registry / @picsart/gen-ai / 2.62.0

@picsart/gen-ai@2.62.0

⚠ Under review

Picsart AI CLI — generate images, video, and audio from the terminal

Static Scan Results

scanned 22h ago · by rust-scanner

Static analysis flagged 16 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 1.18 MB of source, external domains: api.picsart.com, cdn.example, github.com, jimmy.warting.se, json-schema.org, nodejs.org, picsart.com, registry.npmjs.org

Source & flagged code

9 flagged

cli.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @picsart/gen-ai@2.59.3 matchedIdentity = npm:QHBpY3NhcnQvZ2VuLWFp:2.59.3 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

cli.jsView on unpkg

1import cu,{supportsColor,supportsColorStderr,Chalk}from'chalk';import*as Ce from'fs';import Ce__default,{readFileSync,existsSync,mkdirSync,readdirSync,cpSync}from'fs';import*as Hi ... L2: `)}

High

Child Process

Package source references child process execution.

cli.jsView on unpkg · L1

1import cu,{supportsColor,supportsColorStderr,Chalk}from'chalk';import*as Ce from'fs';import Ce__default,{readFileSync,existsSync,mkdirSync,readdirSync,cpSync}from'fs';import*as Hi ... L2: `)} ... L8: `);}function ho(t){process.stderr.write(`${t} L9: `);}function DD(t){let{color:e,quiet:r,debug:i,plainMode:n}=t,o=hD;function s(a){GI(process.stdout.isTTY?a:e.strip(a));}return {result(a){GI(a);},info(a){if(r)return;let A=e.blue("... L10: `+r.map(function(i,n){return n+1+") "+i.toString()}).join(`

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

cli.jsView on unpkg · L1

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. cli.js: import cu,{supportsColor,supportsColorStderr,Chalk}from'chalk';import*as Ce from'fs';import Ce__default,{readFileSync,existsSync,mkdirSync,readdirSync,cpSync}from'fs';import*as Hi ... ${a}`;throw new Error(A)}findProvider(e){return this.providers.get(e)||this.parent?.findProvider(e)}typeName(e){return e instanceof Ta?`Token(${e.key})`:this.isClass(e)?e.name:Stri... `)||t.includes("\r")||t.includes("\0"))===false}function Uue(t){let e=(t.headersList.get("referrer-policy",true)??"").split(","),r="";if(e.length)for(let i=e.length;i!==0;i--){let ... `,this[Dde]=a??3e5,this[Sde]=i??3e5,this[Rde]=y??true,this[KQ]=b,this[Ln]=null,this

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

cli.jsView on unpkg

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. cli.js: `))}return r}getOrCreate(e){if(e===t)return this;let r=this.store.get(e);if(r)return r;let i=this.tasks.get(e);if(i)return i.waitUntilResolved();i=new zp;let n=this.providers.get(e... ${a}`;throw new Error(A)}findProvider(e){return this.providers.get(e)||this.parent?.findProvider(e)}typeName(e){return e instanceof Ta?`Token(${e.key})`:this.isClass(e)?e.name:Stri... ${e.format(r)}`.trim())}};oL.exports=c0;});var Qh=C((AHe,lL)=>{var aL=Symbol.for("undici.globalDispatcher.1"),{InvalidArgumentError:kpe}=te(),_pe=za();uL()===void 0&&AL(new _pe);fu... `);}close(){this.#r.close();}get(e){b0(e);let r=this.#A(e);return r?{body:r.body?Buffer.from(r.body.buff

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

cli.jsView on unpkg

1import cu,{supportsColor,supportsColorStderr,Chalk}from'chalk';import*as Ce from'fs';import Ce__default,{readFileSync,existsSync,mkdirSync,readdirSync,cpSync}from'fs';import*as Hi ... L2: `)} ... L6: `)} L7: `}let g=[u,d,...f],h=e.maxWidth??Rd();return ae(g,{color:i,padding:1,borderColor:e.borderColor,maxWidth:h})}var SD=S(()=>{Ut();Yr();});function GI(t){process.stdout.write(`${t} L8: `);}function ho(t){process.stderr.write(`${t} L9: `);}function DD(t){let{color:e,quiet:r,debug:i,plainMode:n}=t,o=hD;function s(a){GI(process.stdout.isTTY?a:e.strip(a));}return {result(a){GI(a);},info(a){if(r)return;let A=e.blue("... L10: `+r.map(function(i,n){return n+1+") "+i.toString()}).join(`

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

cli.jsView on unpkg · L1

1Trigger-reachable command-output exfiltration chain: manifest.main -> cli.js L1: import cu,{supportsColor,supportsColorStderr,Chalk}from'chalk';import*as Ce from'fs';import Ce__default,{readFileSync,existsSync,mkdirSync,readdirSync,cpSync}from'fs';import*as Hi ... L2: `)} ... L6: `)} L7: `}let g=[u,d,...f],h=e.maxWidth??Rd();return ae(g,{color:i,padding:1,borderColor:e.borderColor,maxWidth:h})}var SD=S(()=>{Ut();Yr();});function GI(t){process.stdout.write(`${t} L8: `);}function ho(t){process.stderr.write(`${t} L9: `);}function DD(t){let{color:e,quiet:r,debug:i,plainMode:n}=t,o=hD;function s(a){GI(process.stdout.isTTY?a:e.strip(a));}return {result(a){GI(a);},info(a){if(r)return;let A=e.blue("... L10: `+r.map(function(i,n){return n+1+") "+i.toString()}).join(`

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

cli.jsView on unpkg · L1

13L14: ${a}`;throw new Error(A)}findProvider(e){return this.providers.get(e)||this.parent?.findProvider(e)}typeName(e){return e instanceof Ta?`Token(${e.key})`:this.isClass(e)?e.name:Stri... L15: `)||t.includes("\r")||t.includes("\0"))===false}function Uue(t){let e=(t.headersList.get("referrer-policy",true)??"").split(","),r="";if(e.length)for(let i=e.length;i!==0;i--){let ...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

cli.jsView on unpkg · L13

1import cu,{supportsColor,supportsColorStderr,Chalk}from'chalk';import*as Ce from'fs';import Ce__default,{readFileSync,existsSync,mkdirSync,readdirSync,cpSync}from'fs';import*as Hi ... L2: `)} ... L6: `)} L7: `}let g=[u,d,...f],h=e.maxWidth??Rd();return ae(g,{color:i,padding:1,borderColor:e.borderColor,maxWidth:h})}var SD=S(()=>{Ut();Yr();});function GI(t){process.stdout.write(`${t} L8: `);}function ho(t){process.stderr.write(`${t} L9: `);}function DD(t){let{color:e,quiet:r,debug:i,plainMode:n}=t,o=hD;function s(a){GI(process.stdout.isTTY?a:e.strip(a));}return {result(a){GI(a);},info(a){if(r)return;let A=e.blue("... L10: `+r.map(function(i,n){return n+1+") "+i.toString()}).join(` ... L13: L14: ${a}`;throw new Error(A)}findProvider(e){return this.providers.get(e)||this.parent?.findProvi

Low

Weak Crypto

Package source references weak cryptographic algorithms.

cli.jsView on unpkg · L1

Source & flagged code

9 flagged · loading source

cli.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code