous_version_dangerous_delta matchedPackage = @iamken/cloudtunnel@0.1.0 matchedIdentity = npm:QGlhbWtlbi9jbG91ZHR1bm5lbA:0.1.0 similarity = 0.833 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg

Source & flagged code

2 flagged · loading source

dist/index.jsView file

54function formatRoute(host, target) { L55: return `${pc.green(pc.bold(`https://${host}`))} ${pc.dim("\u2192")} ${pc.cyan(target)}`; L56: } ... L71: cancel("Cancelled."); L72: throw new CliError("Cancelled.", { exitCode: 130 }); L73: } ... L77: // src/config/token-url.ts L78: import { spawn } from "child_process"; L79: var REQUIRED_SCOPES = [ ... L88: function openBrowser(url) { L89: const cmd = process.platform === "darwin" ? "open" : process.platform === "win32" ? "cmd" : "xdg-open"; L90: const args = process.platform === "win32" ? ["/c", "start", "", url] : [url];

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L54

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg

Findings

2 High3 Medium5 Low

HighSandbox Evasion Gated Capabilitydist/index.js

HighPrevious Version Dangerous Deltadist/index.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings