registry / @nexushub/client / 0.6.5

@nexushub/client@0.6.5

The God-Tier NexusHub SDK

Static Scan Results

scanned 4d ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 18 file(s), 1.43 MB of source, external domains: github.com, gnapex.gnexus.co.tz, jimmy.warting.se, maps.google.com, player.vimeo.com, react.dev, sentry.gnexus.co.tz, www.youtube.com

Source & flagged code

5 flagged

dist/cli.cjsView file

Lines 1-45javascript

1#!/usr/bin/env node

2"use strict";var qu=Object.create;var Wn=Object.defineProperty;var zu=Object.getOwnPropertyDescriptor;var Hu=Object.getOwnPropertyNames;var Ku=Object.getPrototypeOf,Gu=Object.prototype.hasOwnProperty;var Ra=n=>{throw TypeError(n)};var Vu=(n,t,o)=>t in n?Wn(n,t,{enumerable:!0,configurable:!0,writable:!0,value:o}):n[t]=o;var qr=(n,t)=>()=>(n&&(t=n(n=0)),t);var si=(n,t)=>()=>(t||n((t={exports:{}}).exports,t),t.exports),Ea=(n,t)=>{for(var o in t)Wn(n,o,{get:t[o],enumerable:!0})},Yu=(n,t,o,i)=>{if(t&&typeof t=="object"||typeof t=="function")for(let a of Hu(t))!Gu.call(n,a)&&a!==o&&Wn(n,a,{get:()=>t ...

3Content-Disposition: form-data; name="`;return n.forEach((l,u)=>typeof l=="string"?i.push(a+Mi(u)+`"\r

4\r

5${l.replace(/\r(?!\n)|(?<!\r)\n/g,`\r

6`)}\r

7`):i.push(a+Mi(u)+`"; filename="${Mi(l.name,1)}"\r

8Content-Type: ${l.type||"application/octet-stream"}\r

9\r

10`,l,`\r

11`)),i.push(`--${o}--`),new t(i,{type:"multipart/form-data; boundary="+o})}var rn,nd,od,pl,id,ml,Mi,Xt,Ne,gl,Jt,oo=qr(()=>{"use strict";Zr();Wi();({toStringTag:rn,iterator:nd,hasInstance:od}=Symbol),pl=Math.random,id="append,set,get,getAll,delete,keys,values,entries,forEach,constructor".split(","),ml=(n,t,o)=>(n+="",/^(Blob|File)$/.test(t&&t[rn])?[(o=o!==void 0?o+"":t[rn]=="File"?t.name:"blob",n),t.name!==o||t[rn]=="blob"?new vr([t],o,t):t]:[n,t+""]),Mi=(n,t)=>(t?n:n.replace(/\r?\n|\r/g,`\r

12`)).replace(/\n/g,"%0A").replace(/\r/g,"%0D").replace(/"/g,"%22"),Xt=(n,t,o)=>{if(t.length<o)throw new TypeError(`Failed to execute '${n}' on 'FormData': ${o} arguments required, but only ${t.length} present.`)},Jt=(gl=class{constructor(...t){M(this,Ne,[]);if(t.length)throw new TypeError("Failed to construct 'FormData': parameter 1 is not of type 'HTMLFormElement'.")}get[rn](){return"FormData"}[nd](){return this.entries()}static[od](t){return t&&typeof t=="object"&&t[rn]==="FormData"&&!id.some(o=>typeof t[o]!="function")}append(

13--`+t;let o=new Uint8Array(t.length);for(let i=0;i<t.length;i++)o[i]=t.charCodeAt(i),this.boundaryChars[o[i]]=!0;this.boundary=o,this.lookbehind=new Uint8Array(this.boundary.length+8),this.state=ne.START_BOUNDARY}write(t){let o=0,i=t.length,a=this.index,{lookbehind:l,boundary:u,boundaryChars:d,index:g,state:f,flags:p}=this,C=this.boundary.length,P=C-1,D=t.length,y,S,I=x=>{this[x+"Mark"]=o},O=x=>{delete this[x+"Mark"]},F=(x,A,U,fe)=>{(A===void 0||A!==U)&&this[x](fe&&fe.subarray(A,U))},K=(x,A)=>{let U=x+"Mark";U in this&&(A?(F(x,this[U],o,t),delete this[U]):(F(x,this[U],t.length,t),this[U]=0))}; ...

14`:`

15`)+o,a=i+1,i=n.indexOf(`

16`,a)}while(i!==-1);return l+=n.slice(a),l}var{stdout:Da,stderr:La}=Aa,ui=Symbol("GENERATOR"),pr=Symbol("STYLER"),zr=Symbol("IS_EMPTY"),ka=["ansi","ansi","ansi256","ansi16m"],mr=Object.create(null),of=(n,t=

17`);return l!==-1&&(t=Oa(t,a,i,l)),i+t+a};Object.defineProperties(Hr.prototype,mr);var uf=Hr(),sh=Hr({level:La?La.level:0});var w=uf;var Rr=Y(require("process"),1),Za=require("util");var wi=Y(require("process"),1);var Kr=Y(require("process"),1);var ff=(n,t,o,i)=>{if(o==="length"||o==="prototype"||o==="arguments"||o==="caller")return;let a=Object.getOwnPropertyDescriptor(n,o),l=Object.getOwnPropertyDescriptor(t,o);!df(a,l)&&i||Object.defineProperty(n,o,l)},df=function(n,t){return n===void 0||n.configurable||n.writable===t.writable&&n.enumerable===t.enumerable&&n.configurable===t.configurable&&(n ...

18${t}`,mf=Object.getOwnPropertyDescriptor(Function.prototype,"toString"),gf=Object.getOwnPropertyDescriptor(Function.prototype.toString,"name"),yf=(n,t,o)=>{let i=o===""?"":`with ${o.trim()}() `

19`),f=u-1;i=[...g.slice(0,f),"... (content truncated to fit terminal)"].join(`

20`)}G(this,$,Gt).call(this,()=>m(this,re).write(i))===!1&&m(this,re).isTTY&&(L(this,Ye,()=>{L(this,Ye,void 0),G(this,$,ki).call(this)}),m(this,re).once("drain",m(this,Ye))),L(this,Ct,G(this,$,to).call(this,i,a))}finally{o&&G(this,$,Gt).call(this,()=>m(this,re).write(Qf))}return this}start(t){if(t&&(this.text=t),this.isSilent)return this;if(!this.isEnabled){let o=this.text?"-":"",i=" ".repeat(m(this,N).indent)+G(this,$,Bi).call(this,o,this.text,m(this,N).prefixText,m(this,N).suffixText);return i.trim()!==""&&G(this,$,Gt).call(this,()=>m(this,re).write(i+`

21`)),this}return this.isSpinning?this:(m(this,N).hideCursor&&Si.hide(m(this,re)),m(this,N).discardStdin&&Rr.default.stdin.isTTY&&(Di.start(),L(this,Cr,!0)),G(this,$,ol).call(this),this.render(),L(this,Vt,setInterval(this.render.bind(this),this.interval)),this)}stop(){return clearInterval(m(this,Vt)),L(this,Vt,void 0),L(this,Ve,-1),L(this,Er,0),G(this,$,Ni).call(this),G(this,$,il).call(this),m(this,Ye)&&(m(this,re).removeListener("drain",m(this,Ye)),L(this,Ye,void 0)),this.isEnabled&&(this.clear(),m(this,N).hideCursor&&Si.show(m(this,re))),m(this,Cr)&&(L(this,Cr,!1),Di.stop()),this}succeed(t){re ...

22`;return this.stop(),G(this,$,Gt).call(this,()=>m(this,re).write(u)),this}};Ct=new WeakMap,Ve=new WeakMap,Er=new WeakMap,N=new WeakMap,qe=new WeakMap,re=new WeakMap,Vt=new WeakMap,xt=new WeakMap,Tr=new WeakMap,Ye=new WeakMap,Ce=new WeakMap,Cr=new WeakMap,$

23`||o==="\r"},rl=function(){m(this,Ce)||(L(this,Ce,setTimeout(()=>{L(this,Ce,void 0),this.isSpinning&&G(this,$,ki).call(this)},Xf)),typeof m(this,Ce)?.unref=="function"&&m(this,Ce).unref())},Ni=function(){m(this,Ce)&&(clearTimeout(m(this,Ce)),L(this,Ce,void 0))},Bi=function(t,o,i,a){let l=G(this,$,Fi).call(this,i," "),d=typeof o=="string"?(t?" ":"")+o:"",g=G(this,$,$i).call(this,a," ");return l+t+d+g},ji=function(t,o,i=!1){let a=typeof t=="function"?t():t;return typeof a=="string"&&a!==""?i?o+a:a+o:""},Fi=function(t=m(this,N).prefixText,o=" "){return G(this,$,ji).call(this,t,o,!1)},$i=function( ...

24`))i+=Math.max(1,Math.ceil(Ai(a)/o));return i},nl=function(t){if(!t||m(this,xt).has(t)||!t.isTTY||typeof t.write!="function")return;eo.has(t)&&console.warn("[ora] Multiple concurrent spinners detected. This may cause visual corruption. Use one spinner at a time.");

25\r

26`),i=!1,a=!1,l;n.on("response",u=>{let{headers:d}=u;i=d["transfer-encoding"]==="chunked"&&!d["content-length"]}),n.on("socket",u=>{let d=()=>{if(i&&!a){let f=new Error("Premature close");f.code="ERR_STREAM_PREMATURE_CLOSE",t(f)}},g=f=>{a=ln.Buffer.compare(f.slice(-5),o)===0,!a&&l&&(a=ln.Buffer.compare(l.slice(-3),o.slice(0,3))===0&&ln.Buffer.compare(f.slice(-2),o.slice(3))===0),l=f};u.prependListener("close",d),u.on("data",g),n.on("close",()=>{u.removeListener("close",d),u.removeListener("data",g)})})}var Ze=require("child_process"),es=Y(require("semver"),1),Hl=Y(require("crypto"),1),Kl=Y(requ ...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/cli.cjsView on unpkg · L10

27\u{1F6A8} NexusHub Security Alert: Data Integrity Violation in file:

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli.cjsView on unpkg · L17

High

Child Process

Package source references child process execution.

dist/cli.cjsView on unpkg · L25

28 ${t}

29 Error: ${o.message}

30 This file has been disabled until regenerated via npx nexus pull.

31`),null}}async getPage(t){let o=ft.default.resolve(process.cwd(),this.baseDir,"pages",`${t}.nx`);if(Qe.default.existsSync(o)){let i=this.decompileFile(o);if(!i)return null;let a=i;for(;a&&typeof a==

32`+o),console.log(E(" \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500")),n&&console.log(" "+w.bold.white(n)),console.log(E(` SDK CLI v${It} \xB7 Platform by G-Nexus \xB7 Enterprise Edition`)),console.log(E(` \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u25 ...

33`))}async function Or(){let n=process.cwd(),t=T.default.join(n,wo);await R.default.pathExists(t)||(console.log(`

34`+Q("\u2716 Project not initialized.")),console.log(E(" This project has not been set up with the NexusHub SDK.")),console.log(E(` Run the following command to get started:

35`)),console.log(" "+vd("npx nexus init")+`

36`),process.exit(1))}async function Ad(n){await R.default.ensureDir(T.default.join(process.cwd(),Ot)),await R.default.writeJson(T.default.join(process.cwd(),wo),{nexusVersion:It,initializedAt:new Date().toISOString(),projectId:n.projectId,workspace:n.workspace,features:n.features,checksum:Hl.default.createHash("md5").update(JSON.stringify(n)).digest("hex")},{spaces:2})}async function Vl(){try{return await R.default.readJson(T.default.join(process.cwd(),wo))}catch{return null}}async function Ro(n,t,o){let i=T.default.resolve(process.cwd(),So),a=ae.compile(n,t,o);await R.default.ensureDir(T.defau ...

37`+Q("\u2716 Missing credentials")),console.log(E(` NEXUS_API_KEY and NEXUS_PROJECT_ID must be set in .env or .env.local

38`)),process.exit(1)),t}async function Id(n,t){let o=T.default.join(process.cwd(),ns),i=ae.compile(n,t,n.projectId);await R.default.ensureDir(T.default.dirname(o)),await R.default.writeFile(o,i)}async function Od(){try{let{apiKey:n}=un(),t=T.default.join(process.cwd(),ns);if(!await R.default.pathExists(t)||!n)return null;let o=await R.default.readFile(t);return ae.decompile(o,n).data}catch{return null}}async function ue(n,t,{method:o="GET",body:i,timeout:a=3e4,retries:l=3}={}){for(let u=0;u<l;u++){let d=new AbortController,g=setTimeout(()=>d.abort(),a);try{let f=await po(n,{method:o,headers:{Au ...

39`).some(u=>u.startsWith(t+"="))){let u=`${t}=${o}`;return i=i.trimEnd()+`

40`+u+`

41`,await R.default.writeFile(n,i),!0}return!1}async function Eo(n){let t=T.default.join(process.cwd(),he),o={pages:{},collections:{},globals:{}};if(!await R.default.pathExists(t))return o;let i=T.default.join(t,

42${n.fields.filter(i=>!i.isHidden).map(i=>`${t} ${i.name}${i.validation?.required?"":"?"}: ${yo(i,t+" ")};`).join(`

43`)}

44${t}}`:"Record<string, unknown>";case"ARRAY":case"LIST":if(n.fields&&n.fields.length>0){let o=n.fields[0];return o.type==="OBJECT"&&o.fields?`Array<{

45${o.fields.filter(a=>!a.isHidden).map(a=>`${t} ${a.name}${a.validation?.required?"":"?"}: ${yo(a,t+" ")};`).join(`

Long lines were clipped for display.

dist/studio/assets/DC-KSUi6.woff2View file

•path = dist/studio/assets/DC-KSUi6.woff2 kind = high_entropy_blob sizeBytes = 16512 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/studio/assets/DC-KSUi6.woff2View on unpkg

Source & flagged code

5 flagged · loading source

dist/cli.cjsView file

High

Child Process

Package source references child process execution.

dist/cli.cjsView on unpkg · L25

17`);return l!==-1&&(t=Oa(t,a,i,l)),i+t+a};Object.defineProperties(Hr.prototype,mr);var uf=Hr(),sh=Hr({level:La?La.level:0});var w=uf;var Rr=Y(require("process"),1),Za=require("util"... L18: ${t}`,mf=Object.getOwnPropertyDescriptor(Function.prototype,"toString"),gf=Object.getOwnPropertyDescriptor(Function.prototype.toString,"name"),yf=(n,t,o)=>{let i=o===""?"":`with ${... L19: `),f=u-1;i=[...g.slice(0,f),"... (content truncated to fit terminal)"].join(` ... L25: \r L26: `),i=!1,a=!1,l;n.on("response",u=>{let{headers:d}=u;i=d["transfer-encoding"]==="chunked"&&!d["content-length"]}),n.on("socket",u=>{let d=()=>{if(i&&!a){let f=new Error("Premature c... L27: \u{1F6A8} NexusHub Security Alert: Data Integrity Violation in file:

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli.cjsView on unpkg · L17

10`,l,`\r L11: `)),i.push(`--${o}--`),new t(i,{type:"multipart/form-data; boundary="+o})}var rn,nd,od,pl,id,ml,Mi,Xt,Ne,gl,Jt,oo=qr(()=>{"use strict";Zr();Wi();({toStringTag:rn,iterator:nd,hasIns... L12: `)).replace(/\n/g,"%0A").replace(/\r/g,"%0D").replace(/"/g,"%22"),Xt=(n,t,o)=>{if(t.length<o)throw new TypeError(`Failed to execute '${n}' on 'FormData': ${o} arguments required, b... L13: --`+t;let o=new Uint8Array(t.length);for(let i=0;i<t.length;i++)o[i]=t.charCodeAt(i),this.boundaryChars[o[i]]=!0;this.boundary=o,this.lookbehind=new Uint8Array(this.boundary.length... L14: `:` ... L17: `);return l!==-1&&(t=Oa(t,a,i,l)),i+t+a};Object.defineProperties(Hr.prototype,mr);var uf=Hr(),sh=Hr({level:La?La.level:0});var w=uf;var Rr=Y(require("process"),1),Za=require("util"... L18: ${t}`,mf=Object.getOwnPropertyDescriptor(Function.prototype,"toString"),gf=Object.getOwnPropertyDescriptor(Function.prototype.toString,"name"),yf=(n,t,o)=>{let i=o===""?"":`with ${... L19: `),f=u-1;i=[...g.slice(0,f),"... (content truncated to fit terminal)"].join(` ... L25: \r L26: `),i=!1,a=!1,l;n.on("response",u=>{let{headers:d}=u;i=d["transfer-encoding"]==="chunked"&&!d["content-length"]}),n.on("socket",u=

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/cli.cjsView on unpkg · L10

25\r L26: `),i=!1,a=!1,l;n.on("response",u=>{let{headers:d}=u;i=d["transfer-encoding"]==="chunked"&&!d["content-length"]}),n.on("socket",u=>{let d=()=>{if(i&&!a){let f=new Error("Premature c... L27: \u{1F6A8} NexusHub Security Alert: Data Integrity Violation in file: ... L29: Error: ${o.message} L30: This file has been disabled until regenerated via npx nexus pull. L31: `),null}}async getPage(t){let o=ft.default.resolve(process.cwd(),this.baseDir,"pages",`${t}.nx`);if(Qe.default.existsSync(o)){let i=this.decompileFile(o);if(!i)return null;let a=i;...

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli.cjsView on unpkg · L25

dist/studio/assets/DC-KSUi6.woff2View file

•path = dist/studio/assets/DC-KSUi6.woff2 kind = high_entropy_blob sizeBytes = 16512 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/studio/assets/DC-KSUi6.woff2View on unpkg

Findings

5 High3 Medium5 Low

HighChild Processdist/cli.cjs

HighSame File Env Network Executiondist/cli.cjs

HighCommand Output Exfiltrationdist/cli.cjs

HighRuntime Package Installdist/cli.cjs

HighShips High Entropy Blobdist/studio/assets/DC-KSUi6.woff2

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

5 flagged

dist/cli.cjsView file

Lines 1-45javascript

1#!/usr/bin/env node

3Content-Disposition: form-data; name="`;return n.forEach((l,u)=>typeof l=="string"?i.push(a+Mi(u)+`"\r

4\r

5${l.replace(/\r(?!\n)|(?<!\r)\n/g,`\r

6`)}\r

7`):i.push(a+Mi(u)+`"; filename="${Mi(l.name,1)}"\r

8Content-Type: ${l.type||"application/octet-stream"}\r

9\r

10`,l,`\r

14`:`

15`)+o,a=i+1,i=n.indexOf(`

18${t}`,mf=Object.getOwnPropertyDescriptor(Function.prototype,"toString"),gf=Object.getOwnPropertyDescriptor(Function.prototype.toString,"name"),yf=(n,t,o)=>{let i=o===""?"":`with ${o.trim()}() `

19`),f=u-1;i=[...g.slice(0,f),"... (content truncated to fit terminal)"].join(`

25\r

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/cli.cjsView on unpkg · L10

27\u{1F6A8} NexusHub Security Alert: Data Integrity Violation in file:

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli.cjsView on unpkg · L17

High

Child Process

Package source references child process execution.

dist/cli.cjsView on unpkg · L25

28 ${t}

29 Error: ${o.message}

30 This file has been disabled until regenerated via npx nexus pull.

33`))}async function Or(){let n=process.cwd(),t=T.default.join(n,wo);await R.default.pathExists(t)||(console.log(`

34`+Q("\u2716 Project not initialized.")),console.log(E(" This project has not been set up with the NexusHub SDK.")),console.log(E(` Run the following command to get started:

35`)),console.log(" "+vd("npx nexus init")+`

37`+Q("\u2716 Missing credentials")),console.log(E(` NEXUS_API_KEY and NEXUS_PROJECT_ID must be set in .env or .env.local

39`).some(u=>u.startsWith(t+"="))){let u=`${t}=${o}`;return i=i.trimEnd()+`

40`+u+`

42${n.fields.filter(i=>!i.isHidden).map(i=>`${t} ${i.name}${i.validation?.required?"":"?"}: ${yo(i,t+" ")};`).join(`

43`)}

44${t}}`:"Record<string, unknown>";case"ARRAY":case"LIST":if(n.fields&&n.fields.length>0){let o=n.fields[0];return o.type==="OBJECT"&&o.fields?`Array<{

45${o.fields.filter(a=>!a.isHidden).map(a=>`${t} ${a.name}${a.validation?.required?"":"?"}: ${yo(a,t+" ")};`).join(`

Long lines were clipped for display.

dist/studio/assets/DC-KSUi6.woff2View file

•path = dist/studio/assets/DC-KSUi6.woff2 kind = high_entropy_blob sizeBytes = 16512 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/studio/assets/DC-KSUi6.woff2View on unpkg