registry / @radhya/mach / 2.0.33

@radhya/mach@2.0.33

⚠ Under review

Mach CLI: Cloud Build Orchestrator for React Native & Expo

Static Scan Results

scanned 22h ago · by rust-scanner

Static analysis flagged 18 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 6 file(s), 428 KB of source, external domains: 127.0.0.1, 169.254.169.254, api.appstoreconnect.apple.com, app.example.com, appstoreconnect.apple.com, deb.nodesource.com, developer.android.com, developer.apple.com, dl.google.com, example.com, getmach.dev, github.com, mach-api.securejs.in, www.apple.com, www.sitemaps.org

Source & flagged code

10 flagged

dist/index.jsView file

Lines 1-37javascript

1#!/usr/bin/env node

2import{a as Yt,b as at,c as wo,d as Lt,e as ve,f as xe,g as _o,h as $o,i as qt,j as vo,l as gn}from"./chunk-ZPETQEMG.js";import{a as m,b as Eo,c as Ne,d as Io,e as Jt,f as ft,g as st,h as N}from"./chunk-S64YFTRR.js";import{Command as Qg,Option as We}from"commander";import{configDotenv as eh}from"dotenv";import{intro as me,outro as gc}from"@clack/prompts";import ce from"chalk";import{text as Ro,confirm as bc,spinner as Ac,isCancel as Wi,cancel as hn,note as Ec,outro as Ic}from"@clack/prompts";import yn from"chalk";async function Po(){try{let e=await Ro({message:"Enter Bucket Name:",placeholder: ...

3`;s+=`Region: ${yn.cyan(o.region)}

4`,s+=`S3 Website URL: ${yn.blue(o.s3WebsiteUrl)}`,o.cloudFrontId&&(s+=`

6CloudFront ID: ${yn.cyan(o.cloudFrontId)}`,s+=`

7CloudFront URL: ${yn.blue(o.cloudFrontUrl)}`),Ec(s,"Setup Complete!"),Ic("You are all set!")}catch(r){i.stop("Setup failed"),hn(`Error: ${r.response?.data?.message||r.message}`)}}catch(e){hn(`An unexpected error occurred: ${e.message}`)}}import{readdir as wc,writeFile as _c,access as $c,mkdir as vc}from"fs/promises";import{join as Do}from"path";import{spinner as Rc,text as Oo,isCancel as Co,cancel as Ji,note as Pc,outro as Dc}from"@clack/prompts";import Oc from"chalk";async function Cc(){let e=["./app","./src/app"];for(let t of e)try{return await $c(t),t}catch{}return null}async function ko( ...

8${s.map(u=>` \u2022 ${u.path}`).join(`

9`)}`,"Sitemap Summary"),Dc(`Sitemap saved to ${Oc.cyan(a)}`)}catch(t){Ji(`An error occurred: ${t.message}`)}}async function To(e,t=""){let n=[];try{let i=await wc(e,{withFileTypes:!0});for(let r of i){let o=Do(e,r.name);if(!(r.name.startsWith("_")||r.name.startsWith("."

10<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">

11${e.map(r=>{let o=r.path;return o=o.replace(/\/$[^)]+$/g,""),o=o.replace(/\/\[.*?\]/g,"/:id"),o=o.replace(/\/+/g

12 <loc>${t}${o}</loc>

13 <lastmod>${n}</lastmod>

14 <changefreq>weekly</changefreq>

15 <priority>0.8</priority>

16 </url>`}).join(`

17`)}

18</urlset>`}import{randomUUID as bp}from"crypto";import Ae from"path";import si from"axios";import Ap from"os";import{spinner as Cr,select as Vs,confirm as Ks,isCancel as ai,cancel as zs,log as R}from"@clack/prompts";import D from"chalk";import fe from"fs";import{execSync as Ws}from"child_process";import Js from"adm-zip";import{spinner as jc,log as Jn}from"@clack/prompts";import Lo from"chalk";import Mo from"fs";import Uo from"path";var No=`#!/bin/bash

19# --- Mach Cloud Build Script (Android) ---

20# All S3 operations use presigned URLs via curl \u2014 zero AWS credentials on instance.

21BUILD_ID="{{BUILD_ID}}"

23# --- System Setup ---

24exec > >(tee /var/log/user-data.log | cat) 2>&1

25export PYTHONUNBUFFERED=1

26export GRADLE_OPTS="-Dorg.gradle.console=plain"

27echo "Starting build setup..."

29# Forward environment variables (includes PRESIGNED_* URLs + project secrets)

30{{ENV_VARS}}

31export HUSKY=0

32export CI=true

33export npm_config_engine_strict=false

34export npm_config_ignore_engines=true

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

dist/index.jsView on unpkg · L17

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/index.jsView on unpkg · L1

35export YARN_IGNORE_ENGINES=1

37# Check if this is a Pre-Warmed Mach AMI

Long lines were clipped for display.

Lines 603-643javascript

603post_install do |installer|

604${F}

605end

606`;Ue.appendFileSync(_,O)}let P="/opt/homebrew/bin/pod",w=Ue.existsSync(P)?P:"pod",T=d(E);Ue.existsSync(Xt.join(E,"Pods"))&&i.pods&&i.pods!==T&&(await e.reportLog(`[CACHE] Podfile/Podfile.lock changed \u2014 wiping ios/Pods

607`),Le.info(Me.dim("Podfile fingerprint changed \u2014 clearing Pods for clean install...")),Ue.rmSync(Xt.join(E,"Pods"),{recursive:!0,force:!0})),Le.info(Me.dim(`Using pod command: ${w} in ${E}`)),await l(w,["install"],E,b),i.pods=T,u(r,i)}catch(E){let _=E.message||"Unknown error";Le.warn(Me.yellow(`Native "pod"

Lines 1409-1449javascript

1409`)}),i}async function gs(e,t){e&&await new Promise(n=>{let i=!1,r=()=>{i||(i=!0,n())};e.once("exit",r),e.once("close",r),e.killed||(L.appendFileSync(t,`Stopping iOS simulator recording...

1410`),e.kill("SIGINT")),setTimeout(()=>{!i&&!e.killed&&(L.appendFileSync(t,`[WARN] iOS simulator recording did not stop after SIGINT; sending SIGKILL.

1411`),e.kill("SIGKILL")),r()},5e3).unref?.()})}function du(e,t){let n=Ps(e,t);if(!n)return;L.appendFileSync(t,`Uninstalling existing iOS app data for ${n} if present...

1412`),Et("xcrun",["simctl","uninstall","booted",n],t)!==0&&L.appendFileSync(t,`No existing app install removed for ${n}; continuing.

1413`)}function uu(e,t){if(!e?.appId)return;if(L.appendFileSync(t,`Cleaning up installed app after Maestro run...

1414`),e.platform==="ios"){let r=Et("xcrun",["simctl","uninstall","booted",e.appId],t);r===0?L.appendFileSync(t,`Uninstalled iOS app ${e.appId} after Maestro run.

1533patternName = generic_password severity = medium line = 1533 matchedText = `).filte...in(`

Medium

Secret Pattern

Hardcoded password in dist/index.js

dist/index.jsView on unpkg · L1533

dist/chunk-ZPETQEMG.jsView file

Lines 1-57javascript

expo-plugin/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @radhya/mach@2.0.31 matchedIdentity = npm:QHJhZGh5YS9tYWNo:2.0.31 similarity = 0.833 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

expo-plugin/index.jsView on unpkg

Source & flagged code

10 flagged · loading source

dist/index.jsView file

1429patternName = private_key_rsa severity = critical line = 1429 matchedText = `):n||e....----

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/index.jsView on unpkg · L1429

17`)} L18: </urlset>`}import{randomUUID as bp}from"crypto";import Ae from"path";import si from"axios";import Ap from"os";import{spinner as Cr,select as Vs,confirm as Ks,isCancel as ai,cancel ... L19: # --- Mach Cloud Build Script (Android) --- ... L32: export CI=true L33: export npm[redacted]=false L34: export npm[redacted]=true

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

dist/index.jsView on unpkg · L17

623Trigger-reachable chain: manifest.main -> dist/index.js L623: `),Mt.info(Ut.dim("React Native Podfile fingerprint changed - clearing Pods for clean install...")),mt.rmSync(g,{recursive:!0,force:!0})):_&&Nc(y,E)&&(await s(`[CACHE] React Native... L624: `),Mt.info(Ut.dim("React Native Pods manifest is out of sync - clearing Pods for clean install...")),mt.rmSync(g,{recursive:!0,force:!0}));let x="/opt/homebrew/bin/pod",I=mt.exists... L625: `):"",f;if(r){let b=Uo.isAbsolute(r)?r:Uo.resolve(process.cwd(),r);Mo.existsSync(b)?(f=Mo.readFileSync(b,"utf-8"),Jn.info(Lo.magenta(`\u2713 Loaded preBuild hook: ${r}`))):Jn.warn(... ... L631: {{ENV_VARS}} L632: `).replace("{{FRAMEWORK_ANDROID_VERSION_CODE}}",s.androidRemoteVersionCodeScript().trim()).replace("{{FRAMEWORK_ANDROID_PREBUILD}}",s.androidRemotePrebuildScript().trim()).replace(... L633: # --- Mach Cloud Build Script (iOS) ---

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg · L623

1429patternName = private_key_rsa severity = critical line = 1429 matchedText = `):n||e....----

Critical

Secret Pattern

RSA private key in dist/index.js

dist/index.jsView on unpkg · L1429

1#!/usr/bin/env node L2: import{a as Yt,b as at,c as wo,d as Lt,e as ve,f as xe,g as _o,h as $o,i as qt,j as vo,l as gn}from"./chunk-ZPETQEMG.js";import{a as m,b as Eo,c as Ne,d as Io,e as Jt,f as ft,g as ... L3: `;s+=`Region: ${yn.cyan(o.region)} ... L6: CloudFront ID: ${yn.cyan(o.cloudFrontId)}`,s+=` L7: CloudFront URL: ${yn.blue(o.cloudFrontUrl)}`),Ec(s,"Setup Complete!"),Ic("You are all set!")}catch(r){i.stop("Setup failed"),hn(`Error: ${r.response?.data?.message||r.message}`)}... L8: ${s.map(u=>` \u2022 ${u.path}`).join(` ... L17: `)} L18: </urlset>`}import{randomUUID as bp}from"crypto";import Ae from"path";import si from"axios";import Ap from"os";import{spinner as Cr,select as Vs,confirm as Ks,isCancel as ai,cancel ... L19: # --- Mach Cloud Build Script (Android) --- ... L32: export CI=true L33: export npm[redacted]=false L34: export npm[redacted]=true

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/index.jsView on unpkg · L1

1533patternName = generic_password severity = medium line = 1533 matchedText = `).filte...in(`

Medium

Secret Pattern

Hardcoded password in dist/index.js

dist/index.jsView on unpkg · L1533

dist/chunk-ZPETQEMG.jsView file

1import{a as m,h as V}from"./chunk-S64YFTRR.js";import{log as o,spinner as Ae,text as q,password as ve,select as ne,confirm as dt,isCancel as T,cancel as H,intro as Dt,outro as Jt,n... L2: Apple Team ID is required to fetch certificates.`)),ie.info(ae.dim("You can find this at: https://developer.apple.com/account -> Membership Details"));let e=await bt({message:"Ente...

High

Child Process

Package source references child process execution.

dist/chunk-ZPETQEMG.jsView on unpkg · L1

15L16: 1. Open: ${F.cyan("https://appstoreconnect.apple.com/access/integrations/api")} L17: 2. Find Key ID: ${F.green(v)} L18: 3. Click ${F.bold("Download API Key")} (only available once) L19: 4. Drag & drop the downloaded .p8 file below`,"Manual Step Required");let b=await Q({message:"Path to the downloaded .p8 file (drag & drop here):",validate:D=>E.existsSync(D)?void ... L20: ${c.stderr||""}`);if(p.length>0){n.stop("Select App Store Connect team");let A=await le({message:"Select the App Store Connect team to list API keys:",options:p.map(v=>({value:v.id... L21: `).split(/\r?\n/).map(n=>n.trim()).filter(Boolean);return t.length>0?t.slice(-8).join(` ... L29: `)?n:`${n} L30: `,"utf8")),r.writeZip(a),a},mt=e=>{let t=e.toLowerCase();return t==="production"||t==="prod"||t.includes("store")||t.endsWith("-production")||t.endsWith("-prod")},on=e=>{let t=e.to... L31: `).map(G=>G.trim()).filter(G=>G.length>0),te].join(" ");O(`security list-keychains -d user -s ${S}`)}}catch(R){o.warn(d.dim("Keychain setup warning (non-critical): "+R.message))}le...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/chunk-ZPETQEMG.jsView on unpkg · L15

37patternName = generic_password severity = medium line = 37 matchedText = Manual U...in(`

Medium

Secret Pattern

Hardcoded password in dist/chunk-ZPETQEMG.js

dist/chunk-ZPETQEMG.jsView on unpkg · L37

expo-plugin/index.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

expo-plugin/index.jsView on unpkg

Findings

5 Critical2 High6 Medium5 Low

CriticalCritical Secretdist/index.js

CriticalSame File Env Network Executiondist/index.js

CriticalTrigger Reachable Dangerous Capabilitydist/index.js

CriticalPrevious Version Dangerous Deltaexpo-plugin/index.js

CriticalSecret Patterndist/index.js

HighChild Processdist/chunk-ZPETQEMG.js

HighCommand Output Exfiltrationdist/chunk-ZPETQEMG.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/index.js

MediumStructural Risk Force Deep Review

MediumSecret Patterndist/chunk-ZPETQEMG.js

MediumSecret Patterndist/index.js

LowScripts Present

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

10 flagged

dist/index.jsView file

Lines 1-37javascript

1#!/usr/bin/env node

3`;s+=`Region: ${yn.cyan(o.region)}

4`,s+=`S3 Website URL: ${yn.blue(o.s3WebsiteUrl)}`,o.cloudFrontId&&(s+=`

6CloudFront ID: ${yn.cyan(o.cloudFrontId)}`,s+=`

8${s.map(u=>` \u2022 ${u.path}`).join(`

10<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">

11${e.map(r=>{let o=r.path;return o=o.replace(/\/$[^)]+$/g,""),o=o.replace(/\/\[.*?\]/g,"/:id"),o=o.replace(/\/+/g

12 <loc>${t}${o}</loc>

13 <lastmod>${n}</lastmod>

14 <changefreq>weekly</changefreq>

15 <priority>0.8</priority>

16 </url>`}).join(`

17`)}

19# --- Mach Cloud Build Script (Android) ---

20# All S3 operations use presigned URLs via curl \u2014 zero AWS credentials on instance.

21BUILD_ID="{{BUILD_ID}}"

23# --- System Setup ---

24exec > >(tee /var/log/user-data.log | cat) 2>&1

25export PYTHONUNBUFFERED=1

26export GRADLE_OPTS="-Dorg.gradle.console=plain"

27echo "Starting build setup..."

29# Forward environment variables (includes PRESIGNED_* URLs + project secrets)

30{{ENV_VARS}}

31export HUSKY=0

32export CI=true

33export npm_config_engine_strict=false

34export npm_config_ignore_engines=true

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

dist/index.jsView on unpkg · L17

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/index.jsView on unpkg · L1

35export YARN_IGNORE_ENGINES=1

37# Check if this is a Pre-Warmed Mach AMI

Long lines were clipped for display.

Lines 603-643javascript

603post_install do |installer|

604${F}

605end

Lines 1409-1449javascript

1409`)}),i}async function gs(e,t){e&&await new Promise(n=>{let i=!1,r=()=>{i||(i=!0,n())};e.once("exit",r),e.once("close",r),e.killed||(L.appendFileSync(t,`Stopping iOS simulator recording...

1410`),e.kill("SIGINT")),setTimeout(()=>{!i&&!e.killed&&(L.appendFileSync(t,`[WARN] iOS simulator recording did not stop after SIGINT; sending SIGKILL.

1411`),e.kill("SIGKILL")),r()},5e3).unref?.()})}function du(e,t){let n=Ps(e,t);if(!n)return;L.appendFileSync(t,`Uninstalling existing iOS app data for ${n} if present...

1412`),Et("xcrun",["simctl","uninstall","booted",n],t)!==0&&L.appendFileSync(t,`No existing app install removed for ${n}; continuing.

1413`)}function uu(e,t){if(!e?.appId)return;if(L.appendFileSync(t,`Cleaning up installed app after Maestro run...

1414`),e.platform==="ios"){let r=Et("xcrun",["simctl","uninstall","booted",e.appId],t);r===0?L.appendFileSync(t,`Uninstalled iOS app ${e.appId} after Maestro run.

1533patternName = generic_password severity = medium line = 1533 matchedText = `).filte...in(`

Medium

Secret Pattern

Hardcoded password in dist/index.js

dist/index.jsView on unpkg · L1533

dist/chunk-ZPETQEMG.jsView file

Lines 1-57javascript

expo-plugin/index.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

expo-plugin/index.jsView on unpkg