registry / @radhya/mach / 2.0.37

@radhya/mach@2.0.37

⚠ Under review

Mach CLI: Cloud Build Orchestrator for React Native & Expo

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 18 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 6 file(s), 424 KB of source, external domains: 127.0.0.1, 169.254.169.254, api.appstoreconnect.apple.com, app.example.com, appstoreconnect.apple.com, deb.nodesource.com, developer.android.com, developer.apple.com, dl.google.com, example.com, getmach.dev, github.com, mach-api.securejs.in, www.apple.com, www.sitemaps.org

Source & flagged code

10 flagged

dist/index.jsView file

Lines 1-37javascript

1#!/usr/bin/env node

2import{a as zt,b as He,c as $o,d as Tt,e as ve,f as xe,g as vo,h as Ro,i as Wt,j as Po,l as mn}from"./chunk-ZPETQEMG.js";import{a as m,b as

Source & flagged code

10 flagged · loading source

dist/index.jsView file

1427patternName = private_key_rsa severity = critical line = 1427 matchedText = `):n||e....----

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/index.jsView on unpkg · L1427

17`)} L18: </urlset>`}import{randomUUID as hp}from"crypto";import Ee from"path";import ai from"axios";import yp from"os";import{spinner as Tr,select as Ks,confirm as zs,isCancel as li,cancel ... L19: # --- Mach Cloud Build Script (Android) --- ... L32: export CI=true L33: export npm[redacted]=false L34: export npm[redacted]=true

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

dist/index.jsView on unpkg · L17

623Trigger-reachable chain: manifest.main -> dist/index.js L623: `),Nt.info(xt.dim("React Native Podfile fingerprint changed - clearing Pods for clean install...")),ut.rmSync(g,{recursive:!0,force:!0})):_&&Tc(y,h)&&(await s(`[CACHE] React Native... L624: `),Nt.info(xt.dim("React Native Pods manifest is out of sync - clearing Pods for clean install...")),ut.rmSync(g,{recursive:!0,force:!0}));let T="/opt/homebrew/bin/pod",w=ut.exists... L625: `):"",f;if(r){let I=Bo.isAbsolute(r)?r:Bo.resolve(process.cwd(),r);Fo.existsSync(I)?(f=Fo.readFileSync(I,"utf-8"),qn.info(Uo.magenta(`\u2713 Loaded preBuild hook: ${r}`))):qn.warn(... ... L631: {{ENV_VARS}} L632: `).replace("{{FRAMEWORK_ANDROID_VERSION_CODE}}",s.androidRemoteVersionCodeScript().trim()).replace("{{FRAMEWORK_ANDROID_PREBUILD}}",s.androidRemotePrebuildScript().trim()).replace(... L633: # --- Mach Cloud Build Script (iOS) ---

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg · L623

1427patternName = private_key_rsa severity = critical line = 1427 matchedText = `):n||e....----

Critical

Secret Pattern

RSA private key in dist/index.js

dist/index.jsView on unpkg · L1427

1#!/usr/bin/env node L2: import{a as zt,b as He,c as $o,d as Tt,e as ve,f as xe,g as vo,h as Ro,i as Wt,j as Po,l as mn}from"./chunk-ZPETQEMG.js";import{a as m,b as wo,c as Ne,d as _o,e as Kt,f as dt,g as ... L3: `;s+=`Region: ${hn.cyan(o.region)} ... L6: CloudFront ID: ${hn.cyan(o.cloudFrontId)}`,s+=` L7: CloudFront URL: ${hn.blue(o.cloudFrontUrl)}`),Ac(s,"Setup Complete!"),Ec("You are all set!")}catch(r){i.stop("Setup failed"),gn(`Error: ${r.response?.data?.message||r.message}`)}... L8: ${s.map(u=>` \u2022 ${u.path}`).join(` ... L17: `)} L18: </urlset>`}import{randomUUID as hp}from"crypto";import Ee from"path";import ai from"axios";import yp from"os";import{spinner as Tr,select as Ks,confirm as zs,isCancel as li,cancel ... L19: # --- Mach Cloud Build Script (Android) --- ... L32: export CI=true L33: export npm[redacted]=false L34: export npm[redacted]=true

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/index.jsView on unpkg · L1

1531patternName = generic_password severity = medium line = 1531 matchedText = `).filte...in(`

Medium

Secret Pattern

Hardcoded password in dist/index.js

dist/index.jsView on unpkg · L1531

dist/chunk-ZPETQEMG.jsView file

1import{a as m,h as V}from"./chunk-S64YFTRR.js";import{log as o,spinner as Ae,text as q,password as ve,select as ne,confirm as dt,isCancel as T,cancel as H,intro as Dt,outro as Jt,n... L2: Apple Team ID is required to fetch certificates.`)),ie.info(ae.dim("You can find this at: https://developer.apple.com/account -> Membership Details"));let e=await bt({message:"Ente...

High

Child Process

Package source references child process execution.

dist/chunk-ZPETQEMG.jsView on unpkg · L1

15L16: 1. Open: ${F.cyan("https://appstoreconnect.apple.com/access/integrations/api")} L17: 2. Find Key ID: ${F.green(v)} L18: 3. Click ${F.bold("Download API Key")} (only available once) L19: 4. Drag & drop the downloaded .p8 file below`,"Manual Step Required");let b=await Q({message:"Path to the downloaded .p8 file (drag & drop here):",validate:D=>E.existsSync(D)?void ... L20: ${c.stderr||""}`);if(p.length>0){n.stop("Select App Store Connect team");let A=await le({message:"Select the App Store Connect team to list API keys:",options:p.map(v=>({value:v.id... L21: `).split(/\r?\n/).map(n=>n.trim()).filter(Boolean);return t.length>0?t.slice(-8).join(` ... L29: `)?n:`${n} L30: `,"utf8")),r.writeZip(a),a},mt=e=>{let t=e.toLowerCase();return t==="production"||t==="prod"||t.includes("store")||t.endsWith("-production")||t.endsWith("-prod")},on=e=>{let t=e.to... L31: `).map(G=>G.trim()).filter(G=>G.length>0),te].join(" ");O(`security list-keychains -d user -s ${S}`)}}catch(R){o.warn(d.dim("Keychain setup warning (non-critical): "+R.message))}le...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/chunk-ZPETQEMG.jsView on unpkg · L15

37patternName = generic_password severity = medium line = 37 matchedText = Manual U...in(`

Medium

Secret Pattern

Hardcoded password in dist/chunk-ZPETQEMG.js

dist/chunk-ZPETQEMG.jsView on unpkg · L37

expo-plugin/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @radhya/mach@2.0.31 matchedIdentity = npm:QHJhZGh5YS9tYWNo:2.0.31 similarity = 0.833 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

expo-plugin/index.jsView on unpkg

Findings

5 Critical2 High6 Medium5 Low

CriticalCritical Secretdist/index.js

CriticalSame File Env Network Executiondist/index.js

CriticalTrigger Reachable Dangerous Capabilitydist/index.js

CriticalPrevious Version Dangerous Deltaexpo-plugin/index.js

CriticalSecret Patterndist/index.js

HighChild Processdist/chunk-ZPETQEMG.js

HighCommand Output Exfiltrationdist/chunk-ZPETQEMG.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/index.js

MediumStructural Risk Force Deep Review

MediumSecret Patterndist/chunk-ZPETQEMG.js

MediumSecret Patterndist/index.js

LowScripts Present

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

Lines 603-643javascript

603post_install do |installer|

604${U}

605end

606`;Ue.appendFileSync(_,P)}let J="/opt/homebrew/bin/pod",A=Ue.existsSync(J)?J:"pod",v=d(h);Ue.existsSync(Jt.join(h,"Pods"))&&i.pods&&i.pods!==v&&(await e.reportLog(`[CACHE] Podfile/Podfile.lock changed \u2014 wiping ios/Pods

607`),Le.info(Me.dim("Podfile fingerprint changed \u2014 clearing Pods for clean install...")),Ue.rmSync(Jt.join(h,"Pods"),{recursive:!0,force:!0})),Le.info(Me.dim(`Using pod command: ${A} in ${h}`)),await l(A,["install"],h,I),i.pods=v,u(r,i)}catch(h){let _=h.message||"Unknown error";Le.warn(Me.yellow(`Native "pod" command failed: ${_}`)),Le.info(Me.dim("Falling back to npm exec pod-install..."));let I=o();a(Jt.resolve("ios"),I),Le.info(Me.magenta(`${m.nameUpper}_DEBUG: Executing pod-install override via npx --yes pod-install@latest`)),await l("npx",["--yes","pod-install@latest","ios"],process.cw ...

608export MACH_FRAMEWORK="react-native"

609echo "[ENV] MACH_FRAMEWORK=$MACH_FRAMEWORK"

610unset EXPO_NO_DOTENV

611`,iosRemotePrebuildScript:()=>`

612echo "[STEP_START:prebuild] $(date +%s)"

613echo "[PREBUILD] React Native framework configured. Skipping Expo prebuild."

614`,androidRemoteVersionCodeScript:()=>`

615echo "[VERSIONING] React Native framework configured. Version code will be injected through Gradle."

616`,androidRemotePrebuildScript:()=>`

617echo "[PREBUILD] React Native framework configured. Skipping Expo prebuild."

618`,androidRemoteGradlePropertiesScript:()=>`

619:

620`,androidRemoteReleaseGradlePropertiesScript:()=>`

621:

622`,prepareLocalProject:async e=>{let{platform:t,cacheMeta:n,cacheMetaDir:i,currentBuildEnv:r,reportStep:o,reportLog:s,loggedRun:l,configureXcodeNodeBinary:a,podsFingerprint:d,writeCacheMeta:u}=e;if(t!=="ios")return{};let c=yn.resolve("ios"),p=

623`),Nt.info(xt.dim("React Native Podfile fingerprint changed - clearing Pods for clean install...")),ut.rmSync(g,{recursive:!0,force:!0})):_&&Tc(y,h)&&(await s(`[CACHE] React Native Pods Manifest.lock is out of sync - wiping ios/Pods

624`),Nt.info(xt.dim("React Native Pods manifest is out of sync - clearing Pods for clean install...")),ut.rmSync(g,{recursive:!0,force:!0}));let T="/opt/homebrew/bin/pod",w=ut.existsSync(T)?T:"pod";try{Nt.info(xt.dim(`Using pod command: ${w} in ${c}`)),await l(w,["install"],c,f)}catch(U){let V=U.message||"Unknown error";Nt.warn(xt.yellow(`Native "pod" command failed: ${V}`)),Nt.info(xt.dim("Falling back to npx pod-install..."));let J=r();a(c,J),Nt.info(xt.magenta(`${m.nameUpper}_DEBUG: Executing pod-install fallback via npx --yes pod-install@latest`)),await l("npx",["--yes","pod-install@latest", ...

625`):"",f;if(r){let I=Bo.isAbsolute(r)?r:Bo.resolve(process.cwd(),r);Fo.existsSync(I)?(f=Fo.readFileSync(I,"utf-8"),qn.info(Uo.magenta(`\u2713 Loaded preBuild hook: ${r}`))):qn.warn(`preBuild script not found at ${

626export MACH_APP_NAME="${Zi(y.MACH_APP_NAME)}"

627export MACH_BUILD_PROFILE="${Zi(l)}"

628export MACH_ANDROID_RELEASE_ABIS="${Zi(g)}"

629export MACH_ENV_FINGERPRINT="${h}"

630${s.remoteEnvSetupScript().trim()}

631{{ENV_VARS}}

632 `).replace("{{FRAMEWORK_ANDROID_VERSION_CODE}}",s.androidRemoteVersionCodeScript().trim()).replace("{{FRAMEWORK_ANDROID_PREBUILD}}",s.androidRemotePrebuildScript().trim()).replace("{{FRAMEWORK_ANDROID_GRADLE_PROPERTIES}}",s.androidRemoteGradlePropertiesScript().trim()).replace("{{FRAMEWORK_ANDROID_RELEASE_GRADLE_PROPERTIES}}",s.androidRemoteReleaseGradlePropertiesScript().trim());if(e.dryRun){qn.info("User Data Script (dry run):"),console.log(_);return}o.start

633# --- Mach Cloud Build Script (iOS) ---

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg · L623

634# All S3 operations use presigned URLs via curl \u2014 zero AWS credentials on Mac.

635

636exec > >(tee -a "{{REMOTE_DIR}}/build-log.txt") 2>&1

637set -e

638set -o pipefail

639

640# 1. Robust PATH setup

641export PATH="/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin:$HOME/.npm-global/bin:$PATH"

642

643# 2. Try to load user profile to get their specific env vars (like NVM, etc)

Long lines were clipped for display.

Lines 1407-1447javascript

1407`)}),i}async function fs(e,t){e&&await new Promise(n=>{let i=!1,r=()=>{i||(i=!0,n())};e.once("exit",r),e.once("close",r),e.killed||(x.appendFileSync(t,`Stopping iOS simulator recording...

1408`),e.kill("SIGINT")),setTimeout(()=>{!i&&!e.killed&&(x.appendFileSync(t,`[WARN] iOS simulator recording did not stop after SIGINT; sending SIGKILL.

1409`),e.kill("SIGKILL")),r()},5e3).unref?.()})}function iu(e,t){let n=vs(e,t);if(!n)return;x.appendFileSync(t,`Uninstalling existing iOS app data for ${n} if present...

1410`),yt("xcrun",["simctl","uninstall","booted",n],t)!==0&&x.appendFileSync(t,`No existing app install removed for ${n}; continuing.

1411`)}function ru(e,t){if(!e?.appId)return;if(x.appendFileSync(t,`Cleaning up installed app after Maestro run...

1412`),e.platform==="ios"){let r=yt("xcrun",["simctl","uninstall","booted",e.appId],t);r===0?x.appendFileSync(t,`Uninstalled iOS app ${e.appId} after Maestro run.

1413`):x.appendFileSync(t,`Warning: failed to uninstall iOS app ${e.appId} after Maestro run: xcrun simctl uninstall exited with code ${r}

1414`);return}let n=e.deviceId?["-s",e.deviceId]:[],i=yt("adb",[...n,"uninstall",e.appId],t);i===0?x.appendFileSync(t,`Uninstalled Android app ${e.appId} after Maestro run.

1415`):x.appendFileSync(t,`Warning: failed to uninstall Android app ${e.appId} after Maestro run: adb uninstall exited with code ${i}

1416`)}function ou(e,t){let n=qe("adb",["devices"],{encoding:"utf-8",env:process.env});if(n.status!==0||n.error)return x.appendFileSync(t,`[WARN] Could not list Android devices before install; using adb default target.

1417`),null;let i=String(n.stdout||"").split(`

1418`).map(r=>r.trim().split(/\s+/)).filter(r=>r.length>=2&&r[1]==="device").map(r=>r[0]).filter(Boolean);return e&&i.includes(e)?(x.appendFileSync(t,`Using Android device ${e} for install and cleanup.

1419`),e):i.length===1?(x.appendFileSync(t,`Using Android device ${i[0]} for install and cleanup.

1420`),i[0]):(i.length>1&&x.appendFileSync(t,`[WARN] Multiple Android devices are connected; using adb default target for install and cleanup.

1421`),null)}function su(e,t){let i=(lr("aapt",["dump","badging",e])||lr("aapt2",["dump","badging",e]))?.match(/package:\s+name='([^']+)'/);if(i?.[1])return i[1];let o=lr("apkanalyzer",["manifest","application-id",e])?.split(/\s+/).find(Boolean);return o||(x.appendFileSync(t,`[WARN] Could not determine Android application id from APK; post-run uninstall will be skipped.

1422`),null)}function lr(e,t){for(let n of au(e)){let i=qe(n,t,{encoding:"utf-8",env:process.env,maxBuffer:10485760});if(i.status===0&&i.stdout)return String(i.stdout).trim()}return null}function au(e){let t=process.platform==="win32"&&!e.endsWith(".exe")?`${e}.exe`:e,n=[];if(e==="aapt"||e==="aapt2")for(let r of ms()){let o=G.join(r,"build-tools");for(let s of gs(o))n.push(G.join(o,s,t))}if(e==="apkanalyzer")for(let r of ms()){n.push(G.join(r,"cmdline-tools","latest","bin",t));let o=G.join(r,"cmdline-tools");for(let s of gs(o))n.push(G.join(o,s,"bin",t));n.push(G.join(r,"tools","bin",t))}let i=lu( ...

1423`)[0]?.trim()||null}async function cr(e,t,n){if(!x.existsSync(e))return;let i=x.readFileSync(e),r;for(let o=1;o<=3;o+=1)try{

1424`)}try{await cr(i,e.logUploadUrl,"text/plain")}catch(s){x.appendFileSync(i,`[WARN] Failed to upload runner log: ${s.message||s}

1425`)}try{yt("tar",["-czf",o,"-C",t,G.basename(n)],i),await cr(o,e.artifactsUploadUrl,"application/gzip")}catch(s){x.appendFileSync(i,`[WARN] Failed to upload Maestro artifacts: ${s.message||s}

1426`)}}function cu(e){if(!e.endsWith(".apk"))return F.error(j.red("Local Android Maestro runs need an APK artifact.")),!1;F.info(j.dim("Installing APK on local Android device/emulator..."));let t=qe("adb",["install","-r",e],{stdio:

1427`):n||e.message||String(e)}function Bt(e,t){if(!e)return ot;let n=t?`?projectId=${encodeURIComponent(t)}`:"";return`${ot}/submissions/${e}${n}`}function It(e,t){if(!e.jsonOutput)return;let n=Pe.resolve(e.jsonOutput),i={...t,url:t.url||t.dashboardUrl||Bt(t.submitId,t.projectId),updatedAt:new Date().toISOString()};try{let r=Pe.dirname(n);r&&r!=="."&&oe.mkdirSync(r,{recursive:!0}),oe.writeFileSync(n,JSON.stringify(i,null,2))}catch(r){Us.warn(ie.yellow(`Could not write submission metadata JSON: ${r.message}`))}}function ku(e,t){return t&&e.find(n=>n.credentialId===t||n.id===t||n.keyId===t||n.meta? ...

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/index.jsView on unpkg · L1427

Critical

Secret Pattern

RSA private key in dist/index.js

dist/index.jsView on unpkg · L1427

1428${(i.replace(/-----BEGIN[^-]*-----/g,"").replace(/-----END[^-]*-----/g,"").replace(/\s+/g,"").match(/.{1,64}/g)||[]).join(

1429`)}

1430-----END PRIVATE KEY-----`}let o=Pe.join(jt.tmpdir(),`api_key_${n}_${Date.now()}.json`),s={key_id:n,issuer_id:t,key:r,in_house:!1};return oe.writeFileSync(o,JSON.stringify(s,null,2)),o}function qu(e){let t=["-o","StrictHostKeyChecking=no","-o",

1431set -euo pipefail

1432

1433export PATH="/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin:$HOME/.local/share/fastlane/3.4.0/bin:$PATH"

1434export FASTLANE_SKIP_UPDATE_CHECK=1

1435export FASTLANE_HIDE_CHANGELOG=1

1436export CI="\${CI:-1}"

1437

1438if ! command -v fastlane >/dev/null 2>&1; then

1439 if ! command -v gem >/dev/null 2>&1; then

1440 echo "fastlane was not found and gem is unavailable on the remote macOS runner."

1441 exit 127

1442 fi

1443

1444 FASTLANE_GEM_HOME="\${FASTLANE_GEM_HOME:-$HOME/.local/share/fastlane/3.4.0}"

1445 FASTLANE_BIN_DIR="$FASTLANE_GEM_HOME/bin"

1446 mkdir -p "$FASTLANE_BIN_DIR"

1447 export GEM_HOME="$FASTLANE_GEM_HOME"

Long lines were clipped for display.

dist/chunk-ZPETQEMG.jsView file

Lines 1-57javascript

1import{a as m,h as V}from"./chunk-S64YFTRR.js";import{log as o,spinner as Ae,text as q,password as ve,select as ne,confirm as dt,isCancel as T,cancel as H,intro as Dt,outro as Jt,note as ct}from"@clack/prompts";import{log as N,spinner as Ie,text as Q,select as le,isCancel as Y,cancel as L,note as we,confirm as Ke}from"@clack/prompts";import F from"chalk";import{spawnSync as fe}from"child_process";import E from"fs";import U from"path";import Ge from"os";import ye from"fs";var At=["react-native","expo","flutter"],Zn="react-native",He=e=>{if(typeof e!="string")return;let t=e.trim();return t.lengt ...

2Apple Team ID is required to fetch certificates.`)),ie.info(ae.dim("You can find this at: https://developer.apple.com/account -> Membership Details"));let e=await bt({message:"Enter your 10-character Apple Team ID:",placeholder:"e.g. SA56KTS33U",validate:t=>/^[A-Z0-9]{10}$/i.test(t.trim())?void 0:"Team ID must be exactly 10 letters/numbers"});return Ve(e)?(We("Operation cancelled"),null):{id:e.trim().toUpperCase()}}function Tt(e){let t=[e.id,e.type].filter(Boolean);return t.length>0?t.join(" \xB7 "):void 0}async function Ft(e,t){if(!e.config)return!1;if(e.persistConfig)return!0;if(!e.promptToP ...

High

Child Process

Package source references child process execution.

dist/chunk-ZPETQEMG.jsView on unpkg · L1

3${r.stderr||""}`);if(g.length>0)return Te(t,g,"Select the App Store Connect provider for this API key:");N.warn(F.yellow(`Could not list App Store Connect providers: ${r.stderr||"Unknown error"}`));return}let s=(r.stdout||"").match(new RegExp(`${m.

51. Open: ${F.cyan(u)}

6`+(n==="ios"?`2. Generate an "App Store Connect API Key" with ${F.bold("Admin")} role.

73. Download the ${F.bold(".p8")} file.`:`2. Create a "Service Account", generate a ${F.bold("JSON")} key.

83. Download the ${F.bold(".json")} file.`),"Guided Setup"),t.start("Scanning for downloaded keys...");let C=Yt(n);if(t.stop(C.length>0?`Detected ${C.length} potential key(s)`:"No keys detected automatically"),C.length>0){let p=await le({message:"Found these potential keys. Use one of them?",options:[...C.map(A=>({value:A.path,label:`${U.basename(A.path)} (${A.location})`})),{value:"manual",label:"Enter path manually..."}]});if(Y(p)){L("Operation cancelled");return}p!=="manual"&&(l=p)}if(!l){let p=await Q({message:`Paste the path to your ${n==="ios"?".p8":".json"} file:`,validate:A=>E.existsSyn ...

9${C}`);if(b.length>0){n.stop("Select App Store Connect team"),we(`Apple Developer Team IDs look like ${F.bold(i)}.

10App Store Connect API keys use a numeric provider/team ID instead.`,"Team ID mismatch");let D=await Te(t,b,"Select the App Store Connect provider for this API key:");if(!D)return;f=D,r=D.id,n.start("Creating API Key with selected App Store Connect team..."),g=I(r),u=g.stdout||"",C=g.stderr||""}}if(C&&(

11`).forEach(b=>{b.trim()&&N.info(F.dim(`[Ruby] ${b.trim()}`))}),g.status!==0){n.stop("Failed"),N.error(`Magic creation failed: ${C}`);return}let p=u.match(new RegExp

12 ${F.cyan("https://appstoreconnect.apple.com/access/integrations/api")}

14It looks like: ${F.dim("xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx")}`,"One More Thing");let b=await Q({message:"Enter your App Store Connect Issuer ID:",validate:D=>D.trim().length>0?void 0:"Issuer ID is required"});if(Y(b)){L("Operation cancelled.");return}$=b.trim

16 1. Open: ${F.cyan("https://appstoreconnect.apple.com/access/integrations/api")}

17 2. Find Key ID: ${F.green(v)}

18 3. Click ${F.bold("Download API Key")} (only available once)

19 4. Drag & drop the downloaded .p8 file below`,"Manual Step Required");let b=await Q({message:"Path to the downloaded .p8 file (drag & drop here):",validate:D=>E.existsSync(D)?void 0:"File not found"});if(Y(b)){L("Operation cancelled. Credential ID was registered but key content is missing.");return}await Fe(e,b,"ios",$,v,t.ios?.bundleIdentifier||"*",{...

20${c.stderr||""}`);if(p.length>0){n.stop("Select App Store Connect team");let A=await le({message:"Select the App Store Connect team to list API keys:",options:p.map(v=>({value:v.id,label:v.name,hint:v.id}))});if(Y(A)){L("Operation cancelled");return}r=A,n.start("Fetching existing API Keys..."),c=l(r)}}if(c.status!==0){n.stop("Failed"),N.error(`Listing failed: ${c.stderr}`);return}let f=c.stdout.match(new RegExp(`${m.jsonStartMarker}(.*)${m.jsonEndMarker}`));if(!f){n.stop("Parse Error");return}let I=JSON.parse(f[1]);if(n.stop(`Found ${I.length} keys`),I.length===0){N.info("No API Keys found on ...

21`).split(/\r?\n/).map(n=>n.trim()).filter(Boolean);return t.length>0?t.slice(-8).join(`

22`):void 0}function Ot(e,t,n){let a=M(e,t,{env:n,encoding:"utf-8"});if(!(a.error||a.status!==0))return(a.stdout||a.stderr||"").trim()||void 0}function Kt(e,

23`)};let a=process.env.HOME||Ce.homedir(),i=process.env.FASTLANE_GEM_HOME||w.join(a,".local/share/fastlane/3.4.0"),r=w.join(i,"bin");y.mkdirSync(r,{recursive:!0}),o.info(d.dim("fastlane not found. Installing fastlane into the local Mach cache..."));let s=M("gem",["install","fastlane","--no-document","--install-dir",i,"--bindir",r],{env:{...e,GEM_HOME:i,GEM_PATH:[i,e.GEM_PATH].filter(Boolean).join(":")},encoding:"utf-8"});if(s.error||s.status!==0){let l=et(s.stdout,s.stderr);return o.warn(d.yellow("Automatic fastlane install failed.")),l&&o.warn(d.dim(l)),{ok:!1,detail:[n?`Detected Ruby: ${n}`:v ...

24`)||void 0}}return o.success(d.green("\u2713 fastlane installed into the local Mach cache.")),{ok:!0}}function jt(){return!process.env.CI&&process.stdin.isTTY&&process.stdout.isTTY}function Qt(e){let t=M("brew",["--version"],{env:e,encoding:"utf-8"});if(t.error||t.status

25${i.detail}`:void 0,"Try running manually: brew install fastlane","Then run mach credentials again."].filter(Boolean).join(`

26`))}throw new Error(["fastlane is required for iOS certificate/profile sync, but it was not found on PATH.",n.detail?`Automatic install failed:

27${n.detail}`:void 0,"Recommended fix: brew install fastlane","Alternative: install Ruby 3.x, then run: gem install fastlane --no-document","Then run mach credentials again."].filter(Boolean).join(`

28`))}var P=e=>{if(typeof e!="string")return;let t=e.trim();return t.length>0?t:void 0},_e=e=>P(e.password)||P(e.p12Password)||P(e.certificatePassword)||P(e.meta?.password)||P(e.meta?.p12Password)||P(e.meta?.certificatePassword),ut=e=>P(e.keystorePassword)||P(e.storePassword)||P(e.meta?.keystorePassword)||P(e.meta?.storePassword),gt=e=>P(e.keyPassword)||P(e.meta?.keyPassword),tn=e=>P(e.alias)||P(e.meta?.alias),tt=e=>e.credentialId||e.id,nt=e=>e.bundleId||e.bundleIdentifier||e.meta?.bundleId||e.meta?.bundleIdentifier,it=e=>e.distributionType||e.meta?.distributionType,at=e=>!!_e(e)||!!ut(e)||!!gt( ...

29`)?n:`${n}

30`,"utf8")),r.writeZip(a),a},mt=e=>{let t=e.toLowerCase();return t==="production"||t==="prod"||t.includes("store")||t.endsWith("-production")||t.endsWith("-prod")},on=e=>{let t=e.toLowerCase();return t==="staging"||t==="stage"||t.includes("preview")||t.includes("adhoc")||t.includes("ad-hoc")||t.endsWith("-staging")||t.endsWith("-stage")},ln=(e,t)=>{let n=re(e,t)||{},a=ee(n.distribution),i=ee(n.iosExportMethod||n.ios?.exportMethod),r=ee(n.environment);return i==="app-store"||a==="store"?"store":i==="development"||a==="development"?"development":i==="ad-hoc"||i==="adhoc"||a==="ad-hoc

31`).map(G=>G.trim()).filter(G=>G.length>0),te].join(" ");O(`security list-keychains -d user -s ${S}`)}}catch(R){o.warn(d.dim("Keychain setup warning (non-critical): "+R.message))}let z,ce;try{let W=((await V.get(`/credentials/${e}`)).data.credentials||[]).find(S=>S.type==="asc_api_key"&&S.issuerId);if(W){let S=await V.get(`/credentials/${W.credentialId}/download`,{params:{projectId:e,format:"raw"}});if(S.data.downloadUrl){let B=await(await import("axios")).default.get(S.data.downloadUrl,{responseType:"arraybuffer"}),K=w.join(Ce.tmpdir(),`mach-asc-${Date.now()}`);y.mkdirSync(K,{recursive:!0}),u= ...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/chunk-ZPETQEMG.jsView on unpkg · L15

32\u26A0\uFE0F Force flag detected: Hard resetting ${i} certificates...`)),o.info(d.dim("Detected decryption failure loop. Clearing remote storage directly to allow fresh generation.")),o.info(d.cyan(`Current MATCH_PASSWORD: ${A}`)),o.info(d.dim(`Cleaning match storage for Team ID: ${h}...`));try{(await V.post("/credentials/clean-match-storage",{projectId:e,teamId:h,storagePrefix:D})).data.status==="success"&&o.success(d.green

33Certificate sync failed. Attempting to create App ID and retry...`));try{O(`${_.shellCommand} produce --app_identifier "${t}" --app_name "${t}" --skip_itc`,{stdio:"inherit",env:j}),o.success(d.green("\u2713 App ID created successfully")),o.info(d.blue("Retrying certificate sync...")),S=M(W,{shell:!0,cwd:process.cwd(),env:j,stdio:"inherit",encoding:"utf-8"})}catch{}if(S.status!==0)throw new Error("fastlane match failed")}}catch(R){o.warn(d.yellow(`

34Sync failed. This often happens if the encryption passphrase (MATCH_PASSWORD) is incorrect or session expired.`)),o.info(d.cyan(`Failed MATCH_PASSWORD was: ${A}`));let W=await ne({message:"What would you like to do?",options:[{value:"retry_password",label:"Retry with a different MATCH_PASSWORD",hint:"Manually enter the decryption passphrase"},{value:"check_portal",label:"Check Apple Portal (Resolve certificate limits)",hint:"See if you have too many certificates"},{value:"manual",label:"Fallback to manual upload",hint:"Provide .p12 and .mobileprovision files"},{value:"cancel",label:"Cancel",hi ...

35You are overriding the dashboard passphrase for this session.`));let S=await ve({message:"Enter the correct MATCH_PASSWORD for this project:"});if(S&&!T(S)){A=S,o.info(d.blue("Retrying with provided passphrase...")),o.info(d.cyan(`New MATCH_PASSWORD: ${A}`));let G={...j,MATCH_PASSWORD:A};if(M

36${S.trim()}`)),O(`security export -k "${W}" -t identities -f pkcs12 -o "${ue}" -P ""`,{stdio:"ignore"});try{let G=O(`openssl pkcs12 -in "${ue}" -nokeys -passin pass: -legacy 2>/dev/null || openssl pkcs12 -in "${ue}" -nokeys -passin pass: 2>/dev/null`,{encoding:"utf-8"});if(!G.includes(h))throw new Error(`Exported P12 does not contain identity for team ${h

37Manual Upload Mode`)),o.info("Please provide your certificate and provisioning profile:");let i=await q({message:"Path to .p12 certificate file:",validate:l=>y.existsSync(l)?void 0:"File not found"});T(i)&&(H("Operation cancelled"),process.exit(0));let r=await q({message:"Path to .mobileprovision file:",validate:l=>y.existsSync(l)?void 0:"File not found"

38`),te=rt(x,`${w.basename(x,w.extname(x))}-passwords.txt`,Z);J=w.join("credentials",n,p.distributionType,w.basename(te))}}if(n==="android")p.type==="android_keystore"&&(u.android.keystore={keystorePath:D,keystorePassword:k.keystorePassword,keyAlias:k.alias,keyPassword:k.keyPassword},J&&(u.android.keystore.keystoreArchivePath=J));else if(n==="ios"){let X=p.distributionType==="store"?"production":p.distributionType==="adhoc"?"staging":"development";u.ios[X]||(u.ios[X]={}),p.type==="ios_cert"?(u.ios[X].certificatePath=D,u.ios[X].certificatePassword=_,J&&(u.ios[X].certificateArchivePath=J)):p.type= ...

39lane :${m.fastlanePrefix}_list_certs do

40 require 'spaceship'

41 require 'json'

42 begin

43 Spaceship::Portal.login(ENV['FASTLANE_USER'])

44 Spaceship::Portal.select_team(team_id: ENV['FASTLANE_TEAM_ID'])

45 output = Spaceship::Portal.certificate.all.select { |c|

46 if "${a}" == "development"

47 c.type_display_id.downcase.include?("development")

48 else

49 c.type_display_id.downcase.include?("distribution") || c.type_display_id.downcase.include?("production")

50 end

51 }.map { |c| { id: c.id, name: c.name, expires: c.expires.strftime('%Y-%m-%d'), type: c.type_display_id } }

52 puts "${m.jsonStartMarker}" + output.to_json + "${m.jsonEndMarker}"

53 rescue => e

54 $stderr.puts "ERROR: #{e.message}"

55 exit 1

56 end

57end`,r=w.join(Ce.tmpdir(),`/tmp/${m.nameLower}-list-certs-${Date.now()}`),s=w.join(r,"fastlane"),l=w.join(s,"Fastfile");try{y.existsSync(s)||y.mkdirSync(s,{recursive:!0

Long lines were clipped for display.