registry / @mailkite/cli / 0.13.0

@mailkite/cli@0.13.0

MailKite command-line client — sign in, add domains, set DNS + webhooks, send mail, and tail inbound messages from your terminal. Built on the MailKite Node SDK.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 30.3 KB of source, external domains: api.mailkite.dev

Source & flagged code

2 flagged

cli.mjsView file

Lines 1-35javascript

1#!/usr/bin/env node

2// MailKite CLI — a wrangler-style terminal client for MailKite.

3//

4// It is a thin layer over the MailKite Node SDK (sdks/node): every network call

5// goes through the `MailKite` class, so auth, base URL, and error handling stay

6// in one place. Auth/token storage and the interactive flows are the CLI's own.

7//

8// Designed to be fully scriptable for AI agents: every command works from flags

9// + env with no prompts (prompts only appear as a fallback on an interactive TTY),

10// and every data command supports `--json` for machine-readable output.

12import { readFileSync, writeFileSync, mkdirSync, existsSync } from "node:fs";

13import { homedir } from "node:os";

14import path from "node:path";

15import readline from "node:readline";

16import { spawn } from "node:child_process";

17import { MailKite, MailKiteError } from "mailkite";

High

Child Process

Package source references child process execution.

cli.mjsView on unpkg · L15

19// Read from the package manifest so `--version` never drifts from the published version.

20// npm always ships package.json in the tarball (even though `files` doesn't list it), and it

21// sits next to this script, so this resolves both in-repo and when installed.

22const VERSION = JSON.parse(readFileSync(new URL("./package.json", import.meta.url), "utf8")).version;

23const CONFIG_DIR = path.join(homedir(), ".mailkite");

24const CONFIG_FILE = path.join(CONFIG_DIR, "config.json");

25const DEFAULT_BASE_URL = "https://api.mailkite.dev";

27// ---- tiny arg parser --------------------------------------------------------

28// Supports: positionals, --flag, --key value, --key=value, -h/-v shortcuts.

29function parseArgs(argv) {

30 const _ = [];

31 const flags = {};

32 for (let i = 0; i < argv.length; i++) {

33 const a = argv[i];

34 if (a === "-h") { flags.help = true; continue; }

35 if (a === "-v") { flags.version = true; continue; }

Lines 484-524javascript

484

485// Verify an x-mailkite-signature header locally (no network) via the SDK helper.

486commands["verify-webhook"] = async ({ flags }) => {

487 const signature = await need(flags.signature, "signature", "x-mailkite-signature value: ");

488 const secret = await

Source & flagged code

2 flagged · loading source

cli.mjsView file

15import readline from "node:readline"; L16: import { spawn } from "node:child_process"; L17: import { MailKite, MailKiteError } from "mailkite";

High

Child Process

Package source references child process execution.

cli.mjsView on unpkg · L15

504env.MAILKITE_BASE_URL = resolveBaseUrl(flags); L505: const child = spawn("npx", ["-y", "@mailkite/mcp"], { stdio: "inherit", env }); L506: await new Promise((resolve) => child.on("exit", (code) => { process.exitCode = code ?? 0; resolve(); }));

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

cli.mjsView on unpkg · L504

Findings

3 High2 Medium4 Low

HighChild Processcli.mjs

HighShell

HighRuntime Package Installcli.mjs

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

cli.mjsView file

Lines 1-35javascript

1#!/usr/bin/env node

2// MailKite CLI — a wrangler-style terminal client for MailKite.

3//

4// It is a thin layer over the MailKite Node SDK (sdks/node): every network call

5// goes through the `MailKite` class, so auth, base URL, and error handling stay

6// in one place. Auth/token storage and the interactive flows are the CLI's own.

7//

8// Designed to be fully scriptable for AI agents: every command works from flags

9// + env with no prompts (prompts only appear as a fallback on an interactive TTY),

10// and every data command supports `--json` for machine-readable output.

12import { readFileSync, writeFileSync, mkdirSync, existsSync } from "node:fs";

13import { homedir } from "node:os";

14import path from "node:path";

15import readline from "node:readline";

16import { spawn } from "node:child_process";

17import { MailKite, MailKiteError } from "mailkite";

High

Child Process

Package source references child process execution.

cli.mjsView on unpkg · L15

19// Read from the package manifest so `--version` never drifts from the published version.

20// npm always ships package.json in the tarball (even though `files` doesn't list it), and it

21// sits next to this script, so this resolves both in-repo and when installed.

22const VERSION = JSON.parse(readFileSync(new URL("./package.json", import.meta.url), "utf8")).version;

23const CONFIG_DIR = path.join(homedir(), ".mailkite");

24const CONFIG_FILE = path.join(CONFIG_DIR, "config.json");

25const DEFAULT_BASE_URL = "https://api.mailkite.dev";

27// ---- tiny arg parser --------------------------------------------------------

28// Supports: positionals, --flag, --key value, --key=value, -h/-v shortcuts.

29function parseArgs(argv) {

30 const _ = [];

31 const flags = {};

32 for (let i = 0; i < argv.length; i++) {

33 const a = argv[i];

34 if (a === "-h") { flags.help = true; continue; }

35 if (a === "-v") { flags.version = true; continue; }

Lines 484-524javascript

484

485// Verify an x-mailkite-signature header locally (no network) via the SDK helper.

486commands["verify-webhook"] = async ({ flags }) => {

487 const signature = await need(flags.signature, "signature", "x-mailkite-signature value: ");

488 const secret = await