registry / @jango-blockchained/hoox-cli / 0.9.4

@jango-blockchained/hoox-cli@0.9.4

⚠ Under review

Hoox CLI — manage Cloudflare Workers, infrastructure, secrets, and deployments (@jango-blockchained/hoox-cli)

Static Scan Results

scanned 6h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 1.33 MB of source, external domains: api.cloudflare.com, api.honeycomb.io, api.telegram.org, bit.ly, bun.sh, dash.cloudflare.com, github.com, json-schema.org, nodejs.org, otel.sentry.io, otlp.grafana.cloud, react.dev, registry.npmjs.org

Source & flagged code

5 flagged

dist/index.jsView file

151uint8ArrayToHex: () => uint8ArrayToHex, L152: uint8ArrayToBase64url: () => uint8ArrayToBase64url, L153: uint8ArrayToBase64: () => uint8ArrayToBase64, ... L1018: error: new (_Err ?? $ZodError)(result.issues.map((iss) => finalizeIssue(iss, ctx, config()))) L1019: } : { success: true, data: result.value }; L1020: }, safeParse, _safeParseAsync = (_Err) => async (schema, value, _ctx) => { ... L2517: try { L2518: new URL(`http://[${payload.value}]`); L2519: } catch { ... L15753: const envConfig = { L15754: apiUrl: process.env.HOOX_API_URL, L15755: apiToken: process.env.HOOX_API_TOKEN

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

dist/index.jsView on unpkg · L151

21487function wrapAnsi(string4, columns, options) { L21488: return String(string4).normalize().split(CRLF_OR_LF).map((line) => exec(line, columns, options)).join(` L21489: `);

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L21487

25779} L25780: const execArgv = process2.execArgv ?? []; L25781: if (execArgv.includes("-e") || execArgv.includes("--eval") || execArgv.includes("-p") || execArgv.includes("--print")) {

High

Shell

Package source references shell execution.

dist/index.jsView on unpkg · L25779

High

Credential Exfiltration

Source combines credential-like environment material and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L151

bin/hoox.jsView file

Lines 11-51javascript

11 * The dev fallback lets contributors and CI jobs that haven't yet run

12 * `bun run build` still execute the CLI directly via `bun bin/hoox.js` or

13 * `hoox` after a `bun link`.

Source & flagged code

5 flagged · loading source

dist/index.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code