registry / @rightkit/release / 0.2.5

@rightkit/release@0.2.5

Portable Right Suite release CLI/SDK: signed installers, updater artifacts, patch/update routing, hardening, R2 publish, and RightApps registration.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 15 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 15 file(s), 61.0 KB of source, external domains: api.spoares.com, github.com, pub-6c73208d46c245a9b4881d5e02f6b618.r2.dev, rightapps-license-gate.adrdsouza.workers.dev, timestamp.acs.microsoft.com

Source & flagged code

7 flagged

upload-large.test.mjsView file

Lines 1-24javascript

1import assert from "node:assert/strict";

2import { mkdtempSync, writeFileSync } from "node:fs";

3import os from "node:os";

4import path from "node:path";

5import { spawnSync } from "node:child_process";

6import { fileURLToPath } from "node:url";

High

Child Process

Package source references child process execution.

upload-large.test.mjsView on unpkg · L4

7import test from "node:test";

9const uploader = fileURLToPath(new URL("./upload-large.mjs", import.meta.url));

11function fixtureFile() {

12 const dir = mkdtempSync(path.join(os.tmpdir(), "right-upload-test-"));

13 const file = path.join(dir, "Artifact.exe");

14 writeFileSync(file, "artifact");

15 return file;

16}

18function run(bucket) {

19 return spawnSync(process.execPath, [uploader, fixtureFile(), "fixture/updates/windows/current/Artifact.exe", bucket], {

20 encoding: "utf8",

21 env: { ...process.env, RIGHT_RELEASE_UPLOAD_DRY_RUN: "1" },

22 });

23}

sign-windows.mjsView file

Lines 1-32javascript

1#!/usr/bin/env node

2import { existsSync, mkdtempSync, readdirSync, rmSync, writeFileSync } from "node:fs";

3import os from "node:os";

4import path from "node:path";

5import { spawnSync } from "node:child_process";

7const EXCLUDE_CREDENTIALS

release.mjsView file

Lines 39-79javascript

39 else if (arg === "--upload" || arg === "--publish") opts.upload = true;

40 else if (arg === "--no-upload" || arg === "--package") opts.upload = false;

publish-update.mjsView file

Lines 1-25javascript

1#!/usr/bin/env node

2import { createHash } from "node:crypto";

3import { access, readFile, stat } from "node:fs/promises";

4import path from "node:path";

5import { fileURLToPath, pathToFileURL } from "node:url";

6import { spawn } from "node:child_process"

lsclean.shView file

•path = lsclean.sh kind = build_helper sizeBytes = 1204 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

lsclean.shView on unpkg

Source & flagged code

7 flagged · loading source

upload-large.test.mjsView file

4import path from "node:path"; L5: import { spawnSync } from "node:child_process"; L6: import { fileURLToPath } from "node:url";

High

Child Process

Package source references child process execution.

upload-large.test.mjsView on unpkg · L4

sign-windows.mjsView file

12"VisualStudioCodeCredential", L13: "AzurePowerShellCredential", L14: "AzureDeveloperCliCredential",

High

Shell

Package source references shell execution.

sign-windows.mjsView on unpkg · L12

release.mjsView file

59const configPath = path.resolve(opts.config); L60: const config = (await import(pathToFileURL(configPath))).default; L61: if (!config) usage(2, `config did not export default: ${configPath}`);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

release.mjsView on unpkg · L59

publish-update.mjsView file

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

publish-update.mjsView on unpkg · L5

5import { fileURLToPath, pathToFileURL } from "node:url"; L6: import { spawn } from "node:child_process"; L7: ... L9: const UPLOAD = path.join(TOOL_ROOT, "upload-large.mjs"); L10: const API_BASE = process.env.RIGHTAPPS_API_URL || "https://api.spoares.com"; L11: const DOWNLOAD_BASE = process.env.RIGHTAPPS_UPDATE_DOWNLOAD_BASE || "https://rightapps-license-gate.adrdsouza.workers.dev"; ... L15: let configName = "right-release.config.mjs"; L16: let platform = process.platform === "win32" ? "win" : "mac"; L17: let dryRun = false; ... L119: if (!uploadedKeys.has(artifact.key)) { L120: console.log(`${dryRun ? "[dry-run] " : ""}UPLOAD private/${artifact.key}`); L121: if (!dryRun) await run(process.execPath, [UPLOAD, file, artifact.key, "private"], root);

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

publish-update.mjsView on unpkg · L5

•matchType = previous_version_dangerous_delta matchedPackage = @rightkit/release@0.2.3 matchedIdentity = npm:QHJpZ2h0a2l0L3JlbGVhc2U:0.2.3 similarity = 0.800 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

publish-update.mjsView on unpkg

lsclean.shView file

•path = lsclean.sh kind = build_helper sizeBytes = 1204 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

lsclean.shView on unpkg

Findings

5 High5 Medium5 Low

HighChild Processupload-large.test.mjs

HighShellsign-windows.mjs

HighSame File Env Network Executionpublish-update.mjs

HighSandbox Evasion Gated Capabilitypublish-update.mjs

HighPrevious Version Dangerous Deltapublish-update.mjs

MediumDynamic Requirerelease.mjs

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperlsclean.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

7 flagged

upload-large.test.mjsView file

Lines 1-24javascript

1import assert from "node:assert/strict";

2import { mkdtempSync, writeFileSync } from "node:fs";

3import os from "node:os";

4import path from "node:path";

5import { spawnSync } from "node:child_process";

6import { fileURLToPath } from "node:url";

High

Child Process

Package source references child process execution.

upload-large.test.mjsView on unpkg · L4

7import test from "node:test";

9const uploader = fileURLToPath(new URL("./upload-large.mjs", import.meta.url));

11function fixtureFile() {

12 const dir = mkdtempSync(path.join(os.tmpdir(), "right-upload-test-"));

13 const file = path.join(dir, "Artifact.exe");

14 writeFileSync(file, "artifact");

15 return file;

16}

18function run(bucket) {

19 return spawnSync(process.execPath, [uploader, fixtureFile(), "fixture/updates/windows/current/Artifact.exe", bucket], {

20 encoding: "utf8",

21 env: { ...process.env, RIGHT_RELEASE_UPLOAD_DRY_RUN: "1" },

22 });

23}

sign-windows.mjsView file

Lines 1-32javascript

1#!/usr/bin/env node

2import { existsSync, mkdtempSync, readdirSync, rmSync, writeFileSync } from "node:fs";

3import os from "node:os";

4import path from "node:path";

5import { spawnSync } from "node:child_process";

7const EXCLUDE_CREDENTIALS

release.mjsView file

Lines 39-79javascript

39 else if (arg === "--upload" || arg === "--publish") opts.upload = true;

40 else if (arg === "--no-upload" || arg === "--package") opts.upload = false;

publish-update.mjsView file

Lines 1-25javascript

1#!/usr/bin/env node

2import { createHash } from "node:crypto";

3import { access, readFile, stat } from "node:fs/promises";

4import path from "node:path";

5import { fileURLToPath, pathToFileURL } from "node:url";

6import { spawn } from "node:child_process"

lsclean.shView file

•path = lsclean.sh kind = build_helper sizeBytes = 1204 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

lsclean.shView on unpkg