registry  /  @photon-ai/cli  /  2.0.0

@photon-ai/cli@2.0.0

Photon CLI — typed terminal UI for the Photon Dashboard. Binary: `photon` (alias `pho`).

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkWebSocket
Supply chain
HighEntropyStringsMinifiedUrlStrings
Manifest
WildcardDependency
scanned 1 file(s), 374 KB of source, external domains: empty.invalid, registry.npmjs.org

Source & flagged code

4 flagged · loading source
dist/photon.jsView file
61(Did you mean one of ${E.join(", ")}?)`;if(E.length===1)return` L62: (Did you mean ${E[0]}?)`;return""}az.suggestSimilar=nz});var DC=T((uq)=>{var sz=i("node:events").EventEmitter,Qu=i("node:child_process"),G0=i("node:path"),R8=i("node:fs"),o=i("node... L63: - specify the name in Command constructor or using .name()`);if(F=F||{},F.isDefault)this._defaultCommandName=D._name;if(F.noHelp||F.hidden)D._hidden=!0;return this._registerCommand...
High
Child Process

Package source references child process execution.

dist/photon.jsView on unpkg · L61
38* CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. L39: */function Z4(D){return D instanceof Buffer||D instanceof Date||D instanceof RegExp?!0:!1}function J4(D){if(D instanceof Buffer){var F=Buffer.alloc?Buffer.alloc(D.length):new Buffe... L40: GFS4: `),console.error(D)};if(!ZD[qD]){if(A1=global[qD]||[],R4(ZD,A1),ZD.close=function(D){function F(u,E){return D.call(ZD,u,function(B){if(!B)L4();if(typeof E==="function")E.appl... ... L46: L47: `);return E.split(",")}switch(D){case"hoist-pattern":case"public-hoist-pattern":return u(F)}return F}F5.exports=D5});var Y5=T((J5)=>{var C5=i("os"),H0=i("path"),Z5=C5.tmpdir(),bX=p... L48: `:`
High
Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/photon.jsView on unpkg · L38
42`;function y4(D,F){var u=[],E="";if(typeof F==="string")F={section:F,whitespace:!1};else F=F||{},F.whitespace=F.whitespace===!0;var B=F.whitespace?" = ":"=";if(Object.keys(D).forEa... L43: `});else if(X&&typeof X==="object")u.push(C);else E+=GF(C)+B+GF(X)+$1}),F.section&&E.length)E="["+GF(F.section)+"]"+$1+E;return u.forEach(function(C,Z,J){var X=b4(C).join("\\."),Y=... L44: ... L46: L47: `);return E.split(",")}switch(D){case"hoist-pattern":case"public-hoist-pattern":return u(F)}return F}F5.exports=D5});var Y5=T((J5)=>{var C5=i("os"),H0=i("path"),Z5=C5.tmpdir(),bX=p... L48: `:`
High
Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/photon.jsView on unpkg · L42
4`);let B=u?yJ:bJ;for(let C=0;C<F.length;C++)E.push.apply(E,B(D,F[C]));return E}function vJ(D){let F={},u=[];for(let E=0;E<D.length;E++){let B=jJ(F,D[E]);F=RJ(B);let C=Object.assign... L5: `)!=-1,E=this._styles,B=E.length;while(B--){var C=R0[E[B]];if(F=C.open+F.replace(C.closeRe,C.open)+C.close,u)F=F.replace(lJ,function(Z){return C.close+Z+C.open})}return F}n.setThem... L6: `))}wrapLines(D){let F=wD.colorizeLines(D);if(this.href)return F.map((u)=>wD.hyperlink(this.href,u));return F}init(D){let F=this.x,u=this.y;this.widths=D.colWidths.slice(F,F+this.c...
Medium
Dynamic Require

Package source references dynamic require/import behavior.

dist/photon.jsView on unpkg · L4

Findings

3 High5 Medium5 Low
HighChild Processdist/photon.js
HighSame File Env Network Executiondist/photon.js
HighCommand Output Exfiltrationdist/photon.js
MediumDynamic Requiredist/photon.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumWildcard Dependency
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings