registry / @kennyshaw/autopost / 0.2.3

@kennyshaw/autopost@0.2.3

Agent-friendly CLI for local multi-platform video publishing with AutoPost

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 2 file(s), 25.4 KB of source, external domains: astral.sh, pub-2ad7ea477e7d42d39847b6376c82e059.r2.dev

Source & flagged code

4 flagged

bin/autopost.jsView file

Lines 1-22javascript

1#!/usr/bin/env node

3import { spawn } from "node:child_process";

4import { randomBytes } from "node:crypto";

High

Child Process

Package source references child process execution.

bin/autopost.jsView on unpkg · L2

5import fs from "node:fs";

Source & flagged code

4 flagged · loading source

bin/autopost.jsView file

2L3: import { spawn } from "node:child_process"; L4: import { randomBytes } from "node:crypto";

High

Child Process

Package source references child process execution.

bin/autopost.jsView on unpkg · L2

250const stderr = fs.openSync(path.join(logDir, "runner-error.log"), "a"); L251: const command = runnerExecutable && process.platform === "win32" ? "cmd.exe" : runnerExecutable || process.execPath; L252: const commandArgs = runnerExecutable

High

Shell

Package source references shell execution.

bin/autopost.jsView on unpkg · L250

src/runtime-installer.jsView file

42const candidates = [ L43: process.env.AUTOPOST_UV_BIN, L44: path.join(home, "tools", "bin", "uv"), ... L55: const installer = path.join(home, "downloads", "uv-install.sh"); L56: execFileSync("curl", ["-LsSf", "https://astral.sh/uv/install.sh", "-o", installer], { stdio: "inherit" }); L57: execFileSync("/bin/sh", [installer], {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

src/runtime-installer.jsView on unpkg · L42

1import { execFileSync } from "node:child_process"; L2: import { createHash } from "node:crypto"; ... L8: L9: export const DEFAULT_RELEASE_MANIFEST_URL = "https://pub-[redacted].r2.dev/stable.json"; L10: L11: function platformKey() { L12: return `${process.platform}-${process.arch}`; L13: } ... L21: if (command.includes(path.sep)) return fs.existsSync(command); L22: return (process.env.PATH || "").split(path.delimiter).some((entry) => fs.existsSync(path.join(entry, command))); L23: } ... L27: if (!response.ok) throw new Error(`Unable to fetch AutoPost release manifest: HTTP ${response.status}`);

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

src/runtime-installer.jsView on unpkg · L1

Findings

4 High3 Medium4 Low

HighChild Processbin/autopost.js

HighShellbin/autopost.js

HighSame File Env Network Executionsrc/runtime-installer.js

HighSandbox Evasion Gated Capabilitysrc/runtime-installer.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Lines 230-270javascript

230 throw error;

231 }

232 return final;

233}

234

235async function startRunner() {

236 const config = readConfig();

237 const running = await health(config);

238 if (running) {

239 const compatibility = runnerCompatibility(running);

240 if (!compatibility.ok) throw new Error(compatibility.issue);

241 return { already_running: true, health: running };

242 }

243 const runnerExecutable = config.runner_executable && fs.existsSync(config.runner_executable) ? config.runner_executable : null;

244 if (!runnerExecutable && (!config.runner_entry || !fs.existsSync(config.runner_entry))) {

245 throw new Error(`Runner executable or entry was not found. Run \`autopost setup\` again.`);

246 }

247 const logDir = config.log_dir || path.join(autopostHome(), "logs");

248 fs.mkdirSync(logDir, { recursive: true, mode: 0o700 });

249 const stdout = fs.openSync(path.join(logDir, "runner.log"), "a");

250 const stderr = fs.openSync(path.join(logDir, "runner-error.log"), "a");

251 const command = runnerExecutable && process.platform === "win32" ? "cmd.exe" : runnerExecutable || process.execPath;

252 const commandArgs = runnerExecutable

High

Shell

Package source references shell execution.

bin/autopost.jsView on unpkg · L250

253 ? process.platform === "win32" ? ["/d", "/s", "/c", runnerExecutable] : []

254 : [config.runner_entry];

255 const child = spawn(command, commandArgs, {

256 cwd: runnerExecutable ? path.dirname(runnerExecutable) : path.dirname(config.runner_entry),

257 env: {

258 ...process.env,

259 AUTOPOST_HOME: autopostHome(),

260 AUTOPOST_RUNTIME_DIR: config.runtime_dir,

261 AUTOPOST_ACCOUNT_DIR: config.account_dir,

262 AUTOPOST_SAU_BIN: config.sau_bin,

263 AUTOPOST_SAU_CWD: config.sau_cwd,

264 },

265 detached: true,

266 stdio: ["ignore", stdout, stderr],

267 });

268 child.unref();

269 fs.closeSync(stdout);

270 fs.closeSync(stderr);

src/runtime-installer.jsView file

Lines 1-62javascript

1import { execFileSync } from "node:child_process";

2import { createHash } from "node:crypto";

3import fs from "node:fs";

4import os from "node:os";

5import path from "node:path";

6import { Readable } from "node:stream";

7import { pipeline } from "node:stream/promises";

9export const DEFAULT_RELEASE_MANIFEST_URL = "https://pub-2ad7ea477e7d42d39847b6376c82e059.r2.dev/stable.json";

11function platformKey() {

12 return `${process.platform}-${process.arch}`;

13}

15function executable(root, relative) {

16 return path.join(root, ...relative.split("/"));

17}

19function commandExists(command) {

20 if (!command) return false;

21 if (command.includes(path.sep)) return fs.existsSync(command);

22 return (process.env.PATH || "").split(path.delimiter).some((entry) => fs.existsSync(path.join(entry, command)));

23}

25async function fetchJson(url) {

26 const response = await fetch(url, { signal: AbortSignal.timeout(30_000), headers: { "user-agent": "autopost-cli" } });

27 if (!response.ok) throw new Error(`Unable to fetch AutoPost release manifest: HTTP ${response.status}`);

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

src/runtime-installer.jsView on unpkg · L1

28 return response.json();

29}

31async function download(url, destination) {

32 const response = await fetch(url, { signal: AbortSignal.timeout(10 * 60_000), headers: { "user-agent": "autopost-cli" } });

33 if (!response.ok || !response.body) throw new Error(`Unable to download AutoPost Runtime: HTTP ${response.status}`);

34 await pipeline(Readable.fromWeb(response.body), fs.createWriteStream(destination, { mode: 0o600 }));

35}

37function sha256(filePath) {

38 return createHash("sha256").update(fs.readFileSync(filePath)).digest("hex");

39}

41function installUv(home, progress) {

42 const candidates = [

43 process.env.AUTOPOST_UV_BIN,

44 path.join(home, "tools", "bin", "uv"),

45 path.join(os.homedir(), ".local", "bin", "uv"),

46 "uv",

47 ].filter(Boolean);

48 const existing = candidates.find(commandExists);

49 if (existing) return existing;

50 if (process.platform !== "darwin") throw new Error("Automatic uv installation currently supports Apple Silicon macOS only.");

52 progress("Installing uv and managed Python support");

53 const toolsBin = path.join(home, "tools", "bin");

54 fs.mkdirSync(toolsBin, { recursive: true, mode: 0o700 });

55 const installer = path.join(home, "downloads", "uv-install.sh");

56 execFileSync("curl", ["-LsSf", "https://astral.sh/uv/install.sh", "-o", installer], { stdio: "inherit" });

57 execFileSync("/bin/sh", [installer], {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

src/runtime-installer.jsView on unpkg · L42

58 env: { ...process.env, UV_INSTALL_DIR: toolsBin, UV_NO_MODIFY_PATH: "1" },

59 stdio: "inherit",

60 });

61 const installed = path.join(toolsBin, "uv");

62 if (!fs.existsSync(installed)) throw new Error("uv installer completed without creating the expected executable.");