registry / @orth/cli / 0.2.29

@orth/cli@0.2.29

CLI to access all APIs and skills on the Orthogonal platform

Static Scan Results

scanned 5h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 13 file(s), 116 KB of source, external domains: 127.0.0.1, api.orthogonal.com, orthogonal.com, orthogonal.sh, x402.orth.sh

Source & flagged code

3 flagged

dist/commands/auth.jsView file

Lines 1-44javascript

1"use strict";

2var __importDefault = (this && this.__importDefault) || function (mod) {

3 return (mod && mod.__esModule) ? mod : { "default": mod };

4};

5Object.defineProperty(exports, "__esModule", { value: true });

6exports.loginCommand = loginCommand;

7exports.logoutCommand = logoutCommand;

8exports.whoamiCommand = whoamiCommand;

9const chalk_1 = __importDefault(require("chalk"));

10const crypto_1 = __importDefault(require("crypto"));

11const http_1 = __importDefault(require("http"));

12const config_js_1 = require("../config.js");

13const api_js_1 = require("../api.js");

14const WEB_BASE = process.env.ORTH_WEB_URL || "https://orthogonal.sh";

15function escapeHtml(str) {

16 return str

17 .replace(/&/g, "&")

18 .replace(/</g, "<")

19 .replace(/>/g, ">")

20 .replace(/"/g, """)

21 .replace(/'/g, "'");

22}

23function openBrowser(url) {

24 // Use execFile-style args to avoid shell injection

25 const { execFile } = require("child_process");

26 const platform = process.platform;

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/commands/auth.jsView on unpkg · L10

High

Child Process

Package source references child process execution.

dist/commands/auth.jsView on unpkg · L24

27 if (platform === "darwin")

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/commands/auth.jsView on unpkg · L10

28 execFile("open", [url]);

29 else if (platform === "win32")

30 execFile("cmd", ["/c", "start", "", url]);

31 else

32 execFile("xdg-open", [url]);

33}

34async function browserLogin() {

35 // Generate a random state token to prevent CSRF

36 const state = crypto_1.default.randomBytes(32).toString("hex");

37 return new Promise((resolve, reject) => {

38 let timeoutHandle;

39 const server = http_1.default.createServer((req, res) => {

40 const url = new URL(req.url || "/", `http://localhost`);

41 if (url.pathname === "/callback") {

42 const key = url.searchParams.get("key");

43 const error = url.searchParams.get("error");

44 const returnedState = url.searchParams.get("state");

Source & flagged code

3 flagged · loading source

dist/commands/auth.jsView file

24// Use execFile-style args to avoid shell injection L25: const { execFile } = require("child_process"); L26: const platform = process.platform;

High

Child Process

Package source references child process execution.

dist/commands/auth.jsView on unpkg · L24

10const crypto_1 = __importDefault(require("crypto")); L11: const http_1 = __importDefault(require("http")); L12: const config_js_1 = require("../config.js"); L13: const api_js_1 = require("../api.js"); L14: const WEB_BASE = process.env.ORTH_WEB_URL || "https://orthogonal.sh"; L15: function escapeHtml(str) { ... L24: // Use execFile-style args to avoid shell injection L25: const { execFile } = require("child_process"); L26: const platform = process.platform;

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/commands/auth.jsView on unpkg · L10

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/commands/auth.jsView on unpkg · L10

Findings

3 High3 Medium5 Low

HighChild Processdist/commands/auth.js

HighSame File Env Network Executiondist/commands/auth.js

HighSandbox Evasion Gated Capabilitydist/commands/auth.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

dist/commands/auth.jsView file

Lines 1-44javascript

1"use strict";

2var __importDefault = (this && this.__importDefault) || function (mod) {

3 return (mod && mod.__esModule) ? mod : { "default": mod };

4};

5Object.defineProperty(exports, "__esModule", { value: true });

6exports.loginCommand = loginCommand;

7exports.logoutCommand = logoutCommand;

8exports.whoamiCommand = whoamiCommand;

9const chalk_1 = __importDefault(require("chalk"));

10const crypto_1 = __importDefault(require("crypto"));

11const http_1 = __importDefault(require("http"));

12const config_js_1 = require("../config.js");

13const api_js_1 = require("../api.js");

14const WEB_BASE = process.env.ORTH_WEB_URL || "https://orthogonal.sh";

15function escapeHtml(str) {

16 return str

17 .replace(/&/g, "&")

18 .replace(/</g, "<")

19 .replace(/>/g, ">")

20 .replace(/"/g, """)

21 .replace(/'/g, "'");

22}

23function openBrowser(url) {

24 // Use execFile-style args to avoid shell injection

25 const { execFile } = require("child_process");

26 const platform = process.platform;

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/commands/auth.jsView on unpkg · L10

High

Child Process

Package source references child process execution.

dist/commands/auth.jsView on unpkg · L24

27 if (platform === "darwin")

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/commands/auth.jsView on unpkg · L10

28 execFile("open", [url]);

29 else if (platform === "win32")

30 execFile("cmd", ["/c", "start", "", url]);

31 else

32 execFile("xdg-open", [url]);

33}

34async function browserLogin() {

35 // Generate a random state token to prevent CSRF

36 const state = crypto_1.default.randomBytes(32).toString("hex");

37 return new Promise((resolve, reject) => {

38 let timeoutHandle;

39 const server = http_1.default.createServer((req, res) => {

40 const url = new URL(req.url || "/", `http://localhost`);

41 if (url.pathname === "/callback") {

42 const key = url.searchParams.get("key");

43 const error = url.searchParams.get("error");

44 const returnedState = url.searchParams.get("state");