registry / @krovacloud/cli / 0.5.3

@krovacloud/cli@0.5.3

Krova Cloud CLI (krova) — manage Cubes (Firecracker microVMs), browse the catalog, and log in, from your terminal.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 44.6 KB of source, external domains: krova.cloud

Source & flagged code

4 flagged

dist/index.jsView file

Lines 1-32javascript

1#!/usr/bin/env node

3// src/index.ts

4import { Command as Command13 } from "commander";

6// src/commands/auth.ts

7import { Command } from "commander";

9// src/lib/config.ts

10import { chmodSync, mkdirSync, readFileSync, writeFileSync } from "fs";

11import { homedir } from "os";

12import { dirname, join } from "path";

13var DEFAULT_BASE_URL = "https://krova.cloud/api/v1";

14var DEFAULT_CONTEXT_NAME = "default";

15var ENV = {

16 apiKey: "KROVA_API_KEY",

17 spaceId: "KROVA_SPACE_ID",

18 baseUrl: "KROVA_BASE_URL",

19 context: "KROVA_CONTEXT"

20};

21function configDir() {

22 const xdg = (process.env.XDG_CONFIG_HOME ?? "").trim();

23 if (xdg) return join(xdg, "krova");

24 return join(homedir(), ".config", "krova");

25}

26function configPath() {

27 return join(configDir(), "config.json");

28}

29function load() {

30 let cfg = {};

31 try {

32 cfg = JSON.parse(readFileSync(configPath(), "utf8"));

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L12

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/index.jsView on unpkg · L12

Lines 691-738javascript

691 cmd.command("add").argument("<cube>", "cube name or ID").requiredOption("--domain <domain>", "the domain name to attach").requiredOption("--port <n>", "the in-Cube port to route to").description("attach a custom domain to a Cube").action(async (

Source & flagged code

4 flagged · loading source

dist/index.jsView file

718// src/commands/login.ts L719: import { spawn } from "child_process"; L720: import { Command as Command6 } from "commander";

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code