registry / @pandastack/sdk / 0.8.2

@pandastack/sdk@0.8.2

TypeScript SDK for PandaStack Firecracker microVM sandboxes

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

Manifest

WildcardDependency

scanned 3 file(s), 229 KB of source, external domains: api.anthropic.com, api.pandastack.ai, app.pandastack.ai

Source & flagged code

1 flagged

dist/cli.jsView file

Lines 11-51javascript

11 for (let key of __getOwnPropNames(from))

12 if (!__hasOwnProp.call(to, key) && key !== except)

13 __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });

14 }

15 return to;

16};

17var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(

18 // If the importer is in node compatibility mode or this is not an ESM

19 // file that has been converted to a CommonJS file using a Babel-

20 // compatible transform (i.e. "__esModule" has not been set), then set

21 // "default" to the CommonJS "module.exports" for node compatibility.

22 isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,

23 mod

24));

26// src/cli.ts

27var import_node_fs2 = require("fs");

28var import_promises2 = require("fs/promises");

29var import_node_os2 = require("os");

30var import_node_path2 = require("path");

31var import_node_zlib = require("zlib");

32var import_node_child_process = require("child_process");

33var import_node_fs3 = require("fs");

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli.jsView on unpkg · L31

34var os = __toESM(require("os"));

35var path = __toESM(require("path"));

37// src/index.ts

38var import_node_fs = require("fs");

39var import_promises = require("fs/promises");

40var import_node_path = require("path");

41var import_node_os = require("os");

42var ExploreError = class extends Error {

43};

44var PandaStackError = class extends Error {

45 statusCode;

46 response;

47 constructor(message, statusCode, response) {

48 super(message);

49 this.name = new.target.name;

50 this.statusCode = statusCode;

51 this.response = response;

Source & flagged code

1 flagged · loading source

dist/cli.jsView file

31var import_node_zlib = require("zlib"); L32: var import_node_child_process = require("child_process"); L33: var import_node_fs3 = require("fs"); ... L66: var CommandError = class extends PandaStackError { L67: exitCode; L68: stdout; ... L132: if (body !== void 0) init.body = body; L133: let res = await fetch(url, init); L134: if (res.status === 404 && (method === "GET" || method === "DELETE" || method === "HEAD") && !options.noRetry) { ... L139: if (res.status === 204 || options.parseAs === "none") return void 0; L140: if (options.parseAs === "text") return await res.text(); L141: const text = await res.text();

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli.jsView on unpkg · L31

Findings

1 High4 Medium4 Low

HighSandbox Evasion Gated Capabilitydist/cli.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumWildcard Dependency

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

1 flagged

dist/cli.jsView file

Lines 11-51javascript

11 for (let key of __getOwnPropNames(from))

12 if (!__hasOwnProp.call(to, key) && key !== except)

13 __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });

14 }

15 return to;

16};

17var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(

18 // If the importer is in node compatibility mode or this is not an ESM

19 // file that has been converted to a CommonJS file using a Babel-

20 // compatible transform (i.e. "__esModule" has not been set), then set

21 // "default" to the CommonJS "module.exports" for node compatibility.

22 isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,

23 mod

24));

26// src/cli.ts

27var import_node_fs2 = require("fs");

28var import_promises2 = require("fs/promises");

29var import_node_os2 = require("os");

30var import_node_path2 = require("path");

31var import_node_zlib = require("zlib");

32var import_node_child_process = require("child_process");

33var import_node_fs3 = require("fs");

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli.jsView on unpkg · L31

34var os = __toESM(require("os"));

35var path = __toESM(require("path"));

37// src/index.ts

38var import_node_fs = require("fs");

39var import_promises = require("fs/promises");

40var import_node_path = require("path");

41var import_node_os = require("os");

42var ExploreError = class extends Error {

43};

44var PandaStackError = class extends Error {

45 statusCode;

46 response;

47 constructor(message, statusCode, response) {

48 super(message);

49 this.name = new.target.name;

50 this.statusCode = statusCode;

51 this.response = response;