registry / @rulebricks/cli / 2.3.6

@rulebricks/cli@2.3.6

CLI for deploying and managing private Rulebricks instances

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 18 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 82 file(s), 1.04 MB of source, external domains: abcdefghijkl.supabase.co, acme-v02.api.letsencrypt.org, api.github.com, aps-workspaces.us-east-1.amazonaws.com, aps.example.com, awscli.amazonaws.com, bucket.s3.amazonaws.com, cdn.jsdelivr.net, cloud.google.com, docs.aws.amazon.com, docs.microsoft.com, eastus-1.in.applicationinsights.azure.com, elasticsearch.example.com, example.com, example.eastus-1.ingest.monitor.azure.com, example.eastus.metrics.ingest.monitor.azure.com, example.monitor.azure.com, example.okta.com, fonts.googleapis.com, fonts.gstatic.com, github.com, hub.docker.com, jslib.k6.io, k6.io, keycloak.example.com, login.microsoftonline.com, logs.example.com, loki.example.com, metrics.example.com, otlp-gateway.example.com, platform.openai.com, prefix-files.s3.us-west-2.amazonaws.com, prometheus-prod-01.grafana.net, raw.githubusercontent.com, rb-deployment.apm.us-east-1.aws.elastic-cloud.com, rb-deployment.es.us-east-1.aws.elastic-cloud.com, rulebricks.com, splunk.example.com, xxxxx.supabase.co, your-instance.com, your-org.okta.com, your-project.projects.oryapis.com

Source & flagged code

11 flagged

dist/lib/configFixtures.jsView file

Lines 397-437javascript

397 enabled: true,

398 samplingRatio: 1,

399 elastic: {

400 endpoint: "https://rb-deployment.apm.us-east-1.aws.elastic-cloud.com:443",

401 authMode: "secret-token",

402 secretToken: "elastic-apm-secret-token",

403 },

404 },

405 },

406 {

407 name: "aws-app-logs-elasticsearch",

408 provider: "aws",

409 appLogs: {

410 enabled: true,

411 destination: "elasticsearch",

412 elasticsearch: {

413 endpoint: "https://rb-deployment.es.us-east-1.aws.elastic-cloud.com:9243",

414 index: "rulebricks-app-logs",

415 authMode: "basic",

416 username: "elastic",

417 password: "elastic-password",

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/lib/configFixtures.jsView on unpkg · L417

418 },

419 },

420 },

421 {

422 name: "aws-app-logs-loki",

423 provider: "aws",

424 appLogs: {

425 enabled: true,

426 destination: "loki",

427 loki: {

428 endpoint: "https://loki.example.com/loki/api/v1/push",

429 labels: { app: "rulebricks", source: "app-logs" },

430 },

431 },

432 },

433 {

434 name: "aws-app-logs-generic-http",

435 provider: "aws",

436 appLogs: {

437 enabled: true,

Lines 506-535javascript

506 externalServices: {

507 redis: {

508 mode: "external",

509 external: {

510 host: "redis.example.com",

511 existingSecret: "redis-auth",

512 existingSecretKey: "redis-password",

513

dist/lib/benchmark.jsView file

Lines 1-23javascript

1/**

2 * Benchmark utilities for running k6 load tests against Rulebricks deployments

3 */

4import { execa } from "execa";

5import { promises as fs } from "fs";

6import path from "path";

7import os from "os"

benchmarks/run-qps-test.shView file

•path = benchmarks/run-qps-test.sh kind = build_helper sizeBytes = 2603 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

benchmarks/run-qps-test.shView on unpkg

dist/lib/cloudCli.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @rulebricks/cli@2.3.2 matchedIdentity = npm:QHJ1bGVicmlja3MvY2xp:2.3.2 similarity = 0.463 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/lib/cloudCli.jsView on unpkg

dist/lib/helmValues.test.jsView file

Lines 763-813javascript

763 const sb = values.supabase;

764 assert.equal(sb.auth.environment, undefined);

765 assert.equal(sb.rest.environment, undefined);

766 assert.equal(sb.realtime.environment, undefined);

767 assert.equal(sb.meta.environment, undefined);

768});

dist/lib/helmValues.jsView file

Lines 1968-2008javascript

1968 type: "kafka",

1969 bootstrap_servers: "${KAFKA_BOOTSTRAP_SERVERS:-rulebricks-kafka:9092}",

1970 // KAFKA_LOG_TOPIC carries the namespace prefix (e.g. com.rulebricks.logs).

1971 topics: ["${KAFKA_LOG_TOPIC:-logs}"],

1972 group_id: "vector-consumers",

1973 auto_offset_reset:

cluster-setup/gcp/README.mdView file

92patternName = generic_password severity = medium line = 92 matchedText = - **DB p...>'`.

Medium

Secret Pattern

Hardcoded password in cluster-setup/gcp/README.md

cluster-setup/gcp/README.mdView on unpkg · L92

Source & flagged code

11 flagged · loading source

dist/lib/configFixtures.jsView file

417patternName = generic_password severity = medium line = 417 matchedText = password...rd",

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/lib/configFixtures.jsView on unpkg · L417

526patternName = generic_password severity = medium line = 526 matchedText = password...ss",

Medium

Secret Pattern

Hardcoded password in dist/lib/configFixtures.js

dist/lib/configFixtures.jsView on unpkg · L526

dist/lib/benchmark.jsView file

3*/ L4: import { execa } from "execa"; L5: import { promises as fs } from "fs"; ... L10: // Directory for benchmark scripts and results L11: const RULEBRICKS_DIR = path.join(os.homedir(), ".rulebricks"); L12: const BENCHMARKS_DIR = path.join(RULEBRICKS_DIR, "benchmarks"); ... L17: const execaError = error; L18: const output = execaError.stderr || execaError.stdout || ""; L19: if (output) { ... L53: export function getK6InstallInstructions() { L54: const platform = process.platform; L55: switch (platform) {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/lib/benchmark.jsView on unpkg · L3

benchmarks/run-qps-test.shView file

•path = benchmarks/run-qps-test.sh kind = build_helper sizeBytes = 2603 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

benchmarks/run-qps-test.shView on unpkg

dist/lib/cloudCli.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/lib/cloudCli.jsView on unpkg

dist/lib/helmValues.test.jsView file

783patternName = generic_password severity = medium line = 783 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in dist/lib/helmValues.test.js

dist/lib/helmValues.test.jsView on unpkg · L783

793patternName = generic_password severity = medium line = 793 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in dist/lib/helmValues.test.js

dist/lib/helmValues.test.jsView on unpkg · L793

dist/lib/helmValues.jsView file

1988patternName = generic_password severity = medium line = 1988 matchedText = password...D}",

Medium

Secret Pattern

Hardcoded password in dist/lib/helmValues.js

dist/lib/helmValues.jsView on unpkg · L1988

2408patternName = generic_password severity = medium line = 2408 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in dist/lib/helmValues.js

dist/lib/helmValues.jsView on unpkg · L2408

2435patternName = generic_password severity = medium line = 2435 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in dist/lib/helmValues.js

dist/lib/helmValues.jsView on unpkg · L2435

cluster-setup/gcp/README.mdView file

92patternName = generic_password severity = medium line = 92 matchedText = - **DB p...>'`.

Medium

Secret Pattern

Hardcoded password in cluster-setup/gcp/README.md

cluster-setup/gcp/README.mdView on unpkg · L92

Findings

2 High12 Medium4 Low

HighSandbox Evasion Gated Capabilitydist/lib/benchmark.js

HighPrevious Version Dangerous Deltadist/lib/cloudCli.js

MediumSecret Patterndist/lib/configFixtures.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperbenchmarks/run-qps-test.sh

MediumStructural Risk Force Deep Review

MediumSecret Patterndist/lib/configFixtures.js

MediumSecret Patterndist/lib/helmValues.test.js

MediumSecret Patterndist/lib/helmValues.js

MediumSecret Patterncluster-setup/gcp/README.md

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

11 flagged

dist/lib/configFixtures.jsView file

Lines 397-437javascript

397 enabled: true,

398 samplingRatio: 1,

399 elastic: {

400 endpoint: "https://rb-deployment.apm.us-east-1.aws.elastic-cloud.com:443",

401 authMode: "secret-token",

402 secretToken: "elastic-apm-secret-token",

403 },

404 },

405 },

406 {

407 name: "aws-app-logs-elasticsearch",

408 provider: "aws",

409 appLogs: {

410 enabled: true,

411 destination: "elasticsearch",

412 elasticsearch: {

413 endpoint: "https://rb-deployment.es.us-east-1.aws.elastic-cloud.com:9243",

414 index: "rulebricks-app-logs",

415 authMode: "basic",

416 username: "elastic",

417 password: "elastic-password",

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/lib/configFixtures.jsView on unpkg · L417

418 },

419 },

420 },

421 {

422 name: "aws-app-logs-loki",

423 provider: "aws",

424 appLogs: {

425 enabled: true,

426 destination: "loki",

427 loki: {

428 endpoint: "https://loki.example.com/loki/api/v1/push",

429 labels: { app: "rulebricks", source: "app-logs" },

430 },

431 },

432 },

433 {

434 name: "aws-app-logs-generic-http",

435 provider: "aws",

436 appLogs: {

437 enabled: true,

Lines 506-535javascript

506 externalServices: {

507 redis: {

508 mode: "external",

509 external: {

510 host: "redis.example.com",

511 existingSecret: "redis-auth",

512 existingSecretKey: "redis-password",

513

dist/lib/benchmark.jsView file

Lines 1-23javascript

1/**

2 * Benchmark utilities for running k6 load tests against Rulebricks deployments

3 */

4import { execa } from "execa";

5import { promises as fs } from "fs";

6import path from "path";

7import os from "os"

benchmarks/run-qps-test.shView file

•path = benchmarks/run-qps-test.sh kind = build_helper sizeBytes = 2603 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

benchmarks/run-qps-test.shView on unpkg

dist/lib/cloudCli.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/lib/cloudCli.jsView on unpkg

dist/lib/helmValues.test.jsView file

Lines 763-813javascript

763 const sb = values.supabase;

764 assert.equal(sb.auth.environment, undefined);

765 assert.equal(sb.rest.environment, undefined);

766 assert.equal(sb.realtime.environment, undefined);

767 assert.equal(sb.meta.environment, undefined);

768});

dist/lib/helmValues.jsView file

Lines 1968-2008javascript

1968 type: "kafka",

1969 bootstrap_servers: "${KAFKA_BOOTSTRAP_SERVERS:-rulebricks-kafka:9092}",

1970 // KAFKA_LOG_TOPIC carries the namespace prefix (e.g. com.rulebricks.logs).

1971 topics: ["${KAFKA_LOG_TOPIC:-logs}"],

1972 group_id: "vector-consumers",

1973 auto_offset_reset:

cluster-setup/gcp/README.mdView file

92patternName = generic_password severity = medium line = 92 matchedText = - **DB p...>'`.

Medium

Secret Pattern

Hardcoded password in cluster-setup/gcp/README.md

cluster-setup/gcp/README.mdView on unpkg · L92

Lines 2388-2455javascript

2388 delete global.sso.clientSecret;

2389 }

2390 // NOTE: licenseKey is intentionally NOT stripped. The (standard) chart builds

2391 // the image-pull secret <release>-regcred from inline global.licenseKey at

2392 // TEMPLATE time (templates/registry-secret.yaml -> imagePullSecret helper). A

2393 // Kubernetes imagePullSecret cannot be sourced from a secretRef, so the chart

2394 // has no k8s-mode seam for it; stripping it makes the chart fall back to the

2395 // "evaluation" placeholder -> dckr_pat_evaluation -> 401 on every private

2396 // rulebricks/* image. Standalone chart users set global.licenseKey in their own

2397 // values for exactly this reason; the CLI must do the same to stay compatible

2398 // with the unmodified chart. It is a Docker Hub read-only PAT and already lives

2399 // in the deployment's config.yaml, so keeping it inline adds no new exposure.

2400 // Supabase subchart: replace each inline secret block with a secretRef.

2401 if (supabase.secret) {

2402 const dbSecret = { secretRef: names.db };

2403 if (pgExt) {

2404 dbSecret.secretRefKey = {

2405 host: "host",

2406 port: "port",

2407 username: "username",

2408 password: "password",

Medium

Secret Pattern

Hardcoded password in dist/lib/helmValues.js

dist/lib/helmValues.jsView on unpkg · L2408

2409 database: "database",

2410 };

2411 }

2412 supabase.secret = {

2413 db: dbSecret,

2414 jwt: { secretRef: names.jwt },

2415 dashboard: { secretRef: names.dashboard },

2416 realtime: { secretRef: names.realtime },

2417 // Supabase auth (GoTrue) SMTP; only when SMTP creds are configured;

2418 // otherwise the global.smtp we just stripped would leave it empty.

2419 ...(config.smtp?.user || config.smtp?.pass

2420 ? { smtp: { secretRef: names.smtp } }

2421 : {}),

2422 };

2423 }

2424 if (pgExt && supabase.externalDatabase) {

2425 supabase.externalDatabase = {

2426 ...supabase.externalDatabase,

2427 // New charts read host/port/user/pass/db from this single Secret. Keep

2428 // externalDatabase.host/port above for older charts that do not yet support

2429 // host/port secret keys.

2430 secretRef: names.db,

2431 secretRefKey: {

2432 host: "host",

2433 port: "port",

2434 username: "username",

2435 password: "password",

Medium

Secret Pattern

Hardcoded password in dist/lib/helmValues.js

dist/lib/helmValues.jsView on unpkg · L2435

2436 database: "database",

2437 },

2438 bootstrap: {

2439 ...(supabase.externalDatabase.bootstrap ?? {}),

2440 secretRef: names.dbBootstrap,

2441 // Master credentials move into the hook Secret in k8s mode.

2442 masterUsername: undefined,

2443 masterPassword: undefined,

2444 },

2445 };

2446 }

2447 values.global = global;

2448 values.supabase = supabase;

2449 return values;

2450}

2451/**

2452 * Resolves the image catalog for a generate call: an explicitly provided

2453 * catalog wins, otherwise the live manifest for options.chartVersion (or the

2454 * latest chart) is fetched — falling back to the bundled snapshot only when

2455 * fully offline.