registry  /  @rail20/cli  /  0.3.5

@rail20/cli@0.3.5

⚠ Under review

Private payments for onchain agents. CLI for RAIL20 - shield, send, swap, bridge with zero-knowledge privacy on Base and Robinhood Chain.

Static Scan Results

scanned 3m ago · by rust-scanner

Static analysis flagged 8 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot
Behavioral surface
Source
CryptoEnvironmentVarsFilesystemNetwork
Supply chain
HighEntropyStringsUrlStrings
ManifestNo manifest risk signals triggered.
scanned 1 file(s), 66.2 KB of source, external domains: api.rail20.org, basescan.org, docs.rail20.org, registry.npmjs.org, robinhoodchain.blockscout.com, rpc.mainnet.chain.robinhood.com

Source & flagged code

2 flagged · loading source
bin/rail20.jsView file
2/** L3: * rail20 CLI - private payments for onchain agents. L4: * ... L21: // === constants === L22: const API = process.env.RAIL20_API || 'https://api.rail20.org' L23: const SIGN_MESSAGE = ... L26: 'No transaction will be sent.' L27: const CONFIG_DIR = path.join(os.homedir(), '.rail20') L28: const CONFIG_FILE = path.join(CONFIG_DIR, 'config.json') // cached RAIL20 sig ... L37: function color(text, col) { L38: return process.stdout.isTTY ? `${col}${text}${c.reset}` : text L39: }
Critical
Wallet Drain

Source uses private key material to transfer cryptocurrency funds.

bin/rail20.jsView on unpkg · L2
2Trigger-reachable chain: manifest.bin -> bin/rail20.js L2: /** L3: * rail20 CLI - private payments for onchain agents. L4: * ... L21: // === constants === L22: const API = process.env.RAIL20_API || 'https://api.rail20.org' L23: const SIGN_MESSAGE = ... L26: 'No transaction will be sent.' L27: const CONFIG_DIR = path.join(os.homedir(), '.rail20') L28: const CONFIG_FILE = path.join(CONFIG_DIR, 'config.json') // cached RAIL20 sig ... L37: function color(text, col) { L38: return process.stdout.isTTY ? `${col}${text}${c.reset}` : text L39: }
Critical
Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

bin/rail20.jsView on unpkg · L2

Findings

2 Critical3 Medium3 Low
CriticalWallet Drainbin/rail20.js
CriticalTrigger Reachable Dangerous Capabilitybin/rail20.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings