registry / @ratacat/cloudmail / 0.1.0

@ratacat/cloudmail@0.1.0

Robot-mode CLI for disposable email identities on any Cloudflare account.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 18 file(s), 112 KB of source

Source & flagged code

3 flagged

src/core/converge.tsView file

Lines 9-49typescript

9 * init --run converge(repair) from zero

10 * doctor --deep converge(detect) — report only

11 * doctor --fix converge(repair) — repair what detect flags

12 *

13 * Checks without

Source & flagged code

3 flagged · loading source

src/core/converge.tsView file

29/** Run a command from worker/ with optional stdin; returns exit code + combined output. */ L30: exec(cmd: string, args: string[], stdin?: string): Promise<ExecResult>; L31: wranglerCmd: string;

High

Child Process

Package source references child process execution.

src/core/converge.tsView on unpkg · L29

377async detectWrangler() { L378: for (const cmd of ["wrangler", "npx --yes wrangler"]) { L379: try { L380: const result = await spawn(cmd, ["--version"]); L381: if (result.code === 0) return { cmd, version: result.out.trim() };

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/core/converge.tsView on unpkg · L377

install.shView file

•path = install.sh kind = build_helper sizeBytes = 1890 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

Findings

3 High4 Medium3 Low

HighChild Processsrc/core/converge.ts

HighShell

HighRuntime Package Installsrc/core/converge.ts

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperinstall.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

Lines 357-397typescript

357async function patchD1IdOnDisk(databaseId: string): Promise<void> {

358 const path = join(WORKER_DIR, "wrangler.jsonc");

359 const source = await Bun.file(path).text();

360 const placeholder = '"database_id": "REPLACE_WITH_YOUR_D1_ID"';

361 let patched = source.replace(placeholder, `"database_id": "${databaseId}"`);

362 if (patched === source) {

363 patched = source.replace(

364 /("database_name"\s*:\s*"cloudmail"[\s\S]*?"database_id"\s*:\s*")[^"]*(")/,

365 `$1${databaseId}$2`,

366 );

367 }

368 if (patched === source) {

369 throw new Error("cloudmail D1 database entry was not found");

370 }

371 await Bun.write(path, patched);

372}

373

374/** Bun-backed dependencies shared by `init` and `doctor --deep/--fix`. */

375export function defaultProvisionDeps(opts: { apiKey: string; workerUrl?: string }): ProvisionDeps {

376 return {

377 async detectWrangler() {

378 for (const cmd of ["wrangler", "npx --yes wrangler"]) {

379 try {

380 const result = await spawn(cmd, ["--version"]);

381 if (result.code === 0) return { cmd, version: result.out.trim() };

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/core/converge.tsView on unpkg · L377

382 } catch {

383 // Try the fallback command.

384 }

385 }

386 return null;

387 },

388 async whoami(cmd) {

389 try {

390 return (await spawn(cmd, ["whoami"])).code === 0;

391 } catch {

392 return false;

393 }

394 },

395 convergeDeps(wranglerCmd) {

396 return {

397 wranglerCmd,