registry / @pushpalsdev/cli / 1.1.85

@pushpalsdev/cli@1.1.85

⚠ Under review

PushPals terminal CLI for LocalBuddy -> RemoteBuddy orchestration

Static Scan Results

scanned 7h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 54 file(s), 3.06 MB of source, external domains: 127.0.0.1, api.github.com, bun.sh, dev.to, docs.swmansion.com, github.com, json-schema.org, phony.example, placeholder.base, raw.githubusercontent.com, react.dev, reactnavigation.org, www.w3.org

Source & flagged code

5 flagged

monitor-ui/_expo/static/js/web/entry-27d949ee6f58744867b482046e5f00db.jsView file

251__d(function(g,r,i,a,m,e,d){"use strict";Object.defineProperty(e,'__esModule',{value:!0}),Object.defineProperty(e,"EventEmitter",{enumerable:!0,get:function(){return t}}),Object.de... L252: __d(function(g,r,i,a,m,_e,d){"use strict";function _interopDefault(e){return e&&e.__esModule?e:{default:e}}Object.defineProperty(_e,'__esModule',{value:!0}),Object.defineProperty(_... L253: __d(function(g,r,_i,_a,m,_e,_d){'use strict';function e(e,t,n,o){switch(e){case 0:return t&n^~t&o;case 1:case 3:return t^n^o;case 2:return t&n^t&o^n&o;default:return 0}}function t(...

High

Eval

Package source references dynamic code evaluation.

monitor-ui/_expo/static/js/web/entry-27d949ee6f58744867b482046e5f00db.jsView on unpkg · L251

bin/pushpals.cjsView file

Lines 1-23javascript

1#!/usr/bin/env node

2"use strict";

4const { spawn, spawnSync } = require("node:child_process");

5const { existsSync, mkdirSync, readFileSync, rmSync } = require("node:fs");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/pushpals.cjsView on unpkg · L3

6const { tmpdir } = require("node:os");

7const { dirname, join, resolve } = require("node:path");

9const bundledCliPath = resolve(__dirname, "..", "dist", "pushpals-cli.js");

10const packageJsonPath = resolve(__dirname, "..", "package.json");

11const releaseUrl = "https://github.com/PushPalsDev/pushpals/releases";

12const DEFAULT_BUN_PROBE_TIMEOUT_MS = 10_000;

13const DEFAULT_BOOTSTRAP_TIMEOUT_MS = 5 * 60 * 1000;

14const BUN_PROBE_TIMEOUT_ENV = "PUSHPALS_BUN_PROBE_TIMEOUT_MS";

15const BOOTSTRAP_TIMEOUT_ENV = "PUSHPALS_CLI_BOOTSTRAP_TIMEOUT_MS";

16const BOOTSTRAP_READY_MARKER_ENV = "PUSHPALS_CLI_READY_MARKER";

17let packageVersion = "";

18let readyMarkerPath = "";

19let resolvedBunCommand = "";

20if (existsSync(packageJsonPath)) {

21 try {

22 const parsed = JSON.parse(readFileSync(packageJsonPath, "utf8"));

23 packageVersion = String(parsed?.version ?? "").trim();

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/pushpals.cjsView on unpkg · L3

dist/pushpals-cli.jsView file

Lines 4-44javascript

4// ../../scripts/pushpals-cli.ts

5import {

6 appendFileSync,

7 chmodSync,

8 cpSync,

9 existsSync as existsSync5,

10 lstatSync,

11 mkdirSync,

12 readdirSync,

13 readFileSync as

runtime/sandbox/apps/workerpals/src/backends/openai_codex/openai_codex_executor.pyView file

•path = [redacted]openai_codex/openai_codex_executor.py kind = build_helper sizeBytes = 165724 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

runtime/sandbox/apps/workerpals/src/backends/openai_codex/openai_codex_executor.pyView on unpkg

Source & flagged code

5 flagged · loading source

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code