registry  /  @override-dev/cli  /  0.1.0-alpha.1

@override-dev/cli@0.1.0-alpha.1

Override — the dev control plane: environments, repos, services, tasks

Static Scan Results

scanned 18h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
Supply chain
HighEntropyStringsUrlStrings
Manifest
NoLicense
scanned 8 file(s), 212 KB of source, external domains: 127.0.0.1

Source & flagged code

5 flagged · loading source
package.jsonView file
•scripts.postinstall = node scripts/postinstall.mjs
High
Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg
•scripts.postinstall = node scripts/postinstall.mjs
Medium
Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg
dist/cli/index.jsView file
251return null; L252: const mod = await import(pathToFileURL(file).href); L253: const config = mod.default ?? mod;
Medium
Dynamic Require

Package source references dynamic require/import behavior.

dist/cli/index.jsView on unpkg · L251
34import * as clack2 from "@clack/prompts"; L35: import { execFileSync as execFileSync3 } from "node:child_process"; L36: import { appendFileSync, existsSync as existsSync5, mkdirSync as mkdirSync6, readFileSync as readFileSync5, writeFileSync as writeFileSync6 } from "node:fs"; ... L40: // src/util/color.ts L41: var useColor = process.stdout.isTTY && !process.env.NO_COLOR; L42: var paint = (code, s) => useColor ? `\x1B[${code}m${s}\x1B[0m` : s; ... L52: import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs"; L53: import { createServer } from "node:net"; L54: import { dirname, join } from "node:path"; ... L59: try { L60: return JSON.parse(readFileSync(file, "utf8")); L61: } catch {
Medium
Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/cli/index.jsView on unpkg · L34
34import * as clack2 from "@clack/prompts"; L35: import { execFileSync as execFileSync3 } from "node:child_process"; L36: import { appendFileSync, existsSync as existsSync5, mkdirSync as mkdirSync6, readFileSync as readFileSync5, writeFileSync as writeFileSync6 } from "node:fs"; ... L40: // src/util/color.ts L41: var useColor = process.stdout.isTTY && !process.env.NO_COLOR; L42: var paint = (code, s) => useColor ? `\x1B[${code}m${s}\x1B[0m` : s; ... L52: import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs"; L53: import { createServer } from "node:net"; L54: import { dirname, join } from "node:path"; ... L59: try { L60: return JSON.parse(readFileSync(file, "utf8")); L61: } catch {
Low
Weak Crypto

Package source references weak cryptographic algorithms.

dist/cli/index.jsView on unpkg · L34

Findings

1 High6 Medium7 Low
HighInstall Time Lifecycle Scriptspackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requiredist/cli/index.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/cli/index.js
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Cryptodist/cli/index.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License