registry  /  @invarn/cli  /  0.9.37

@invarn/cli@0.9.37

Invarn CLI — run builds, check artifacts, and ship from your terminal

Static Scan Results

scanned 11d ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork
Supply chain
HighEntropyStringsMinifiedObfuscatedUrlStrings
ManifestNo manifest risk signals triggered.
scanned 3 file(s), 2.17 MB of source, external domains: json-schema.org, raw.githubusercontent.com

Source & flagged code

5 flagged · loading source
dist/sdk.mjsView file
6depsCount: ${_0x347287}, L7: deps: ${_0x1f067a}}`};var _0x3c0b2c={'keyword':_0x3f1ff5(0x126),'type':_0x3f1ff5(0x553),'schemaType':_0x3f1ff5(0x553),'error':_0x1c9132['error'],'code'(_0x259c31){let [_0x3a8b06,_0...
High
Child Process

Package source references child process execution.

dist/sdk.mjsView on unpkg · L6
dist/invarn.cjsView file
1#!/usr/bin/env node L2: const _0x4d19ca=_0x4ca3;(function(_0x400360,_0x17c531){const _0x3b0bf4=_0x4ca3,_0x1389d9=_0x400360();while(!![]){try{const _0x2564d4=-parseInt(_0x3b0bf4(0xca3))/0x1*(-parseInt(_0x3... L3: || (${_0x4e5d6a} == "string" && ${_0x5c83f2} && ${_0x5c83f2} == +${_0x5c83f2})`)[_0x4cf3fc(0x230)](_0x512871,(0x0,_0x34d248['_'])`+${_0x5c83f2}`);return;case _0x4cf3fc(0x199):_0x2c... L4: || (${_0x4e5d6a} === "string" && ${_0x5c83f2} && ${_0x5c83f2} == +${_0x5c83f2} && !(${_0x5c83f2} % 1))`)[_0x4cf3fc(0x230)](_0x512871,(0x0,_0x34d248['_'])`+${_0x5c83f2}`);return;cas... L5: || ${_0x4e5d6a} === "boolean" || ${_0x5c83f2} === null`)[_0x4cf3fc(0x230)](_0x512871,(0x0,_0x34d248['_'])`[${_0x5c83f2}]`);}}}function _0x3ca883({gen:_0x25f678,parentData:_0x195ad0... L6: missingProperty: ${_0x34e810},
High
Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/invarn.cjsView on unpkg · L1
1#!/usr/bin/env node L2: const _0x4d19ca=_0x4ca3;(function(_0x400360,_0x17c531){const _0x3b0bf4=_0x4ca3,_0x1389d9=_0x400360();while(!![]){try{const _0x2564d4=-parseInt(_0x3b0bf4(0xca3))/0x1*(-parseInt(_0x3... L3: || (${_0x4e5d6a} == "string" && ${_0x5c83f2} && ${_0x5c83f2} == +${_0x5c83f2})`)[_0x4cf3fc(0x230)](_0x512871,(0x0,_0x34d248['_'])`+${_0x5c83f2}`);return;case _0x4cf3fc(0x199):_0x2c...
High
Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

dist/invarn.cjsView on unpkg · L1
1#!/usr/bin/env node L2: const _0x4d19ca=_0x4ca3;(function(_0x400360,_0x17c531){const _0x3b0bf4=_0x4ca3,_0x1389d9=_0x400360();while(!![]){try{const _0x2564d4=-parseInt(_0x3b0bf4(0xca3))/0x1*(-parseInt(_0x3... L3: || (${_0x4e5d6a} == "string" && ${_0x5c83f2} && ${_0x5c83f2} == +${_0x5c83f2})`)[_0x4cf3fc(0x230)](_0x512871,(0x0,_0x34d248['_'])`+${_0x5c83f2}`);return;case _0x4cf3fc(0x199):_0x2c...
Medium
Dynamic Require

Package source references dynamic require/import behavior.

dist/invarn.cjsView on unpkg · L1
4|| (${_0x4e5d6a} === "string" && ${_0x5c83f2} && ${_0x5c83f2} == +${_0x5c83f2} && !(${_0x5c83f2} % 1))`)[_0x4cf3fc(0x230)](_0x512871,(0x0,_0x34d248['_'])`+${_0x5c83f2}`);return;cas... L5: || ${_0x4e5d6a} === "boolean" || ${_0x5c83f2} === null`)[_0x4cf3fc(0x230)](_0x512871,(0x0,_0x34d248['_'])`[${_0x5c83f2}]`);}}}function _0x3ca883({gen:_0x25f678,parentData:_0x195ad0... L6: missingProperty: ${_0x34e810},
Low
Eval

Package source references a known benign dynamic code generation pattern.

dist/invarn.cjsView on unpkg · L4

Findings

4 High4 Medium6 Low
HighChild Processdist/sdk.mjs
HighSame File Env Network Executiondist/invarn.cjs
HighObfuscated Payload Loaderdist/invarn.cjs
HighObfuscated
MediumDynamic Requiredist/invarn.cjs
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvaldist/invarn.cjs
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings