registry  /  @override-dev/cli  /  0.1.0-alpha.8

@override-dev/cli@0.1.0-alpha.8

Override — the dev control plane: environments, repos, services, tasks

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 15 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
Supply chain
HighEntropyStringsUrlStrings
Manifest
NoLicense
scanned 12 file(s), 266 KB of source, external domains: 127.0.0.1

Source & flagged code

6 flagged · loading source
package.jsonView file
•scripts.postinstall = node scripts/postinstall.mjs
High
Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg
•scripts.postinstall = node scripts/postinstall.mjs
Medium
Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg
dist/cli/index.jsView file
•matchType = previous_version_dangerous_delta matchedPackage = @override-dev/cli@0.1.0-alpha.11 matchedIdentity = npm:QG92ZXJyaWRlLWRldi9jbGk:0.1.0-alpha.11 similarity = 0.833 summary = stored previous version shares package body but lacks this dangerous source file
High
Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli/index.jsView on unpkg
372return null; L373: const mod = await import(pathToFileURL(file).href); L374: const config = mod.default ?? mod;
Medium
Dynamic Require

Package source references dynamic require/import behavior.

dist/cli/index.jsView on unpkg · L372
37import * as clack2 from "@clack/prompts"; L38: import { execFileSync as execFileSync3 } from "node:child_process"; L39: import { appendFileSync, existsSync as existsSync6, mkdirSync as mkdirSync8, readFileSync as readFileSync6, writeFileSync as writeFileSync7 } from "node:fs"; ... L43: // src/util/color.ts L44: var useColor = process.stdout.isTTY && !process.env.NO_COLOR; L45: var paint = (code, s) => useColor ? `\x1B[${code}m${s}\x1B[0m` : s; ... L55: import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs"; L56: import { createServer } from "node:net"; L57: import { dirname, join } from "node:path"; ... L62: try { L63: return JSON.parse(readFileSync(file, "utf8")); L64: } catch {
Medium
Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/cli/index.jsView on unpkg · L37
37import * as clack2 from "@clack/prompts"; L38: import { execFileSync as execFileSync3 } from "node:child_process"; L39: import { appendFileSync, existsSync as existsSync6, mkdirSync as mkdirSync8, readFileSync as readFileSync6, writeFileSync as writeFileSync7 } from "node:fs"; ... L43: // src/util/color.ts L44: var useColor = process.stdout.isTTY && !process.env.NO_COLOR; L45: var paint = (code, s) => useColor ? `\x1B[${code}m${s}\x1B[0m` : s; ... L55: import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs"; L56: import { createServer } from "node:net"; L57: import { dirname, join } from "node:path"; ... L62: try { L63: return JSON.parse(readFileSync(file, "utf8")); L64: } catch {
Low
Weak Crypto

Package source references weak cryptographic algorithms.

dist/cli/index.jsView on unpkg · L37

Findings

2 High6 Medium7 Low
HighInstall Time Lifecycle Scriptspackage.json
HighPrevious Version Dangerous Deltadist/cli/index.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requiredist/cli/index.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/cli/index.js
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Cryptodist/cli/index.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License