registry / @polpo-ai/cli / 0.13.0

@polpo-ai/cli@0.13.0

Command-line client for Polpo — create/link/deploy cloud projects from your terminal.

Static Scan Results

scanned 4h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 41 file(s), 230 KB of source, external domains: api.polpo.sh, docs.polpo.sh, nodejs.org, polpo.sh, registry.npmjs.org, your-project-slug.polpo.cloud

Source & flagged code

3 flagged

dist/util/install-cli.jsView file

Lines 1-32javascript

1/**

2 * Detect + install the `@polpo-ai/cli` package globally.

3 *

4 * Called at the end of `polpo create`: if the user ran via

5 * `npx @polpo-ai/cli create` they DON'T have the `polpo` bin on PATH

6 * after the wizard ends — they'd have to keep using `npx`. Offering a

7 * one-shot global install saves them from that.

8 *

9 * Skipped when `polpo` is already on PATH (user already installed it).

10 */

11import { exec, execSync } from "node:child_process";

12import { promisify } from "node:util";

High

Child Process

Package source references child process execution.

dist/util/install-cli.jsView on unpkg · L10

13const execAsync = promisify(exec);

14export const CLI_PACKAGE = "@polpo-ai/cli";

High

Shell

Package source references shell execution.

dist/util/install-cli.jsView on unpkg · L12

15/**

16 * `true` when the `polpo` bin is already on PATH *globally* — i.e. not

17 * via an npx temp dir.

18 *

19 * When the wizard runs via `npx @polpo-ai/cli create`, npx injects a

20 * temporary bin directory into PATH for the lifetime of the invocation.

21 * `which polpo` then finds *our own* bin (the npx cache copy), which

22 * would falsely report "already installed" and skip the global install

23 * step. We filter out npx cache paths (they typically live under

24 * `_npx` inside the npm cache) to avoid that trap.

25 */

26export function isPolpoOnPath() {

27 try {

28 const cmd = process.platform === "win32" ? "where polpo" : "which polpo";

29 const out = execSync(cmd, { stdio: ["ignore", "pipe", "ignore"] })

30 .toString()

31 .trim()

32 .split("\n")[0] ?? "";

dist/util/self-update.jsView file

Lines 30-70javascript

30 * Fetch the latest published version from the npm registry.

31 */

32export async function getLatestVersion() {

33 // npm registry needs scoped names URL-encoded ("@polpo-ai/cli" → "@polpo-ai%2Fcli")

34 const encoded = PACKAGE_NAME.replace("/", "%2F");

Source & flagged code

3 flagged · loading source

dist/util/install-cli.jsView file

10*/ L11: import { exec, execSync } from "node:child_process"; L12: import { promisify } from "node:util";

High

Child Process

Package source references child process execution.

dist/util/install-cli.jsView on unpkg · L10

12import { promisify } from "node:util"; L13: const execAsync = promisify(exec); L14: export const CLI_PACKAGE = "@polpo-ai/cli";

High

Shell

Package source references shell execution.

dist/util/install-cli.jsView on unpkg · L12

dist/util/self-update.jsView file

50const cmd = pm === "pnpm" L51: ? `pnpm add -g ${PACKAGE_NAME}@${version}` L52: : `npm install -g ${PACKAGE_NAME}@${version}`; ... L54: try { L55: execSync("npm cache clean --force", { stdio: "ignore", timeout: 30_000 }); L56: }

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/util/self-update.jsView on unpkg · L50

Findings

3 High3 Medium4 Low

HighChild Processdist/util/install-cli.js

HighShelldist/util/install-cli.js

HighRuntime Package Installdist/util/self-update.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

dist/util/install-cli.jsView file

Lines 1-32javascript

1/**

2 * Detect + install the `@polpo-ai/cli` package globally.

3 *

4 * Called at the end of `polpo create`: if the user ran via

5 * `npx @polpo-ai/cli create` they DON'T have the `polpo` bin on PATH

6 * after the wizard ends — they'd have to keep using `npx`. Offering a

7 * one-shot global install saves them from that.

8 *

9 * Skipped when `polpo` is already on PATH (user already installed it).

10 */

11import { exec, execSync } from "node:child_process";

12import { promisify } from "node:util";

High

Child Process

Package source references child process execution.

dist/util/install-cli.jsView on unpkg · L10

13const execAsync = promisify(exec);

14export const CLI_PACKAGE = "@polpo-ai/cli";

High

Shell

Package source references shell execution.

dist/util/install-cli.jsView on unpkg · L12

15/**

16 * `true` when the `polpo` bin is already on PATH *globally* — i.e. not

17 * via an npx temp dir.

18 *

19 * When the wizard runs via `npx @polpo-ai/cli create`, npx injects a

20 * temporary bin directory into PATH for the lifetime of the invocation.

21 * `which polpo` then finds *our own* bin (the npx cache copy), which

22 * would falsely report "already installed" and skip the global install

23 * step. We filter out npx cache paths (they typically live under

24 * `_npx` inside the npm cache) to avoid that trap.

25 */

26export function isPolpoOnPath() {

27 try {

28 const cmd = process.platform === "win32" ? "where polpo" : "which polpo";

29 const out = execSync(cmd, { stdio: ["ignore", "pipe", "ignore"] })

30 .toString()

31 .trim()

32 .split("\n")[0] ?? "";

dist/util/self-update.jsView file

Lines 30-70javascript

30 * Fetch the latest published version from the npm registry.

31 */

32export async function getLatestVersion() {

33 // npm registry needs scoped names URL-encoded ("@polpo-ai/cli" → "@polpo-ai%2Fcli")

34 const encoded = PACKAGE_NAME.replace("/", "%2F");