registry / @itznexus/itznexus-cli / 1.33.0

@itznexus/itznexus-cli@1.33.0

⚠ Under review

ITzNexus CLI: operational commands for ITzWorking

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 54 file(s), 400 KB of source, external domains: api.itznex.us, github.com, www.upwork.com

Source & flagged code

3 flagged

dist/lib/auto-update.jsView file

Lines 1-23javascript

1import fs from "node:fs";

2import path from "node:path";

3import os from "node:os";

4import { execSync } from "node:child_process";

5import { fileURLToPath } from "node:url";

High

Child Process

Package source references child process execution.

dist/lib/auto-update.jsView on unpkg · L3

6const __dirname = path.dirname(fileURLToPath(import.meta.url));

7const PKG_ROOT = path.resolve(__dirname, "..", "..");

8const CACHE_DIR = path.join(os.homedir(), ".itznexus");

9const CACHE_FILE = path.join(CACHE_DIR, "last-update-check");

10const CHECK_INTERVAL_MS = 60 * 60 * 1000; // 1 hour

11const PKG_NAME = "@itznexus/itznexus-cli";

12/**

13 * Running from source via npm link — .git exists in the package root.

14 * In this case, skip auto-update entirely.

15 */

16function isDevMode() {

17 try {

18 fs.statSync(path.join(PKG_ROOT, ".git"));

19 return true;

20 }

21 catch {

22 return false;

23 }

Lines 39-79javascript

39function saveCheckTime() {

40 if (!fs.existsSync(CACHE_DIR)) {

41 fs.mkdirSync(CACHE_DIR, { recursive: true });

42 }

43 fs.writeFileSync(CACHE_FILE, String(Date.now()));

44}

45function getLatestVersion

dist/commands/api/projects.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @itznexus/itznexus-cli@1.23.0 matchedIdentity = npm:QGl0em5leHVzL2l0em5leHVzLWNsaQ:1.23.0 similarity = 0.698 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/commands/api/projects.jsView on unpkg

Source & flagged code

3 flagged · loading source

dist/lib/auto-update.jsView file

3import os from "node:os"; L4: import { execSync } from "node:child_process"; L5: import { fileURLToPath } from "node:url";

High

Child Process

Package source references child process execution.

dist/lib/auto-update.jsView on unpkg · L3

59try { L60: execSync(`npm install -g ${PKG_NAME}@latest`, { L61: timeout: 60_000,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/lib/auto-update.jsView on unpkg · L59

dist/commands/api/projects.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/commands/api/projects.jsView on unpkg

Findings

1 Critical3 High3 Medium6 Low

CriticalPrevious Version Dangerous Deltadist/commands/api/projects.js

HighChild Processdist/lib/auto-update.js

HighShell

HighRuntime Package Installdist/lib/auto-update.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

3 flagged

dist/lib/auto-update.jsView file

Lines 1-23javascript

1import fs from "node:fs";

2import path from "node:path";

3import os from "node:os";

4import { execSync } from "node:child_process";

5import { fileURLToPath } from "node:url";

High

Child Process

Package source references child process execution.

dist/lib/auto-update.jsView on unpkg · L3

6const __dirname = path.dirname(fileURLToPath(import.meta.url));

7const PKG_ROOT = path.resolve(__dirname, "..", "..");

8const CACHE_DIR = path.join(os.homedir(), ".itznexus");

9const CACHE_FILE = path.join(CACHE_DIR, "last-update-check");

10const CHECK_INTERVAL_MS = 60 * 60 * 1000; // 1 hour

11const PKG_NAME = "@itznexus/itznexus-cli";

12/**

13 * Running from source via npm link — .git exists in the package root.

14 * In this case, skip auto-update entirely.

15 */

16function isDevMode() {

17 try {

18 fs.statSync(path.join(PKG_ROOT, ".git"));

19 return true;

20 }

21 catch {

22 return false;

23 }

Lines 39-79javascript

39function saveCheckTime() {

40 if (!fs.existsSync(CACHE_DIR)) {

41 fs.mkdirSync(CACHE_DIR, { recursive: true });

42 }

43 fs.writeFileSync(CACHE_FILE, String(Date.now()));

44}

45function getLatestVersion

dist/commands/api/projects.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/commands/api/projects.jsView on unpkg