registry / @modelgov/cli / 1.7.1

@modelgov/cli@1.7.1

Modelgov CLI for setup, operations, validation, and policy decisions.

Static Scan Results

scanned 1h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 53.8 KB of source, external domains: 127.0.0.1

Source & flagged code

3 flagged

dist/index.jsView file

Lines 392-436javascript

392 return;

393 }

394 case "revoke": {

395 const id = requireId(args[1]);

396 await client.postJson(`/v1/admin/keys/${id}/revoke`);

397 console.log(`Revoked key ${id}.`);

398 return;

399 }

400 default:

401 throw new Error(`Unknown keys subcommand: ${sub}`);

402 }

403}

404function requireId(id) {

405 if (!id || id.startsWith("--")) throw new Error("a key id is required");

406 return id;

407}

408

409// src/ops.ts

410import { deployProfileChecks as deployProfileChecks2, PROVIDER_REGISTRY } from "@modelgov/policy-engine";

411import { copyFileSync, existsSync as existsSync2, readFileSync as readFileSync3, unlinkSync } from "fs";

412import { basename, resolve as resolve2 } from "path";

413import { spawn as spawn2 } from "child_process";

414import { parse as parseYaml } from "yaml";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L412

415

416// src/browserOpen.ts

417import { spawn } from "child_process";

418var DEFAULT_CONSOLE_PORT = 5174;

419function buildAutoconnectConsoleUrl(apiUrl, apiKey, consolePort = DEFAULT_CONSOLE_PORT) {

420 const params = new URLSearchParams({ url: apiUrl, token: apiKey });

421 return `http://localhost:${consolePort}/login?${params.toString()}`;

422}

423function browserOpenCommand(platform, url) {

424 if (platform === "darwin") return { cmd: "open", args: [url] };

425 if (platform === "win32") return { cmd: "cmd", args: ["/c", "start", "", url] };

426 return { cmd: "xdg-open", args: [url] };

427}

428function maybeOpenBrowser(url) {

429 if (process.env.CI || process.env.MODELGOV_NO_OPEN || !process.stdout.isTTY) return false;

430 try {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L416

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L416

431 const { cmd, args } = browserOpenCommand(process.platform, url);

432 const child = spawn(cmd, args, { stdio: "ignore", detached: true });

433 child.on("error", () => {

434 });

435 child.unref();

436 return true;

Source & flagged code

3 flagged · loading source

dist/index.jsView file

412import { basename, resolve as resolve2 } from "path"; L413: import { spawn as spawn2 } from "child_process"; L414: import { parse as parseYaml } from "yaml";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L412

416// src/browserOpen.ts L417: import { spawn } from "child_process"; L418: var DEFAULT_CONSOLE_PORT = 5174; ... L420: const params = new URLSearchParams({ url: apiUrl, token: apiKey }); L421: return `http://localhost:${consolePort}/login?${params.toString()}`; L422: } ... L428: function maybeOpenBrowser(url) { L429: if (process.env.CI || process.env.MODELGOV_NO_OPEN || !process.stdout.isTTY) return false; L430: try {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L416

416// src/browserOpen.ts L417: import { spawn } from "child_process"; L418: var DEFAULT_CONSOLE_PORT = 5174; L419: function buildAutoconnectConsoleUrl(apiUrl, apiKey, consolePort = DEFAULT_CONSOLE_PORT) { L420: const params = new URLSearchParams({ url: apiUrl, token: apiKey }); L421: return `http://localhost:${consolePort}/login?${params.toString()}`; L422: } ... L428: function maybeOpenBrowser(url) { L429: if (process.env.CI || process.env.MODELGOV_NO_OPEN || !process.stdout.isTTY) return false; L430: try {

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L416

Findings

4 High2 Medium4 Low

HighChild Processdist/index.js

HighShell

HighSame File Env Network Executiondist/index.js

HighCommand Output Exfiltrationdist/index.js

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

dist/index.jsView file

Lines 392-436javascript

392 return;

393 }

394 case "revoke": {

395 const id = requireId(args[1]);

396 await client.postJson(`/v1/admin/keys/${id}/revoke`);

397 console.log(`Revoked key ${id}.`);

398 return;

399 }

400 default:

401 throw new Error(`Unknown keys subcommand: ${sub}`);

402 }

403}

404function requireId(id) {

405 if (!id || id.startsWith("--")) throw new Error("a key id is required");

406 return id;

407}

408

409// src/ops.ts

410import { deployProfileChecks as deployProfileChecks2, PROVIDER_REGISTRY } from "@modelgov/policy-engine";

411import { copyFileSync, existsSync as existsSync2, readFileSync as readFileSync3, unlinkSync } from "fs";

412import { basename, resolve as resolve2 } from "path";

413import { spawn as spawn2 } from "child_process";

414import { parse as parseYaml } from "yaml";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L412

415

416// src/browserOpen.ts

417import { spawn } from "child_process";

418var DEFAULT_CONSOLE_PORT = 5174;

419function buildAutoconnectConsoleUrl(apiUrl, apiKey, consolePort = DEFAULT_CONSOLE_PORT) {

420 const params = new URLSearchParams({ url: apiUrl, token: apiKey });

421 return `http://localhost:${consolePort}/login?${params.toString()}`;

422}

423function browserOpenCommand(platform, url) {

424 if (platform === "darwin") return { cmd: "open", args: [url] };

425 if (platform === "win32") return { cmd: "cmd", args: ["/c", "start", "", url] };

426 return { cmd: "xdg-open", args: [url] };

427}

428function maybeOpenBrowser(url) {

429 if (process.env.CI || process.env.MODELGOV_NO_OPEN || !process.stdout.isTTY) return false;

430 try {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L416

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L416

431 const { cmd, args } = browserOpenCommand(process.platform, url);

432 const child = spawn(cmd, args, { stdio: "ignore", detached: true });

433 child.on("error", () => {

434 });

435 child.unref();

436 return true;