registry / @neetru/cli / 2.12.22

@neetru/cli@2.12.22

Neetru Developer Kit — scaffold, AI assistant, publish, build e deploy de produtos SaaS Neetru via Core (VM-based agents)

Static Scan Results

scanned 8d ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 105 file(s), 954 KB of source, external domains: api.groq.com, api.neetru.com, cloud.google.com, core.neetru.com, deb.nodesource.com, generativelanguage.googleapis.com, get.docker.com, git-scm.com, github.com, integrate.api.nvidia.com, minhaconta.neetru.com, neetru.com, registry.npmjs.org, sdk.cloud.google.com, storage.googleapis.com

Source & flagged code

6 flagged

dist/lib/db-pipeline/rehearse.jsView file

Lines 48-93javascript

48 (typeof value === 'object' &&

49 value !== null &&

50 value

51 .isRehearseDockerUnavailableError === true));

52}

53// ---------------------------------------------------------------------------

54// Constantes internas

55// ---------------------------------------------------------------------------

56/** Imagem Postgres padrão — leve e suficiente para ensaiar DML/DDL. */

57const DEFAULT_IMAGE = 'postgres:16-alpine';

58/** Tempo máximo de espera para o Postgres aceitar conexões. */

59const DEFAULT_READY_TIMEOUT_MS = 30_000;

60/** Intervalo entre polls de `pg_isready`. */

61const READY_POLL_INTERVAL_MS = 500;

62/**

63 * Credenciais usadas APENAS no container efêmero.

64 * Não há dado real — este banco existe por menos de 60s e é descartado.

65 */

66const PG_ENV = {

67 user: 'neetru_rehearse',

68 password: 'neetru_rehearse_dev',

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/lib/db-pipeline/rehearse.jsView on unpkg · L68

69 db: 'neetru_rehearse',

70};

71/** Credenciais do container MySQL efêmero (root, descartado em <60s). */

72const MYSQL_ENV = {

73 password: 'neetru_rehearse_dev',

Medium

Secret Pattern

Hardcoded password in dist/lib/db-pipeline/rehearse.js

dist/lib/db-pipeline/rehearse.jsView on unpkg · L73

74 db: 'neetru_rehearse',

75};

76const ENGINE_SPECS = {

77 postgres: {

78 defaultImage: DEFAULT_IMAGE,

79 readyTimeoutMs: DEFAULT_READY_TIMEOUT_MS,

80 runEnvArgs: [

81 '-e', `POSTGRES_USER=${PG_ENV.user}`,

82 '-e', `POSTGRES_PASSWORD=${PG_ENV.password}`,

83 '-e', `POSTGRES_DB=${PG_ENV.db}`,

84 ],

85 readyCmd: (c) => [

86 'exec', c, 'pg_isready', '--username', PG_ENV.user, '--dbname', PG_ENV.db, '--quiet',

87 ],

88 // psql --single-transaction: rollback total em erro parcial (container limpo).

89 applyCmd: (c) => [

90 'exec', '--interactive', c, 'psql',

91 '--username', PG_ENV.user, '--dbname', PG_ENV.db,

92 '--no-psqlrc', '--single-transaction', '--file', '-',

93 ],

dist/lib/ai/auth-discovery.jsView file

Lines 1-38javascript

1/**

2 * Auth auto-discovery — detecta Claude Code, Codex (OpenAI) e Gemini CLIs

3 * já instalados na máquina e tenta extrair credenciais existentes.

4 *

5 * Motivação: usuário não deveria precisar setar `anthropicApiKey` na mão se

6 * ele já tem `claude` (Claude Code) ou `codex` (OpenAI Codex CLI) ou `gemini`

7 * (Google Gemini CLI) instalados e logados. CLI Neetru reaproveita as creds

8 * pra ligar o `neetru ai` direto.

9 *

10 * Estratégia (cross-platform Windows/macOS/Linux):

11 * 1. Detectar binário no PATH (`where` no Windows, `command -v` no POSIX).

dist/commands/build.jsView file

Lines 196-236javascript

196 const safeSrcDir = normalizePathForTar(srcDir);

197 const args = [];

198 // bug_8eed9ec1: só passa --force-local pro GNU tar (bsdtar do Windows rejeita).

199 if (process.platform === 'win32' && (await tarIsGnu())) {

200

dist/commands/bootstrap.jsView file

Lines 1-28javascript

1/**

2 * `neetru bootstrap` — checa o ambiente de dev e instala/sugere TUDO que

3 * um dev Neetru precisa pra rodar o ecossistema do zero.

4 *

5 * Diferente de `neetru doctor` (só diagnóstico, 5 checks rapidíssimos) e de

6 * `neetru init`/`neetru new` (só scaffold do projeto), o `bootstrap`:

7 *

8 * 1. Verifica binários do sistema (Node, npm, git, gcloud, docker, firebase).

9 * 2. Pra deps Node críticas — auto-install no `cwd` se há `package.json`.

10 * 3. Pra binários do SO — NÃO auto-install (risco em máquinas variadas);

11 * mostra a linha exata pra instalar em macOS/Linux/Windows.

Source & flagged code

6 flagged · loading source

dist/lib/db-pipeline/rehearse.jsView file

68patternName = generic_password severity = medium line = 68 matchedText = password...ev',

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/lib/db-pipeline/rehearse.jsView on unpkg · L68

73patternName = generic_password severity = medium line = 73 matchedText = password...ev',

Medium

Secret Pattern

Hardcoded password in dist/lib/db-pipeline/rehearse.js

dist/lib/db-pipeline/rehearse.jsView on unpkg · L73

dist/lib/ai/auth-discovery.jsView file

18*/ L19: import { execSync, execFileSync } from 'node:child_process'; L20: import { existsSync, readFileSync } from 'node:fs';

High

Child Process

Package source references child process execution.

dist/lib/ai/auth-discovery.jsView on unpkg · L18

284try { L285: execSync(`npm install -g ${npmPackage}`, { stdio: 'inherit' }); L286: return true;

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/lib/ai/auth-discovery.jsView on unpkg · L284

dist/commands/build.jsView file

216* Detecta se um script npm usa prefixo de variável de ambiente no estilo Unix L217: * (ex: `NODE_ENV=production next build`) que é incompatível com cmd.exe. L218: *

High

Shell

Package source references shell execution.

dist/commands/build.jsView on unpkg · L216

dist/commands/bootstrap.jsView file

8* 1. Verifica binários do sistema (Node, npm, git, gcloud, docker, firebase). L9: * 2. Pra deps Node críticas — auto-install no `cwd` se há `package.json`. L10: * 3. Pra binários do SO — NÃO auto-install (risco em máquinas variadas); ... L24: */ L25: import { spawn, spawnSync } from 'node:child_process'; L26: import * as fsSync from 'node:fs'; ... L36: return null; L37: const out = (r.stdout || r.stderr || '').trim(); L38: // Pega a primeira string que parece versão semver (X.Y.Z) ... L61: return null; L62: const p = process.platform; L63: return installCmd[p] ?? installCmd.linux ?? null;

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/commands/bootstrap.jsView on unpkg · L8

Findings

4 High5 Medium5 Low

HighChild Processdist/lib/ai/auth-discovery.js

HighShelldist/commands/build.js

HighSandbox Evasion Gated Capabilitydist/commands/bootstrap.js

HighRuntime Package Installdist/lib/ai/auth-discovery.js

MediumSecret Patterndist/lib/db-pipeline/rehearse.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumSecret Patterndist/lib/db-pipeline/rehearse.js

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

6 flagged

dist/lib/db-pipeline/rehearse.jsView file

Lines 48-93javascript

48 (typeof value === 'object' &&

49 value !== null &&

50 value

51 .isRehearseDockerUnavailableError === true));

52}

53// ---------------------------------------------------------------------------

54// Constantes internas

55// ---------------------------------------------------------------------------

56/** Imagem Postgres padrão — leve e suficiente para ensaiar DML/DDL. */

57const DEFAULT_IMAGE = 'postgres:16-alpine';

58/** Tempo máximo de espera para o Postgres aceitar conexões. */

59const DEFAULT_READY_TIMEOUT_MS = 30_000;

60/** Intervalo entre polls de `pg_isready`. */

61const READY_POLL_INTERVAL_MS = 500;

62/**

63 * Credenciais usadas APENAS no container efêmero.

64 * Não há dado real — este banco existe por menos de 60s e é descartado.

65 */

66const PG_ENV = {

67 user: 'neetru_rehearse',

68 password: 'neetru_rehearse_dev',

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/lib/db-pipeline/rehearse.jsView on unpkg · L68

69 db: 'neetru_rehearse',

70};

71/** Credenciais do container MySQL efêmero (root, descartado em <60s). */

72const MYSQL_ENV = {

73 password: 'neetru_rehearse_dev',

Medium

Secret Pattern

Hardcoded password in dist/lib/db-pipeline/rehearse.js

dist/lib/db-pipeline/rehearse.jsView on unpkg · L73

74 db: 'neetru_rehearse',

75};

76const ENGINE_SPECS = {

77 postgres: {

78 defaultImage: DEFAULT_IMAGE,

79 readyTimeoutMs: DEFAULT_READY_TIMEOUT_MS,

80 runEnvArgs: [

81 '-e', `POSTGRES_USER=${PG_ENV.user}`,

82 '-e', `POSTGRES_PASSWORD=${PG_ENV.password}`,

83 '-e', `POSTGRES_DB=${PG_ENV.db}`,

84 ],

85 readyCmd: (c) => [

86 'exec', c, 'pg_isready', '--username', PG_ENV.user, '--dbname', PG_ENV.db, '--quiet',

87 ],

88 // psql --single-transaction: rollback total em erro parcial (container limpo).

89 applyCmd: (c) => [

90 'exec', '--interactive', c, 'psql',

91 '--username', PG_ENV.user, '--dbname', PG_ENV.db,

92 '--no-psqlrc', '--single-transaction', '--file', '-',

93 ],

dist/lib/ai/auth-discovery.jsView file

Lines 1-38javascript

1/**

2 * Auth auto-discovery — detecta Claude Code, Codex (OpenAI) e Gemini CLIs

3 * já instalados na máquina e tenta extrair credenciais existentes.

4 *

5 * Motivação: usuário não deveria precisar setar `anthropicApiKey` na mão se

6 * ele já tem `claude` (Claude Code) ou `codex` (OpenAI Codex CLI) ou `gemini`

7 * (Google Gemini CLI) instalados e logados. CLI Neetru reaproveita as creds

8 * pra ligar o `neetru ai` direto.

9 *

10 * Estratégia (cross-platform Windows/macOS/Linux):

11 * 1. Detectar binário no PATH (`where` no Windows, `command -v` no POSIX).

dist/commands/build.jsView file

Lines 196-236javascript

196 const safeSrcDir = normalizePathForTar(srcDir);

197 const args = [];

198 // bug_8eed9ec1: só passa --force-local pro GNU tar (bsdtar do Windows rejeita).

199 if (process.platform === 'win32' && (await tarIsGnu())) {

200

dist/commands/bootstrap.jsView file

Lines 1-28javascript

1/**

2 * `neetru bootstrap` — checa o ambiente de dev e instala/sugere TUDO que

3 * um dev Neetru precisa pra rodar o ecossistema do zero.

4 *

5 * Diferente de `neetru doctor` (só diagnóstico, 5 checks rapidíssimos) e de

6 * `neetru init`/`neetru new` (só scaffold do projeto), o `bootstrap`:

7 *

8 * 1. Verifica binários do sistema (Node, npm, git, gcloud, docker, firebase).

9 * 2. Pra deps Node críticas — auto-install no `cwd` se há `package.json`.

10 * 3. Pra binários do SO — NÃO auto-install (risco em máquinas variadas);

11 * mostra a linha exata pra instalar em macOS/Linux/Windows.