registry / @rightkit/release / 0.2.1

@rightkit/release@0.2.1

Portable Right Suite release CLI/SDK: signed installers, updater artifacts, patch/update routing, hardening, R2 publish, and RightApps registration.

Static Scan Results

scanned 5h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 14 file(s), 55.5 KB of source, external domains: api.spoares.com, github.com, heardright-models.adrdsouza.workers.dev, pub-6c73208d46c245a9b4881d5e02f6b618.r2.dev, rightapps-license-gate.adrdsouza.workers.dev, timestamp.acs.microsoft.com

Source & flagged code

6 flagged

create-mac-updater.mjsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import { execFileSync, spawnSync } from "node:child_process";

3import { existsSync, rmSync } from "node:fs";

High

Child Process

Package source references child process execution.

create-mac-updater.mjsView on unpkg · L1

4import os from "node:os";

5import path from "node:path";

7const args = process.argv.slice(2);

8let app;

9let output;

10let cwd = process.cwd();

11let dryRun = false;

12for (let i = 0; i < args.length; i++) {

13 if (args[i] === "--app") app = args[++i];

14 else if (args[i] === "--output") output = args[++i];

15 else if (args[i] === "--cwd") cwd = path.resolve(args[++i]);

16 else if (args[i] === "--dry-run") dryRun = true;

17 else fail(`unknown argument: ${args[i]}`);

18}

19if (!app || !output) fail("--app and --output are required");

21const appPath = path.resolve(cwd, app);

sign-windows.mjsView file

Lines 1-32javascript

1#!/usr/bin/env node

2import { existsSync, mkdtempSync, readdirSync, rmSync, writeFileSync } from "node:fs";

3import os from "node:os";

4import path from "node:path";

5import { spawnSync } from "node:child_process";

7const EXCLUDE_CREDENTIALS

release.mjsView file

Lines 39-79javascript

39 else if (arg === "--upload" || arg === "--publish") opts.upload = true;

40 else if (arg === "--no-upload" || arg === "--package") opts.upload = false;

upload-large.mjsView file

Lines 1-23javascript

1#!/usr/bin/env node

2import { createReadStream, statSync } from "node:fs";

3import path from "node:path";

4import { spawnSync } from "node:child_process";

6const WORKER_BASE = process.env.RIGHT_RELEASE_UPLOAD_WORKER_BASE || "https://heardright-models.adrdsouza.workers.dev"

publish-update.mjsView file

Lines 1-25javascript

1#!/usr/bin/env node

2import { createHash } from "node:crypto";

3import { access, readFile, stat } from "node:fs/promises";

4import path from "node:path";

5import { fileURLToPath, pathToFileURL } from "node:url";

6import { spawn } from "node:child_process"

lsclean.shView file

•path = lsclean.sh kind = build_helper sizeBytes = 1204 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

lsclean.shView on unpkg

Source & flagged code

6 flagged · loading source

create-mac-updater.mjsView file

1#!/usr/bin/env node L2: import { execFileSync, spawnSync } from "node:child_process"; L3: import { existsSync, rmSync } from "node:fs";

High

Child Process

Package source references child process execution.

create-mac-updater.mjsView on unpkg · L1

sign-windows.mjsView file

12"VisualStudioCodeCredential", L13: "AzurePowerShellCredential", L14: "AzureDeveloperCliCredential",

High

Shell

Package source references shell execution.

sign-windows.mjsView on unpkg · L12

release.mjsView file

59const configPath = path.resolve(opts.config); L60: const config = (await import(pathToFileURL(configPath))).default; L61: if (!config) usage(2, `config did not export default: ${configPath}`);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

release.mjsView on unpkg · L59

upload-large.mjsView file

3import path from "node:path"; L4: import { spawnSync } from "node:child_process"; L5: L6: const WORKER_BASE = process.env.RIGHT_RELEASE_UPLOAD_WORKER_BASE || "https://heardright-models.adrdsouza.workers.dev"; L7: const PART_SIZE = 90 * 1024 * 1024;

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

upload-large.mjsView on unpkg · L3

publish-update.mjsView file

5import { fileURLToPath, pathToFileURL } from "node:url"; L6: import { spawn } from "node:child_process"; L7: ... L9: const UPLOAD = path.join(TOOL_ROOT, "upload-large.mjs"); L10: const API_BASE = process.env.RIGHTAPPS_API_URL || "https://api.spoares.com"; L11: const DOWNLOAD_BASE = process.env.RIGHTAPPS_UPDATE_DOWNLOAD_BASE || "https://rightapps-license-gate.adrdsouza.workers.dev"; ... L15: let configName = "right-release.config.mjs"; L16: let platform = process.platform === "win32" ? "win" : "mac"; L17: let dryRun = false; ... L52: assertCurrentKey(artifact.key, "updater"); L53: const bucket = tier === "patch" ? "public" : "private"; L54: const file = path.resolve(root, artifact.file);

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

publish-update.mjsView on unpkg · L5

lsclean.shView file

•path = lsclean.sh kind = build_helper sizeBytes = 1204 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

lsclean.shView on unpkg

Findings

4 High5 Medium5 Low

HighChild Processcreate-mac-updater.mjs

HighShellsign-windows.mjs

HighSame File Env Network Executionupload-large.mjs

HighSandbox Evasion Gated Capabilitypublish-update.mjs

MediumDynamic Requirerelease.mjs

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperlsclean.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

6 flagged

create-mac-updater.mjsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import { execFileSync, spawnSync } from "node:child_process";

3import { existsSync, rmSync } from "node:fs";

High

Child Process

Package source references child process execution.

create-mac-updater.mjsView on unpkg · L1

4import os from "node:os";

5import path from "node:path";

7const args = process.argv.slice(2);

8let app;

9let output;

10let cwd = process.cwd();

11let dryRun = false;

12for (let i = 0; i < args.length; i++) {

13 if (args[i] === "--app") app = args[++i];

14 else if (args[i] === "--output") output = args[++i];

15 else if (args[i] === "--cwd") cwd = path.resolve(args[++i]);

16 else if (args[i] === "--dry-run") dryRun = true;

17 else fail(`unknown argument: ${args[i]}`);

18}

19if (!app || !output) fail("--app and --output are required");

21const appPath = path.resolve(cwd, app);

sign-windows.mjsView file

Lines 1-32javascript

1#!/usr/bin/env node

2import { existsSync, mkdtempSync, readdirSync, rmSync, writeFileSync } from "node:fs";

3import os from "node:os";

4import path from "node:path";

5import { spawnSync } from "node:child_process";

7const EXCLUDE_CREDENTIALS

release.mjsView file

Lines 39-79javascript

39 else if (arg === "--upload" || arg === "--publish") opts.upload = true;

40 else if (arg === "--no-upload" || arg === "--package") opts.upload = false;

upload-large.mjsView file

Lines 1-23javascript

1#!/usr/bin/env node

2import { createReadStream, statSync } from "node:fs";

3import path from "node:path";

4import { spawnSync } from "node:child_process";

6const WORKER_BASE = process.env.RIGHT_RELEASE_UPLOAD_WORKER_BASE || "https://heardright-models.adrdsouza.workers.dev"

publish-update.mjsView file

Lines 1-25javascript

1#!/usr/bin/env node

2import { createHash } from "node:crypto";

3import { access, readFile, stat } from "node:fs/promises";

4import path from "node:path";

5import { fileURLToPath, pathToFileURL } from "node:url";

6import { spawn } from "node:child_process"

lsclean.shView file

•path = lsclean.sh kind = build_helper sizeBytes = 1204 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

lsclean.shView on unpkg