registry / @objectstack/cli / 12.0.0

@objectstack/cli@12.0.0

Command Line Interface for ObjectStack Protocol

Static Scan Results

scanned 4h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 91 file(s), 810 KB of source, external domains: api.example.com, cdn.example.com, cloud.objectos.ai, example.com, github.com, nodejs.org, objectstack.dev, schema.objectstack.io

Source & flagged code

6 flagged

dist/commands/generate.jsView file

Lines 517-557javascript

517 number: 'DECIMAL(18,2)',

518 integer: 'INTEGER',

519 currency: 'DECIMAL(18,2)',

520 percent: 'DECIMAL(5,2)',

521 boolean: 'BOOLEAN',

522 date: 'DATE',

523 datetime: 'TIMESTAMP',

524 time: 'TIME',

525 email: 'VARCHAR(255)',

526 phone: 'VARCHAR(50)',

527 url: 'VARCHAR(2048)',

528 select: 'VARCHAR(255)',

529 multiselect: 'TEXT',

530 lookup: 'VARCHAR(36)',

531 master_detail: 'VARCHAR(36)',

532 formula: 'TEXT',

533 autonumber: 'SERIAL',

534 json: 'JSONB',

535 file: 'VARCHAR(2048)',

536 image: 'VARCHAR(2048)',

537 password: 'VARCHAR(255)',

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/commands/generate.jsView on unpkg · L537

538 slug: 'VARCHAR(255)',

539 uuid: 'UUID',

540 ip_address: 'VARCHAR(45)',

541 color: 'VARCHAR(7)',

542 rating: 'INTEGER',

543 geo_point: 'POINT',

544 vector: 'VECTOR',

545 encrypted: 'TEXT',

546};

547function fieldTypeToSql(fieldType) {

548 return FIELD_TYPE_SQL_MAP[fieldType] || 'TEXT';

549}

550function generateMigrationSql(config) {

551 const lines = [

552 '-- Auto-generated by ObjectStack CLI — do not edit manually',

553 `-- Generated at ${new Date().toISOString()}`,

554 '',

555 ];

556 const objects = [];

557 const rawObjects = config.objects ?? config.data?.objects ?? {};

dist/utils/auth-flows.jsView file

Lines 19-66javascript

19/**

20 * Email + password authentication (CI / non-interactive path).

21 */

22export async function loginWithPassword(url, email, password) {

23 const client = new ObjectStackClient({ baseUrl: url });

dist/utils/extract-hook-body.jsView file

Lines 15-55javascript

15 * the regex rejects (top-level `import`, `require(`, `fetch(`, `process.*`,

16 * `globalThis.*`, `eval`, `new Function`) makes the build **fail**. There is

17 * no silent fallback to the L3 .mjs path because that path is being closed.

dist/commands/serve.jsView file

Lines 39-79javascript

39 if (i < 0)

40 continue;

41 const k = pair.slice(0, i).trim();

42 const raw = pair.slice(i + 1

dist/commands/login.jsView file

Lines 1-26javascript

2import { Command, Flags } from '@oclif/core';

3import { printHeader, printSuccess, printError, printKV } from '../utils/format.js';

4import { writeAuthConfig, readAuthConfig } from '../utils/auth-config.js';

5import { ObjectStackClient } from '@objectstack/client';

6import

Source & flagged code

6 flagged · loading source

dist/commands/generate.jsView file

537patternName = generic_password severity = medium line = 537 matchedText = password...5)',

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/commands/generate.jsView on unpkg · L537

dist/utils/auth-flows.jsView file

39async function openBrowser(url) { L40: const { exec } = await import('node:child_process'); L41: const platform = process.platform;

High

Child Process

Package source references child process execution.

dist/utils/auth-flows.jsView on unpkg · L39

46: `xdg-open "${url}"`; L47: exec(cmd, () => { L48: /* best-effort */ ... L54: export async function loginWithBrowser(url, opts = {}) { L55: const clientId = opts.clientId ?? process.env.OS_CLI_CLIENT_ID ?? 'objectstack-cli'; L56: const silent = !!opts.silent; L57: // RFC 8628 §3.1 — Device Authorization Request L58: const res = await globalThis.fetch(`${url}/api/v1/auth/device/code`, { L59: method: 'POST',

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/utils/auth-flows.jsView on unpkg · L46

dist/utils/extract-hook-body.jsView file

35{ rx: /\bglobalThis\s*\./, reason: '`globalThis` access is not allowed in hook/action bodies' }, L36: { rx: /\beval\s*\(/, reason: '`eval()` is not allowed in hook/action bodies' }, L37: { rx: /\bnew\s+Function\s*\(/, reason: '`new Function()` is not allowed in hook/action bodies' },

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/utils/extract-hook-body.jsView on unpkg · L35

dist/commands/serve.jsView file

59try { L60: mod = await import('@objectstack/observability'); L61: }

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/commands/serve.jsView on unpkg · L59

dist/commands/login.jsView file

6import * as readline from 'node:readline/promises'; L7: import { stdin as input, stdout as output } from 'node:process'; L8: /** ... L20: const chars = []; L21: process.stdout.write(promptText); L22: process.stdin.setRawMode(true); ... L62: async function openBrowser(url) { L63: const { exec } = await import('node:child_process'); L64: const platform = process.platform; L65: const cmd = platform === 'darwin' ? `open "${url}"` : platform === 'win32' ? `start "" "${url}"` : `xdg-open "${url}"`; ... L71: '$ os login', L72: '$ os login --url https://api.example.com',

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/commands/login.jsView on unpkg · L6

Findings

4 High5 Medium5 Low

HighChild Processdist/utils/auth-flows.js

HighShell

HighSame File Env Network Executiondist/utils/auth-flows.js

HighSandbox Evasion Gated Capabilitydist/commands/login.js

MediumSecret Patterndist/commands/generate.js

MediumDynamic Requiredist/commands/serve.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvaldist/utils/extract-hook-body.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

6 flagged

dist/commands/generate.jsView file

Lines 517-557javascript

517 number: 'DECIMAL(18,2)',

518 integer: 'INTEGER',

519 currency: 'DECIMAL(18,2)',

520 percent: 'DECIMAL(5,2)',

521 boolean: 'BOOLEAN',

522 date: 'DATE',

523 datetime: 'TIMESTAMP',

524 time: 'TIME',

525 email: 'VARCHAR(255)',

526 phone: 'VARCHAR(50)',

527 url: 'VARCHAR(2048)',

528 select: 'VARCHAR(255)',

529 multiselect: 'TEXT',

530 lookup: 'VARCHAR(36)',

531 master_detail: 'VARCHAR(36)',

532 formula: 'TEXT',

533 autonumber: 'SERIAL',

534 json: 'JSONB',

535 file: 'VARCHAR(2048)',

536 image: 'VARCHAR(2048)',

537 password: 'VARCHAR(255)',

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/commands/generate.jsView on unpkg · L537

538 slug: 'VARCHAR(255)',

539 uuid: 'UUID',

540 ip_address: 'VARCHAR(45)',

541 color: 'VARCHAR(7)',

542 rating: 'INTEGER',

543 geo_point: 'POINT',

544 vector: 'VECTOR',

545 encrypted: 'TEXT',

546};

547function fieldTypeToSql(fieldType) {

548 return FIELD_TYPE_SQL_MAP[fieldType] || 'TEXT';

549}

550function generateMigrationSql(config) {

551 const lines = [

552 '-- Auto-generated by ObjectStack CLI — do not edit manually',

553 `-- Generated at ${new Date().toISOString()}`,

554 '',

555 ];

556 const objects = [];

557 const rawObjects = config.objects ?? config.data?.objects ?? {};

dist/utils/auth-flows.jsView file

Lines 19-66javascript

19/**

20 * Email + password authentication (CI / non-interactive path).

21 */

22export async function loginWithPassword(url, email, password) {

23 const client = new ObjectStackClient({ baseUrl: url });

dist/utils/extract-hook-body.jsView file

Lines 15-55javascript

15 * the regex rejects (top-level `import`, `require(`, `fetch(`, `process.*`,

16 * `globalThis.*`, `eval`, `new Function`) makes the build **fail**. There is

17 * no silent fallback to the L3 .mjs path because that path is being closed.

dist/commands/serve.jsView file

Lines 39-79javascript

39 if (i < 0)

40 continue;

41 const k = pair.slice(0, i).trim();

42 const raw = pair.slice(i + 1

dist/commands/login.jsView file

Lines 1-26javascript

2import { Command, Flags } from '@oclif/core';

3import { printHeader, printSuccess, printError, printKV } from '../utils/format.js';

4import { writeAuthConfig, readAuthConfig } from '../utils/auth-config.js';

5import { ObjectStackClient } from '@objectstack/client';

6import