registry  /  @platfory/cli  /  0.1.3

@platfory/cli@0.1.3

Earn from your AI coding tool's wait-state, from any editor or terminal. Install, sign in, and manage Platfory entirely from the shell.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
Supply chain
HighEntropyStringsUrlStrings
Manifest
NoLicense
scanned 5 file(s), 49.6 KB of source, external domains: 127.0.0.1, www.platfory.ai

Source & flagged code

4 flagged · loading source
dist/index.jsView file
3// src/index.ts L4: import { spawnSync } from "node:child_process"; L5:
High
Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L3
335for (const base of docBases) { L336: rcs.push({ path: path3.join(base, "PowerShell", "Microsoft.PowerShell_profile.ps1"), fn: PS_FN }); L337: rcs.push({ path: path3.join(base, "WindowsPowerShell", "Microsoft.PowerShell_profile.ps1"), fn: PS_FN });
High
Shell

Package source references shell execution.

dist/index.jsView on unpkg · L335
868line(" Updating platfory via npm..."); L869: let r = spawnSync("npm", ["install", "-g", "@platfory/cli@latest"], { stdio: "inherit" }); L870: if (r.status !== 0) { ... L874: if (r.status !== 0) { L875: err(` ${cross} Update failed. Try manually: npm install -g @platfory/cli@latest --force`); L876: return 1;
High
Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L868
3// src/index.ts L4: import { spawnSync } from "node:child_process"; L5: ... L41: import * as fs from "node:fs/promises"; L42: var PLATFORY_DIR = path.join(os.homedir(), ".platfory"); L43: var LINE_FILE = path.join(PLATFORY_DIR, "current-line.txt"); ... L80: const raw = await fs.readFile(AUTH_FILE, "utf8"); L81: const parsed = JSON.parse(raw); L82: if (typeof parsed.token === "string" && typeof parsed.apiBaseUrl === "string") { ... L320: const rcs = [ L321: { path: path3.join(home, ".zshrc"), fn: POSIX_FN }, L322: { path: path3.join(home, ".bashrc"), fn: POSIX_FN }
Medium
Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/index.jsView on unpkg · L3

Findings

3 High4 Medium5 Low
HighChild Processdist/index.js
HighShelldist/index.js
HighRuntime Package Installdist/index.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/index.js
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License