registry / @itznexus/itznexus-cli / 1.23.0

@itznexus/itznexus-cli@1.23.0

ITzNexus CLI: operational commands for ITzWorking

Static Scan Results

scanned 5d ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 43 file(s), 277 KB of source, external domains: api.itznex.us, github.com, www.upwork.com

Source & flagged code

2 flagged

dist/lib/auto-update.jsView file

Lines 1-23javascript

1import fs from "node:fs";

2import path from "node:path";

3import os from "node:os";

4import { execSync } from "node:child_process";

5import { fileURLToPath } from "node:url";

High

Child Process

Package source references child process execution.

dist/lib/auto-update.jsView on unpkg · L3

6const __dirname = path.dirname(fileURLToPath(import.meta.url));

7const PKG_ROOT = path.resolve(__dirname, "..", "..");

8const CACHE_DIR = path.join(os.homedir(), ".itznexus");

9const CACHE_FILE = path.join(CACHE_DIR, "last-update-check");

10const CHECK_INTERVAL_MS = 60 * 60 * 1000; // 1 hour

11const PKG_NAME = "@itznexus/itznexus-cli";

12/**

13 * Running from source via npm link — .git exists in the package root.

14 * In this case, skip auto-update entirely.

15 */

16function isDevMode() {

17 try {

18 fs.statSync(path.join(PKG_ROOT, ".git"));

19 return true;

20 }

21 catch {

22 return false;

23 }

Lines 39-79javascript

39function saveCheckTime() {

40 if (!fs.existsSync(CACHE_DIR)) {

41 fs.mkdirSync(CACHE_DIR, { recursive: true });

42 }

43 fs.writeFileSync(CACHE_FILE, String(Date.now()));

44}

45function getLatestVersion

Source & flagged code

2 flagged · loading source

dist/lib/auto-update.jsView file

3import os from "node:os"; L4: import { execSync } from "node:child_process"; L5: import { fileURLToPath } from "node:url";

High

Child Process

Package source references child process execution.

dist/lib/auto-update.jsView on unpkg · L3

59try { L60: execSync(`npm install -g ${PKG_NAME}@latest`, { L61: timeout: 60_000,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/lib/auto-update.jsView on unpkg · L59

Findings

3 High3 Medium6 Low

HighChild Processdist/lib/auto-update.js

HighShell

HighRuntime Package Installdist/lib/auto-update.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

2 flagged

dist/lib/auto-update.jsView file

Lines 1-23javascript

1import fs from "node:fs";

2import path from "node:path";

3import os from "node:os";

4import { execSync } from "node:child_process";

5import { fileURLToPath } from "node:url";

High

Child Process

Package source references child process execution.

dist/lib/auto-update.jsView on unpkg · L3

6const __dirname = path.dirname(fileURLToPath(import.meta.url));

7const PKG_ROOT = path.resolve(__dirname, "..", "..");

8const CACHE_DIR = path.join(os.homedir(), ".itznexus");

9const CACHE_FILE = path.join(CACHE_DIR, "last-update-check");

10const CHECK_INTERVAL_MS = 60 * 60 * 1000; // 1 hour

11const PKG_NAME = "@itznexus/itznexus-cli";

12/**

13 * Running from source via npm link — .git exists in the package root.

14 * In this case, skip auto-update entirely.

15 */

16function isDevMode() {

17 try {

18 fs.statSync(path.join(PKG_ROOT, ".git"));

19 return true;

20 }

21 catch {

22 return false;

23 }

Lines 39-79javascript

39function saveCheckTime() {

40 if (!fs.existsSync(CACHE_DIR)) {

41 fs.mkdirSync(CACHE_DIR, { recursive: true });

42 }

43 fs.writeFileSync(CACHE_FILE, String(Date.now()));

44}

45function getLatestVersion