registry / @krovacloud/cli / 0.5.2

@krovacloud/cli@0.5.2

Krova Cloud CLI (krova) — manage Cubes (Firecracker microVMs), browse the catalog, and log in, from your terminal.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 44.5 KB of source, external domains: krova.cloud

Source & flagged code

4 flagged

dist/index.jsView file

Lines 1-32javascript

1#!/usr/bin/env node

3// src/index.ts

4import { Command as Command13 } from "commander";

6// src/commands/auth.ts

7import { Command } from "commander";

9// src/lib/config.ts

10import { chmodSync, mkdirSync, readFileSync, writeFileSync } from "fs";

11import { homedir } from "os";

12import { dirname, join } from "path";

13var DEFAULT_BASE_URL = "https://krova.cloud/api/v1";

14var DEFAULT_CONTEXT_NAME = "default";

15var ENV = {

16 apiKey: "KROVA_API_KEY",

17 spaceId: "KROVA_SPACE_ID",

18 baseUrl: "KROVA_BASE_URL",

19 context: "KROVA_CONTEXT"

20};

21function configDir() {

22 const xdg = (process.env.XDG_CONFIG_HOME ?? "").trim();

23 if (xdg) return join(xdg, "krova");

24 return join(homedir(), ".config", "krova");

25}

26function configPath() {

27 return join(configDir(), "config.json");

28}

29function load() {

30 let cfg = {};

31 try {

32 cfg = JSON.parse(readFileSync(configPath(), "utf8"));

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L12

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/index.jsView on unpkg · L12

Lines 689-736javascript

689 cmd.command("add").argument("<cube>", "cube name or ID").requiredOption("--domain <domain>", "the domain name to attach").requiredOption("--port <n>", "the in-Cube port to route to").description("attach a custom domain to a Cube").action(async (cubeRef, opts, c) => {

690 const

Source & flagged code

4 flagged · loading source

dist/index.jsView file

716// src/commands/login.ts L717: import { spawn } from "child_process"; L718: import { Command as Command6 } from "commander";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L716

709if (rt.json) return printJSON({ id: mappingId, result: "detached" }); L710: process.stdout.write(`Detached domain ${mappingId} L711: `); ... L716: // src/commands/login.ts L717: import { spawn } from "child_process"; L718: import { Command as Command6 } from "commander"; L719: var BROWSER_UNAVAILABLE = "Browser login isn't enabled on this server yet \u2014 run `krova auth login` to paste an API key from https://krova.cloud"; L720: function safeBrowserURL(raw) {

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L709

12import { dirname, join } from "path"; L13: var DEFAULT_BASE_URL = "https://krova.cloud/api/v1"; L14: var DEFAULT_CONTEXT_NAME = "default"; ... L21: function configDir() { L22: const xdg = (process.env.XDG_CONFIG_HOME ?? "").trim(); L23: if (xdg) return join(xdg, "krova"); L24: return join(homedir(), ".config", "krova"); L25: } ... L31: try { L32: cfg = JSON.parse(readFileSync(configPath(), "utf8")); L33: } catch { ... L135: function printJSON(value) {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L12

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/index.jsView on unpkg · L12

Findings

4 High4 Medium4 Low

HighChild Processdist/index.js

HighShell

HighCommand Output Exfiltrationdist/index.js

HighSandbox Evasion Gated Capabilitydist/index.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/index.js

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

dist/index.jsView file

Lines 1-32javascript

1#!/usr/bin/env node

3// src/index.ts

4import { Command as Command13 } from "commander";

6// src/commands/auth.ts

7import { Command } from "commander";

9// src/lib/config.ts

10import { chmodSync, mkdirSync, readFileSync, writeFileSync } from "fs";

11import { homedir } from "os";

12import { dirname, join } from "path";

13var DEFAULT_BASE_URL = "https://krova.cloud/api/v1";

14var DEFAULT_CONTEXT_NAME = "default";

15var ENV = {

16 apiKey: "KROVA_API_KEY",

17 spaceId: "KROVA_SPACE_ID",

18 baseUrl: "KROVA_BASE_URL",

19 context: "KROVA_CONTEXT"

20};

21function configDir() {

22 const xdg = (process.env.XDG_CONFIG_HOME ?? "").trim();

23 if (xdg) return join(xdg, "krova");

24 return join(homedir(), ".config", "krova");

25}

26function configPath() {

27 return join(configDir(), "config.json");

28}

29function load() {

30 let cfg = {};

31 try {

32 cfg = JSON.parse(readFileSync(configPath(), "utf8"));

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L12

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/index.jsView on unpkg · L12

Lines 689-736javascript

690 const