registry / @polka-codes/cli / 0.11.0

@polka-codes/cli@0.11.0

[![npm version](https://img.shields.io/npm/v/@polka-codes/cli.svg)](https://www.npmjs.com/package/@polka-codes/cli) [![npm downloads](https://img.shields.io/npm/dm/@polka-codes/cli.svg)](https://www.npmjs.com/package/@polka-codes/cli) [![License](https://

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 16 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

CopyleftLicense

scanned 1 file(s), 687 KB of source, external domains: cli.github.com, github.com, openrouter.ai, polka.codes

Oversized source lightweight scan

dist/bin.cjs4.70 MB file, sampled 256 KB

FilesystemChildProcessEnvironmentVarsCryptoDynamicRequireHighEntropyStringsUrlStringsgithub.com

Source & flagged code

8 flagged

dist/index.jsView file

Lines 1-36javascript

1import { createRequire } from "node:module";

2var __defProp = Object.defineProperty;

3var __returnValue = (v) => v;

4function __exportSetter(name, newValue) {

5 this[name] = __returnValue.bind(null, newValue);

7var __export = (target, all) => {

8 for (var name in all)

9 __defProp(target, name, {

10 get: all[name],

11 enumerable: true,

12 configurable: true,

13 set: __exportSetter.bind(all, name)

14 });

15};

16var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);

17var __require = /* @__PURE__ */ createRequire(import.meta.url);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L16

19// src/logger.ts

20import { formatWithOptions } from "node:util";

21function createStreamConsole(stdout, stderr) {

22 const isStdoutTTY = "isTTY" in stdout && stdout.isTTY;

23 const isStderrTTY = "isTTY" in stderr && stderr.isTTY;

24 return {

25 log: (...args) => stdout.write(`${formatWithOptions({ colors: isStdoutTTY }, ...args)}

26`),

27 info: (...args) => stdout.write(`${formatWithOptions({ colors: isStdoutTTY }, ...args)}

28`),

29 warn: (...args) => stderr.write(`${formatWithOptions({ colors: isStderrTTY }, ...args)}

30`),

31 error: (...args) => stderr.write(`${formatWithOptions({ colors: isStderrTTY }, ...args)}

32`)

33 };

34}

35var createLogger = (options) => {

36 const { verbose = 0, stream = process.stderr } = options;

Lines 316-356javascript

316 console.error(inspect(responseBody, { depth: null, colors: process.stderr.isTTY }));

317 }

318 if (TRACING_FILE) {

319 appendFileSync(TRACING_FILE, `${JSON.stringify({

320 type: "response",

321 timestamp: new Date().toISOString(),

Lines 1496-1536javascript

1496 default: defaultValue

1497 });

1498 if (result === ".m") {

1499 result = await readMultiline("Enter multiline text (Ctrl+D to finish):");

1500 }

1501 return result;

1502 } catch (error) {

1503 if (error

Lines 1927-1967javascript

1927 }

1928 await new Promise((resolve) => setTimeout(resolve, 50));

1929 process.stderr.write("\x07");

1930 const result = await getUserInput(input3.message, {

1931 default: input3.default

1932

Lines 6851-6891javascript

6851 regex: /password\s*[:=]\s*['"]\w+['"]/i,

6852 type: "Hardcoded password",

6853 severity: 1000 /* CRITICAL */

6854 },

6855 {

6856 regex: /api[_-]?key

dist/sql-wasm.wasmView file

•path = dist/sql-wasm.wasm kind = wasm_module sizeBytes = 659730 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/sql-wasm.wasmView on unpkg

dist/bin.cjsView file

•path = dist/bin.cjs kind = oversized_source_file sizeBytes = 4928982 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/bin.cjsView on unpkg

•path = dist/bin.cjs kind = oversized_cli_entrypoint sizeBytes = 4928982 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/bin.cjsView on unpkg

Source & flagged code

8 flagged · loading source

dist/index.jsView file

1516// src/workflows/workflow.utils.ts L1517: import { execSync } from "node:child_process"; L1518: import { promises as fs } from "node:fs";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L1516

1947return new Promise((resolve, reject) => { L1948: const child = input3.shell === true ? input3.args && input3.args.length > 0 ? spawn(input3.command, input3.args, { shell: true, stdio: "pipe" }) : spawn(input3.command, { shell: tr... L1949: shell: false,

High

Shell

Package source references shell execution.

dist/index.jsView on unpkg · L1947

336apiKey: config.apiKey, L337: baseURL: config.baseUrl, L338: fetch: fetchOverride ... L1516: // src/workflows/workflow.utils.ts L1517: import { execSync } from "node:child_process"; L1518: import { promises as fs } from "node:fs"; ... L3277: L3278: Available tools: git_diff, readFile, readBinaryFile, searchFiles, listFiles. L3279: Do not use executeCommand or shell commands. Do not inspect node_modules, vendor, or other dependency directories. ... L10009: const template = generateSkillTemplate(name); L10010: writeFileSync(join11(skillDir, "SKILL.md"), template); L10011: logger.info(`Created SKILL.md`);

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/index.jsView on unpkg · L336

16var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res); L17: var __require = /* @__PURE__ */ createRequire(import.meta.url); L18:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L16

6871regex: /eval\s*\(/, L6872: type: "Unsafe eval() usage", L6873: severity: 800 /* HIGH */

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/index.jsView on unpkg · L6871

dist/sql-wasm.wasmView file

•path = dist/sql-wasm.wasm kind = wasm_module sizeBytes = 659730 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/sql-wasm.wasmView on unpkg

dist/bin.cjsView file

•path = dist/bin.cjs kind = oversized_source_file sizeBytes = 4928982 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/bin.cjsView on unpkg

•path = dist/bin.cjs kind = oversized_cli_entrypoint sizeBytes = 4928982 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/bin.cjsView on unpkg

Findings

4 High6 Medium6 Low

HighChild Processdist/index.js

HighShelldist/index.js

HighRemote Agent Bridgedist/index.js

HighOversized Source Filedist/bin.cjs

MediumDynamic Requiredist/index.js

MediumNetwork

MediumEnvironment Vars

MediumShips Wasm Moduledist/sql-wasm.wasm

MediumOversized Cli Entrypointdist/bin.cjs

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvaldist/index.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowCopyleft License

Source & flagged code

8 flagged

dist/index.jsView file

Lines 1-36javascript

1import { createRequire } from "node:module";

2var __defProp = Object.defineProperty;

3var __returnValue = (v) => v;

4function __exportSetter(name, newValue) {

5 this[name] = __returnValue.bind(null, newValue);

7var __export = (target, all) => {

8 for (var name in all)

9 __defProp(target, name, {

10 get: all[name],

11 enumerable: true,

12 configurable: true,

13 set: __exportSetter.bind(all, name)

14 });

15};

16var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);

17var __require = /* @__PURE__ */ createRequire(import.meta.url);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L16

19// src/logger.ts

20import { formatWithOptions } from "node:util";

21function createStreamConsole(stdout, stderr) {

22 const isStdoutTTY = "isTTY" in stdout && stdout.isTTY;

23 const isStderrTTY = "isTTY" in stderr && stderr.isTTY;

24 return {

25 log: (...args) => stdout.write(`${formatWithOptions({ colors: isStdoutTTY }, ...args)}

26`),

27 info: (...args) => stdout.write(`${formatWithOptions({ colors: isStdoutTTY }, ...args)}

28`),

29 warn: (...args) => stderr.write(`${formatWithOptions({ colors: isStderrTTY }, ...args)}

30`),

31 error: (...args) => stderr.write(`${formatWithOptions({ colors: isStderrTTY }, ...args)}

32`)

33 };

34}

35var createLogger = (options) => {

36 const { verbose = 0, stream = process.stderr } = options;

Lines 316-356javascript

316 console.error(inspect(responseBody, { depth: null, colors: process.stderr.isTTY }));

317 }

318 if (TRACING_FILE) {

319 appendFileSync(TRACING_FILE, `${JSON.stringify({

320 type: "response",

321 timestamp: new Date().toISOString(),

Lines 1496-1536javascript

1496 default: defaultValue

1497 });

1498 if (result === ".m") {

1499 result = await readMultiline("Enter multiline text (Ctrl+D to finish):");

1500 }

1501 return result;

1502 } catch (error) {

1503 if (error

Lines 1927-1967javascript

1927 }

1928 await new Promise((resolve) => setTimeout(resolve, 50));

1929 process.stderr.write("\x07");

1930 const result = await getUserInput(input3.message, {

1931 default: input3.default

1932

Lines 6851-6891javascript

6851 regex: /password\s*[:=]\s*['"]\w+['"]/i,

6852 type: "Hardcoded password",

6853 severity: 1000 /* CRITICAL */

6854 },

6855 {

6856 regex: /api[_-]?key

dist/sql-wasm.wasmView file

•path = dist/sql-wasm.wasm kind = wasm_module sizeBytes = 659730 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/sql-wasm.wasmView on unpkg

dist/bin.cjsView file

•path = dist/bin.cjs kind = oversized_source_file sizeBytes = 4928982 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/bin.cjsView on unpkg

•path = dist/bin.cjs kind = oversized_cli_entrypoint sizeBytes = 4928982 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/bin.cjsView on unpkg