registry / @rift-vs/rift / 0.9.1

@rift-vs/rift@0.9.1

Mountebank-compatible Node.js bindings for Rift - A high-performance service virtualization proxy

Static Scan Results

scanned 20h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 4 file(s), 22.9 KB of source, external domains: github.com

Source & flagged code

5 flagged

package.jsonView file

Lines 1-39json

2 "name": "@rift-vs/rift",

3 "version": "0.9.1",

4 "description": "Mountebank-compatible Node.js bindings for Rift - A high-performance service virtualization proxy",

5 "main": "dist/index.js",

6 "types": "dist/index.d.ts",

7 "type": "module",

8 "exports": {

9 ".": {

10 "import": "./dist/index.js",

11 "types": "./dist/index.d.ts"

12 }

13 },

14 "scripts": {

15 "build": "tsc",

16 "test": "node --experimental-vm-modules node_modules/jest/bin/jest.js",

17 "test:unit": "npm test -- --testPathPattern=test/unit",

18 "test:integration": "npm test -- --testPathPattern=test/integration",

19 "postinstall": "node bin/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L19

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L19

20 "prepublishOnly": "npm run build",

21 "lint": "eslint src test --ext .ts",

22 "typecheck": "tsc --noEmit"

23 },

24 "dependencies": {

25 "axios": "^1.6.0"

26 },

27 "devDependencies": {

28 "@types/jest": "^29.5.0",

29 "@types/node": "^20.10.0",

30 "@typescript-eslint/eslint-plugin": "^6.0.0",

31 "@typescript-eslint/parser": "^6.0.0",

32 "eslint": "^8.56.0",

33 "jest": "^29.7.0",

34 "ts-jest": "^29.1.0",

35 "typescript": "^5.3.0"

36 },

37 "engines": {

38 "node": ">=18.0.0"

39 },

bin/postinstall.jsView file

Lines 1-33javascript

1#!/usr/bin/env node

3/**

4 * Postinstall script for rift-node

5 *

6 * Downloads the appropriate Rift binary for the current platform.

7 * This script runs automatically after `npm install`.

8 */

10import https from 'https';

11import fs from 'fs'

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node bin/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/postinstall.jsView file

13import { fileURLToPath } from 'url'; L14: import { execSync } from 'child_process'; L15:

High

Child Process

Package source references child process execution.

bin/postinstall.jsView on unpkg · L13

110execSync( L111: `powershell -Command "Expand-Archive -Path '${archivePath}' -DestinationPath '${destDir}' -Force"`, L112: { stdio: 'pipe' }

High

Shell

Package source references shell execution.

bin/postinstall.jsView on unpkg · L110

9L10: import https from 'https'; L11: import fs from 'fs'; ... L13: import { fileURLToPath } from 'url'; L14: import { execSync } from 'child_process'; L15: ... L23: // Use 'latest' to get the latest release, or specify a version like 'v0.1.0' L24: const VERSION = process.env.RIFT_VERSION || 'latest'; L25:

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

bin/postinstall.jsView on unpkg · L9

Findings

4 High4 Medium5 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processbin/postinstall.js

HighShellbin/postinstall.js

HighSame File Env Network Executionbin/postinstall.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

5 flagged

package.jsonView file

Lines 1-39json

2 "name": "@rift-vs/rift",

3 "version": "0.9.1",

4 "description": "Mountebank-compatible Node.js bindings for Rift - A high-performance service virtualization proxy",

5 "main": "dist/index.js",

6 "types": "dist/index.d.ts",

7 "type": "module",

8 "exports": {

9 ".": {

10 "import": "./dist/index.js",

11 "types": "./dist/index.d.ts"

12 }

13 },

14 "scripts": {

15 "build": "tsc",

16 "test": "node --experimental-vm-modules node_modules/jest/bin/jest.js",

17 "test:unit": "npm test -- --testPathPattern=test/unit",

18 "test:integration": "npm test -- --testPathPattern=test/integration",

19 "postinstall": "node bin/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L19

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L19

20 "prepublishOnly": "npm run build",

21 "lint": "eslint src test --ext .ts",

22 "typecheck": "tsc --noEmit"

23 },

24 "dependencies": {

25 "axios": "^1.6.0"

26 },

27 "devDependencies": {

28 "@types/jest": "^29.5.0",

29 "@types/node": "^20.10.0",

30 "@typescript-eslint/eslint-plugin": "^6.0.0",

31 "@typescript-eslint/parser": "^6.0.0",

32 "eslint": "^8.56.0",

33 "jest": "^29.7.0",

34 "ts-jest": "^29.1.0",

35 "typescript": "^5.3.0"

36 },

37 "engines": {

38 "node": ">=18.0.0"

39 },

bin/postinstall.jsView file

Lines 1-33javascript

1#!/usr/bin/env node

3/**

4 * Postinstall script for rift-node

5 *

6 * Downloads the appropriate Rift binary for the current platform.

7 * This script runs automatically after `npm install`.

8 */

10import https from 'https';

11import fs from 'fs'

Lines 90-130javascript

90 });

92 file.on('error', (err) => {

93 file.close();

94 try {

95 fs.unlinkSync(dest);

96 } catch {}

97 reject(err);

98 });

99 });

100}

101

102/**

103 * Extract archive based on type

104 */

105function extractArchive(archivePath, destDir) {

106 if (archivePath.endsWith('.tar.gz')) {

107 execSync(`tar -xzf "${archivePath}" -C "${destDir}"`, { stdio: 'pipe' });

108 } else if (archivePath.endsWith('.zip')) {

109 if (process.platform === 'win32') {

110 execSync(

111 `powershell -Command "Expand-Archive -Path '${archivePath}' -DestinationPath '${destDir}' -Force"`,

112 { stdio: 'pipe' }

High

Shell

Package source references shell execution.

bin/postinstall.jsView on unpkg · L110

113 );

114 } else {

115 execSync(`unzip -o "${archivePath}" -d "${destDir}"`, { stdio: 'pipe' });

116 }

117 } else {

118 throw new Error(`Unknown archive format: ${archivePath}`);

119 }

120}

121

122/**

123 * Get the latest release version from GitHub

124 */

125async function getLatestVersion() {

126 return new Promise((resolve, reject) => {

127 const options = {

128 hostname: 'api.github.com',

129 path: '/repos/EtaCassiopeia/rift/releases/latest',

130 headers: {