registry / @neko-catpital-labs/invoker-cli / 0.0.7

@neko-catpital-labs/invoker-cli@0.0.7

Invoker standalone CLI installer

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

UrlStrings

Manifest

NoLicense

scanned 2 file(s), 3.33 KB of source, external domains: github.com

Source & flagged code

5 flagged

package.jsonView file

Lines 5-28json

5 "type": "module",

6 "repository": {

7 "type": "git",

8 "url": "git+https://github.com/Neko-Catpital-Labs/Invoker.git",

9 "directory": "packages/npm-cli"

10 },

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/invoker-cli.jsView file

4import { fileURLToPath } from 'node:url'; L5: import { spawnSync } from 'node:child_process'; L6:

High

Child Process

Package source references child process execution.

bin/invoker-cli.jsView on unpkg · L4

scripts/install.jsView file

7import { fileURLToPath } from 'node:url'; L8: import { execFileSync } from 'node:child_process'; L9: import { createRequire } from 'node:module'; ... L18: L19: const repo = process.env.INVOKER_RELEASE_REPOSITORY ?? 'Neko-Catpital-Labs/Invoker'; L20: const baseUrl = process.env.INVOKER_RELEASE_BASE_URL ?? `https://github.com/${repo}/releases/download/v${pkg.version}`; L21: const asset = `invoker-cli-${pkg.version}-${process.platform}-${process.arch}.tar.gz`;

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

scripts/install.jsView on unpkg · L7

10L11: const require = createRequire(import.meta.url); L12: const root = dirname(dirname(fileURLToPath(import.meta.url)));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

scripts/install.jsView on unpkg · L10

Findings

4 High5 Medium4 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processbin/invoker-cli.js

HighShell

HighSame File Env Network Executionscripts/install.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requirescripts/install.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowUrl Strings

LowNo License

bin/invoker-cli.jsView file

Lines 1-17javascript

1#!/usr/bin/env node

2import { existsSync } from 'node:fs';

3import { dirname, join } from 'node:path';

4import { fileURLToPath } from 'node:url';

5import { spawnSync } from 'node:child_process';

High

Child Process

Package source references child process execution.

bin/invoker-cli.jsView on unpkg · L4

7const root = dirname(dirname(fileURLToPath(import.meta.url)));

8const binary = join(root, 'vendor', 'invoker-cli');

10if (!existsSync(binary)) {

11 console.error(`invoker-cli binary is missing at ${binary}. Reinstall @neko-catpital-labs/invoker-cli.`);

12 process.exit(1);

13}

15const result = spawnSync(binary, process.argv.slice(2), { stdio: 'inherit' });

16process.exit(result.status ?? 1);

scripts/install.jsView file

Lines 1-30javascript

1#!/usr/bin/env node

2import { createHash } from 'node:crypto';

3import { createWriteStream, existsSync } from 'node:fs';

4import { chmod, mkdir, readFile, rm } from 'node:fs/promises';

5import { dirname, join } from 'node:path';

6import { pipeline } from 'node:stream/promises';

7import { fileURLToPath } from 'node:url';

8import { execFileSync } from 'node:child_process';

9import { createRequire } from 'node:module';

11const require = createRequire(import.meta.url);

12const root = dirname(dirname(fileURLToPath(import.meta.url)));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

scripts/install.jsView on unpkg · L10

13const pkg = require(join(root, 'package.json'));

15if (existsSync(join(root, '..', '..', 'pnpm-workspace.yaml'))) {

16 process.exit(0);

17}

19const repo = process.env.INVOKER_RELEASE_REPOSITORY ?? 'Neko-Catpital-Labs/Invoker';

20const baseUrl = process.env.INVOKER_RELEASE_BASE_URL ?? `https://github.com/${repo}/releases/download/v${pkg.version}`;

21const asset = `invoker-cli-${pkg.version}-${process.platform}-${process.arch}.tar.gz`;

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

scripts/install.jsView on unpkg · L7

22const vendor = join(root, 'vendor');

23const archivePath = join(vendor, asset);

24const sumsPath = join(vendor, 'SHA256SUMS');

25const binaryPath = join(vendor, 'invoker-cli');

27if (!['darwin', 'linux'].includes(process.platform) || !['x64', 'arm64'].includes(process.arch)) {

28 throw new Error(`Unsupported Invoker CLI platform: ${process.platform}-${process.arch}`);

29}