registry / @prefactor/cli / 0.3.0
@prefactor/cli@0.3.0
Prefactor command-line interface
Static Scan Results
scanned 2mo ago · by rust-scannerStatic analysis flagged 8 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
One or more suspicious static signals were detected.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemShell
HighEntropyStringsUrlStrings
Source & flagged code
4 flaggeddist/install/platform.jsView file
1import { execFileSync } from 'node:child_process';
L2: function normalizePlatform(platform) {
High
Child Process
Package source references child process execution.
dist/install/platform.jsView on unpkg · L1dist/install/installer.jsView file
214if (platform === 'windows') {
L215: const powershell = process.env.ComSpec ? 'powershell.exe' : 'powershell';
L216: await new Promise((resolvePromise, reject) => {
High
dist/bin/cli.cjsView file
495Cross-file remote execution chain: dist/bin/cli.cjs spawns dist/bin/cli.js; helper contains network access plus dynamic code execution.
L495: var import_commander6 = require("commander");
L496: // packages/cli/package.json
L497: var package_default = {
...
L526: type: "git",
L527: url: "git+https://github.com/prefactordev/typescript-sdk.git",
L528: directory: "packages/cli"
...
L558: method: "PUT",
L559: body: { details }
L560: });
...
L694: async function findConfigPath() {
L695: const directoryRoot = await findDirectoryRoot(process.cwd());
L696: const directoryRootConfigPath = import_node_path.resolve(directoryRoot, CONFIG_FILENAME);
Findings
4 High1 Medium3 Low
HighChild Processdist/install/platform.js
HighShelldist/install/installer.js
HighCross File Remote Execution Contextdist/bin/cli.cjs
HighSemantic Analysis Limitedpackage.json
MediumEnvironment Vars
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @prefactor/cli@0.3.0.
See all versions of @prefactor/cli for other recorded verdicts.
- Review the evidence and your use of @prefactor/cli@0.3.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.