registry / @lizozom/yoto / 0.3.2

@lizozom/yoto@0.3.2

CLI and library for interacting with the Yoto API

Static Scan Results

scanned 16h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

WildcardDependency

scanned 3 file(s), 1.56 MB of source, external domains: 127.0.0.1, api.yotoplay.com, dashboard.yoto.dev, github.com, json-schema.org, login.yotoplay.com

Source & flagged code

5 flagged

dist/lib/index.jsView file

Lines 146-186javascript

146 email: () => email2,

147 e164: () => e1642,

148 discriminatedUnion: () => discriminatedUnion,

149 describe: () => describe2,

150 decodeAsync: () => decodeAsync2,

151 decode: () => decode2,

152 date: () => date3,

153 custom: () => custom,

154 cuid2: () => cuid22,

155 cuid: () => cuid3,

156 core: () => exports_core2,

157 config: () => config,

158 coerce: () => exports_coerce,

159 codec: () => codec,

160 clone: () => clone,

161 cidrv6: () => cidrv62,

162 cidrv4: () => cidrv42,

163 check: () => check,

164 catch: () => _catch2,

165 boolean: () => boolean2,

166 bigint: () => bigint2,

167 base64url: () => base64url2,

168 base64: () => base642,

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/lib/index.jsView on unpkg · L166

169 array: () => array,

170 any: () => any,

171 _function: () => _function,

172 _default: () => _default2,

173 _ZodString: () => _ZodString,

174 ZodXor: () => ZodXor,

175 ZodXID: () => ZodXID,

176 ZodVoid: () => ZodVoid,

177 ZodUnknown: () => ZodUnknown,

178 ZodUnion: () => ZodUnion,

179 ZodUndefined: () => ZodUndefined,

180 ZodUUID: () => ZodUUID,

181 ZodURL: () => ZodURL,

182 ZodULID: () => ZodULID,

183 ZodType: () => ZodType,

184 ZodTuple: () => ZodTuple,

185 ZodTransform: () => ZodTransform,

186 ZodTemplateLiteral: () => ZodTemplateLiteral,

Lines 13940-13980javascript

13940 throw new Error(`Failed to upload file: ${response.status}`);

13941 }

13942 }

13943 async getTranscodedAudio(uploadId) {

13944 return this.apiRequest(`/media/upload/${

Lines 13994-14034javascript

13994 console.log(`✓ ${message}`);

13995}

13996function error48(message) {

13997 console.error(`✗ ${message}`);

13998}

13999function info

dist/cli.jsView file

1229} L1230: const execArgv = process2.execArgv ?? []; L1231: if (execArgv.includes("-e") || execArgv.includes("--eval") || execArgv.includes("-p") || execArgv.includes("--print")) {

High

Shell

Package source references shell execution.

dist/cli.jsView on unpkg · L1229

51Cross-file remote execution chain: dist/cli.js spawns dist/lib/index.js; helper contains network access plus dynamic code execution. L51: class CommanderError extends Error { L52: constructor(exitCode, code, message) { L53: super(message); ... L769: var EventEmitter = __require("node:events").EventEmitter; L770: var childProcess = __require("node:child_process"); L771: var path = __require("node:path"); ... L815: this._outputConfiguration = { L816: writeOut: (str) => process2.stdout.write(str), L817: writeErr: (str) => process2.stderr.write(str), ... L2158: // src/commands/auth.ts L2159: import http from "http"; L2160: import { spawn } from "child_process";

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli.jsView on unpkg · L51

Source & flagged code

5 flagged · loading source

dist/lib/index.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code