registry / @krovacloud/cli / 0.4.0

@krovacloud/cli@0.4.0

Krova Cloud CLI (krova) — manage Cubes (Firecracker microVMs), browse the catalog, and log in, from your terminal.

Static Scan Results

scanned 5h ago · by rust-scanner

Static analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 35.7 KB of source, external domains: krova.cloud

Source & flagged code

2 flagged

dist/index.jsView file

Lines 1-32javascript

1#!/usr/bin/env node

3// src/index.ts

4import { Command as Command10 } from "commander";

6// src/commands/auth.ts

7import { Command } from "commander";

9// src/lib/config.ts

10import { chmodSync, mkdirSync, readFileSync, writeFileSync } from "fs";

11import { homedir } from "os";

12import { dirname, join } from "path";

13var DEFAULT_BASE_URL = "https://krova.cloud/api/v1";

14var DEFAULT_CONTEXT_NAME = "default";

15var ENV = {

16 apiKey: "KROVA_API_KEY",

17 spaceId: "KROVA_SPACE_ID",

18 baseUrl: "KROVA_BASE_URL",

19 context: "KROVA_CONTEXT"

20};

21function configDir() {

22 const xdg = (process.env.XDG_CONFIG_HOME ?? "").trim();

23 if (xdg) return join(xdg, "krova");

24 return join(homedir(), ".config", "krova");

25}

26function configPath() {

27 return join(configDir(), "config.json");

28}

29function load() {

30 let cfg = {};

31 try {

32 cfg = JSON.parse(readFileSync(configPath(), "utf8"));

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L12

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/index.jsView on unpkg · L12

Source & flagged code

2 flagged · loading source

dist/index.jsView file

12import { dirname, join } from "path"; L13: var DEFAULT_BASE_URL = "https://krova.cloud/api/v1"; L14: var DEFAULT_CONTEXT_NAME = "default"; ... L21: function configDir() { L22: const xdg = (process.env.XDG_CONFIG_HOME ?? "").trim(); L23: if (xdg) return join(xdg, "krova"); L24: return join(homedir(), ".config", "krova"); L25: } ... L31: try { L32: cfg = JSON.parse(readFileSync(configPath(), "utf8")); L33: } catch { ... L135: function printJSON(value) {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L12

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/index.jsView on unpkg · L12

Findings

1 High4 Medium4 Low

HighSandbox Evasion Gated Capabilitydist/index.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/index.js

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

dist/index.jsView file

Lines 1-32javascript

1#!/usr/bin/env node

3// src/index.ts

4import { Command as Command10 } from "commander";

6// src/commands/auth.ts

7import { Command } from "commander";

9// src/lib/config.ts

10import { chmodSync, mkdirSync, readFileSync, writeFileSync } from "fs";

11import { homedir } from "os";

12import { dirname, join } from "path";

13var DEFAULT_BASE_URL = "https://krova.cloud/api/v1";

14var DEFAULT_CONTEXT_NAME = "default";

15var ENV = {

16 apiKey: "KROVA_API_KEY",

17 spaceId: "KROVA_SPACE_ID",

18 baseUrl: "KROVA_BASE_URL",

19 context: "KROVA_CONTEXT"

20};

21function configDir() {

22 const xdg = (process.env.XDG_CONFIG_HOME ?? "").trim();

23 if (xdg) return join(xdg, "krova");

24 return join(homedir(), ".config", "krova");

25}

26function configPath() {

27 return join(configDir(), "config.json");

28}

29function load() {

30 let cfg = {};

31 try {

32 cfg = JSON.parse(readFileSync(configPath(), "utf8"));

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L12

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/index.jsView on unpkg · L12