registry / @invarn/cibuild / 2.3.0

@invarn/cibuild@2.3.0

⚠ Under review

CI Build CLI — local pipeline orchestration and validation

Static Scan Results

scanned 5h ago · by rust-scanner

Static analysis flagged 21 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemShell

Supply chain

HighEntropyStringsObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 119 file(s), 2.47 MB of source, external domains: 127.0.0.1, adoptium.net, api.qrserver.com, api.slack.com, appdistribution.firebase.dev, ci.example.com, cibuild.io, cli.github.com, developer.android.com, example.com, git-scm.com, github.com, gitlab.com, hooks.slack.com, my-ci.com, testflight.apple.com, www.apple.com

Source & flagged code

13 flagged

dist/src/yaml/steps/xcode.jsView file

Lines 269-309javascript

269 effectiveXcconfig += '\nCODE_SIGNING_ALLOWED = NO';

270 effectiveXcconfig += '\nCODE_SIGN_IDENTITY = -';

271 }

272 commands.push(`cat > "$XCCONFIG_PATH" << 'XCCONFIG_EOF'`);

273 commands.push(effectiveXcconfig);

274 commands.push('XCCONFIG_EOF');

275 commands.push('');

276 // Detect Apple API key for cloud-managed signing (xcodebuild

277 // -allowProvisioningUpdates). When APPLE_API_KEY_ID/ISSUER_ID/KEY_PATH

278 // are resolved by the env-resolver (from .cibuild-secrets.json or

279 // CIBUILD_SW__* env vars), embed the .p8 into the generated script via

280 // heredoc and bake the IDs as literals. Reading from $APPLE_API_KEY_ID

281 // at script runtime would not work because cibuild's runner only

282 // forwards process.env to spawned scripts, and EnvResolver-decoded

283 // secrets live in its in-memory map, not process.env.

284 let xcodeAuthFlags = '';

285 if (automaticCodeSigning !== 'off') {

286 const apiKeyId = (env['APPLE_API_KEY_ID'] || '').trim();

287 const apiIssuerId = (env['APPLE_API_ISSUER_ID'] || '').trim();

288 const apiKeySecret = env['APPLE_API_KEY_PATH'] || '';

289 // Secret may be raw PEM (`-----BEGIN PRIVATE KEY-----…`) or base64-encoded.

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/src/yaml/steps/xcode.jsView on unpkg · L289

Critical

Secret Pattern

RSA private key in dist/src/yaml/steps/xcode.js

dist/src/yaml/steps/xcode.jsView on unpkg · L289

290 let p8Pem = '';

291 if (apiKeySecret) {

292 if (apiKeySecret.trimStart().startsWith('-----BEGIN')) {

293 p8Pem = apiKeySecret;

294 }

295 else {

296 try {

297 p8Pem = Buffer.from(apiKeySecret, 'base64').toString('utf-8');

298 }

299 catch {

300 p8Pem = '';

301 }

302 }

303 }

304 const p8LooksValid = p8Pem.includes('-----BEGIN') && p8Pem.includes('PRIVATE KEY');

305 if (apiKeyId && apiIssuerId && p8LooksValid) {

306 commands.push('# Apple API key resolved — embedding for cloud-managed signing');

307 // BSD/macOS mktemp requires X's at the end of the template; any chars

308 // after them are literal and not substituted. Don't add a .p8 suffix.

309 commands.push('API_KEY_TEMP_FILE="$(mktemp /tmp/cibuild-api-key.XXXXXX)"');

dist/src/yaml/fidelity-input-digest.test.jsView file

Lines 1-55javascript

1/**

2 * Unit tests for the deterministic per-package input digest.

3 *

4 * The digest is the content key the dashboard matches on to decide whether a

5 * render would be identical to one it already has — so it must be a pure

6 * function of the package's input bytes (wrapper source + reference), stable

7 * across machines/branches, and never derived from paths-as-location, mtimes,

8 * or commit ids.

9 */

10import { describe, test, expect } from '@jest/globals'

dist/cli.cjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @invarn/cibuild@2.2.9 matchedIdentity = npm:QGludmFybi9jaWJ1aWxk:2.2.9 similarity = 0.974 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.cjsView on unpkg

1#!/usr/bin/env node L2: const _0x3f9354=_0xb505;(function(_0x3564b9,_0x14c37e){const _0x395893=_0xb505,_0x491980=_0x3564b9();while(!![]){try{const _0x31597e=-parseInt(_0x395893(0x38b))/0x1+-parseInt(_0x39... L3: // Write the helper into the harness dir once (idempotent across screens).

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

dist/cli.cjsView on unpkg · L1

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/cli.cjsView on unpkg · L1

dist/src/yaml/env-resolver.jsView file

Lines 1-28javascript

1/**

2 * Environment variable resolution and interpolation

3 * Merges global and workflow-level environment variables

4 * Supports variable interpolation in multiple formats

5 */

6import * as crypto from 'crypto';

7import * as fs from 'fs';

dist/src/yaml/steps/bitrise-ssh.test.jsView file

Lines 6-46javascript

6describe('BitriseSSHStepExecutor', () => {

7 const mockConfig = {

8 artifactsDir: '/ci/artifacts',

9 interpreters: {

10 python: '/usr/bin/python3',

11 ruby: '/usr/bin/ruby',

12 node: '/usr/bin/node',

dist/src/yaml/steps/bitrise-ssh.jsView file

39patternName = private_key_rsa severity = critical line = 39 matchedText = ' │ ---...n' +

Critical

Secret Pattern

RSA private key in dist/src/yaml/steps/bitrise-ssh.js

dist/src/yaml/steps/bitrise-ssh.jsView on unpkg · L39

45patternName = private_key_openssh severity = critical line = 45 matchedText = ' │ ---...n' +

Critical

Secret Pattern

OpenSSH private key in dist/src/yaml/steps/bitrise-ssh.js

dist/src/yaml/steps/bitrise-ssh.jsView on unpkg · L45

Source & flagged code

13 flagged · loading source

dist/src/yaml/steps/xcode.jsView file

289patternName = private_key_rsa severity = critical line = 289 matchedText = // Secre...ded.

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/src/yaml/steps/xcode.jsView on unpkg · L289

289patternName = private_key_rsa severity = critical line = 289 matchedText = // Secre...ded.

Critical

Secret Pattern

RSA private key in dist/src/yaml/steps/xcode.js

dist/src/yaml/steps/xcode.jsView on unpkg · L289

dist/src/yaml/fidelity-input-digest.test.jsView file

35const require = createRequire(import.meta.url); L36: const twin = new Function('require', RENDER_SCRIPT_SOURCE_DIGEST_STAGE + L37: '\nreturn { __fidSourceDigest: __fidSourceDigest, __fidIsHermetic: __fidIsHermetic };')(require);

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/src/yaml/fidelity-input-digest.test.jsView on unpkg · L35

14function f(path, content) { L15: return { path, bytes: Buffer.from(content, 'utf8') }; L16: } ... L25: } L26: /** 4-byte big-endian length prefix — mirrors the module-private `len`. */ L27: function len(n) { ... L35: const require = createRequire(import.meta.url); L36: const twin = new Function('require', RENDER_SCRIPT_SOURCE_DIGEST_STAGE + L37: '\nreturn { __fidSourceDigest: __fidSourceDigest, __fidIsHermetic: __fidIsHermetic };')(require);

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/src/yaml/fidelity-input-digest.test.jsView on unpkg · L14

dist/cli.cjsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.cjsView on unpkg

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

dist/cli.cjsView on unpkg · L1

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/cli.cjsView on unpkg · L1

dist/src/yaml/env-resolver.jsView file

8import * as path from 'path'; L9: import { execSync } from 'child_process'; L10: import { SecretsManager } from './secrets-manager.js'; ... L21: ' ┌────────────────────────────────────────────────────────┐\n' + L22: ' │ https://example.com/downloads/myapp-v1.0.0.apk │\n' + L23: ' │ https://appdistribution.firebase.dev/i/abc123 │\n' + ... L235: // Resolve relative path to absolute path L236: const absolutePath = path.resolve(process.cwd(), filePath); L237: // Check if file exists ... L261: // CI Build native variables (FR-9.2) L262: const buildNumber = process.env.BUILD_NUMBER || '1'; L263: const buildUrl = process.env.BUILD_URL || 'https://cibuild.io/builds/1';

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/src/yaml/env-resolver.jsView on unpkg · L8

dist/src/yaml/steps/bitrise-ssh.test.jsView file

26patternName = private_key_rsa severity = critical line = 26 matchedText = SSH_RSA_...--',

Critical

Secret Pattern

RSA private key in dist/src/yaml/steps/bitrise-ssh.test.js

dist/src/yaml/steps/bitrise-ssh.test.jsView on unpkg · L26

39patternName = private_key_rsa severity = critical line = 39 matchedText = SSH_RSA_...--',

Critical

Secret Pattern

RSA private key in dist/src/yaml/steps/bitrise-ssh.test.js

dist/src/yaml/steps/bitrise-ssh.test.jsView on unpkg · L39

159patternName = private_key_rsa severity = critical line = 159 matchedText = SSH_RSA_...----

Critical

Secret Pattern

RSA private key in dist/src/yaml/steps/bitrise-ssh.test.js

dist/src/yaml/steps/bitrise-ssh.test.jsView on unpkg · L159

dist/src/yaml/steps/bitrise-ssh.jsView file

39patternName = private_key_rsa severity = critical line = 39 matchedText = ' │ ---...n' +

Critical

Secret Pattern

RSA private key in dist/src/yaml/steps/bitrise-ssh.js

dist/src/yaml/steps/bitrise-ssh.jsView on unpkg · L39

45patternName = private_key_openssh severity = critical line = 45 matchedText = ' │ ---...n' +

Critical

Secret Pattern

OpenSSH private key in dist/src/yaml/steps/bitrise-ssh.js

dist/src/yaml/steps/bitrise-ssh.jsView on unpkg · L45

Findings

8 Critical3 High3 Medium7 Low

CriticalCritical Secretdist/src/yaml/steps/xcode.js

CriticalPrevious Version Dangerous Deltadist/cli.cjs

CriticalSecret Patterndist/src/yaml/steps/xcode.js

CriticalSecret Patterndist/src/yaml/steps/bitrise-ssh.test.js

CriticalSecret Patterndist/src/yaml/steps/bitrise-ssh.js

HighSandbox Evasion Gated Capabilitydist/src/yaml/env-resolver.js

HighObfuscated Payload Loaderdist/cli.cjs

HighObfuscated

MediumDynamic Requiredist/cli.cjs

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvaldist/src/yaml/fidelity-input-digest.test.js

LowWeak Cryptodist/src/yaml/fidelity-input-digest.test.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

13 flagged

dist/src/yaml/steps/xcode.jsView file

Lines 269-309javascript

269 effectiveXcconfig += '\nCODE_SIGNING_ALLOWED = NO';

270 effectiveXcconfig += '\nCODE_SIGN_IDENTITY = -';

271 }

272 commands.push(`cat > "$XCCONFIG_PATH" << 'XCCONFIG_EOF'`);

273 commands.push(effectiveXcconfig);

274 commands.push('XCCONFIG_EOF');

275 commands.push('');

276 // Detect Apple API key for cloud-managed signing (xcodebuild

277 // -allowProvisioningUpdates). When APPLE_API_KEY_ID/ISSUER_ID/KEY_PATH

278 // are resolved by the env-resolver (from .cibuild-secrets.json or

279 // CIBUILD_SW__* env vars), embed the .p8 into the generated script via

280 // heredoc and bake the IDs as literals. Reading from $APPLE_API_KEY_ID

281 // at script runtime would not work because cibuild's runner only

282 // forwards process.env to spawned scripts, and EnvResolver-decoded

283 // secrets live in its in-memory map, not process.env.

284 let xcodeAuthFlags = '';

285 if (automaticCodeSigning !== 'off') {

286 const apiKeyId = (env['APPLE_API_KEY_ID'] || '').trim();

287 const apiIssuerId = (env['APPLE_API_ISSUER_ID'] || '').trim();

288 const apiKeySecret = env['APPLE_API_KEY_PATH'] || '';

289 // Secret may be raw PEM (`-----BEGIN PRIVATE KEY-----…`) or base64-encoded.

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/src/yaml/steps/xcode.jsView on unpkg · L289

Critical

Secret Pattern

RSA private key in dist/src/yaml/steps/xcode.js

dist/src/yaml/steps/xcode.jsView on unpkg · L289

290 let p8Pem = '';

291 if (apiKeySecret) {

292 if (apiKeySecret.trimStart().startsWith('-----BEGIN')) {

293 p8Pem = apiKeySecret;

294 }

295 else {

296 try {

297 p8Pem = Buffer.from(apiKeySecret, 'base64').toString('utf-8');

298 }

299 catch {

300 p8Pem = '';

301 }

302 }

303 }

304 const p8LooksValid = p8Pem.includes('-----BEGIN') && p8Pem.includes('PRIVATE KEY');

305 if (apiKeyId && apiIssuerId && p8LooksValid) {

306 commands.push('# Apple API key resolved — embedding for cloud-managed signing');

307 // BSD/macOS mktemp requires X's at the end of the template; any chars

308 // after them are literal and not substituted. Don't add a .p8 suffix.

309 commands.push('API_KEY_TEMP_FILE="$(mktemp /tmp/cibuild-api-key.XXXXXX)"');

dist/src/yaml/fidelity-input-digest.test.jsView file

Lines 1-55javascript

1/**

2 * Unit tests for the deterministic per-package input digest.

3 *

4 * The digest is the content key the dashboard matches on to decide whether a

5 * render would be identical to one it already has — so it must be a pure

6 * function of the package's input bytes (wrapper source + reference), stable

7 * across machines/branches, and never derived from paths-as-location, mtimes,

8 * or commit ids.

9 */

10import { describe, test, expect } from '@jest/globals'

dist/cli.cjsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.cjsView on unpkg

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

dist/cli.cjsView on unpkg · L1

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/cli.cjsView on unpkg · L1

dist/src/yaml/env-resolver.jsView file

Lines 1-28javascript

1/**

2 * Environment variable resolution and interpolation

3 * Merges global and workflow-level environment variables

4 * Supports variable interpolation in multiple formats

5 */

6import * as crypto from 'crypto';

7import * as fs from 'fs';

dist/src/yaml/steps/bitrise-ssh.test.jsView file

Lines 6-46javascript

6describe('BitriseSSHStepExecutor', () => {

7 const mockConfig = {

8 artifactsDir: '/ci/artifacts',

9 interpreters: {

10 python: '/usr/bin/python3',

11 ruby: '/usr/bin/ruby',

12 node: '/usr/bin/node',

dist/src/yaml/steps/bitrise-ssh.jsView file

39patternName = private_key_rsa severity = critical line = 39 matchedText = ' │ ---...n' +

Critical

Secret Pattern

RSA private key in dist/src/yaml/steps/bitrise-ssh.js

dist/src/yaml/steps/bitrise-ssh.jsView on unpkg · L39

45patternName = private_key_openssh severity = critical line = 45 matchedText = ' │ ---...n' +

Critical

Secret Pattern

OpenSSH private key in dist/src/yaml/steps/bitrise-ssh.js

dist/src/yaml/steps/bitrise-ssh.jsView on unpkg · L45