registry / @rulebricks/cli / 2.3.1

@rulebricks/cli@2.3.1

CLI for deploying and managing private Rulebricks instances

Static Scan Results

scanned 7d ago · by rust-scanner

Static analysis flagged 17 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 67 file(s), 949 KB of source, external domains: abcdefghijkl.supabase.co, acme-v02.api.letsencrypt.org, api.github.com, aps-workspaces.us-east-1.amazonaws.com, aps.example.com, awscli.amazonaws.com, bucket.s3.amazonaws.com, cdn.jsdelivr.net, cloud.google.com, docs.aws.amazon.com, docs.microsoft.com, eastus-1.in.applicationinsights.azure.com, elasticsearch.example.com, example.com, example.eastus-1.ingest.monitor.azure.com, example.eastus.metrics.ingest.monitor.azure.com, example.monitor.azure.com, example.okta.com, fonts.googleapis.com, fonts.gstatic.com, hub.docker.com, jslib.k6.io, k6.io, keycloak.example.com, login.microsoftonline.com, logs.example.com, loki.example.com, metrics.example.com, otlp-gateway.example.com, platform.openai.com, prefix-files.s3.us-west-2.amazonaws.com, prometheus-prod-01.grafana.net, rb-deployment.apm.us-east-1.aws.elastic-cloud.com, rb-deployment.es.us-east-1.aws.elastic-cloud.com, rulebricks.com, splunk.example.com, xxxxx.supabase.co, your-instance.com, your-org.okta.com, your-project.projects.oryapis.com

Source & flagged code

10 flagged

dist/components/Wizard/steps/SMTPStep.jsView file

Lines 170-192javascript

170 smtpFrom: from,

171 smtpFromName: fromName,

172 },

173 });

174 onComplete();

175 };

176 const getCompletedFields = () => {

177 const fields = [];

178 if (host)

179 fields.push({ label: "Host", value: host });

180 if (port && subStep !== "port")

181 fields.push({ label: "Port", value: port });

182 if (user && subStep !== "user")

183 fields.push({ label: "User", value: user });

184 if (pass && subStep !== "pass")

185 fields.push({ label: "Password", value: "••••••••" });

186 if (from && subStep !== "from")

187 fields.push({ label: "From", value: from });

188 return fields;

189 };

190 return (_jsxs(BorderBox, { title: "Email (SMTP)", children: [_jsx(Box, { flexDirection: "column", marginY: 1, children: _jsx(Text, { color: "gray", dimColor: true, children: "Configure SMTP for user invitations, password resets, and notifications" }) }), subStep === "provider" && (_jsxs(Box, { flexDirection: "column", marginY: 1, children: [_jsx(Text, { children: "Select your email provider:" }), _jsx(Box, { marginTop: 1, children: _jsx(SelectInput, { items: PROVIDER_ITEMS, onSelect: handleProviderSelect,

191}

192

Long lines were clipped for display.

dist/lib/benchmark.jsView file

Lines 1-23javascript

1/**

2 * Benchmark utilities for running k6 load tests against Rulebricks deployments

3 */

4import { execa } from "execa";

5import { promises as fs } from "fs";

6import path from "path";

7import os from "os"

benchmarks/run-qps-test.shView file

•path = benchmarks/run-qps-test.sh kind = build_helper sizeBytes = 2603 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

benchmarks/run-qps-test.shView on unpkg

dist/lib/configFixtures.jsView file

Lines 376-416javascript

376 enabled: true,

377 samplingRatio: 1,

378 elastic: {

379 endpoint: "https://rb-deployment.apm.us-east-1.aws.elastic-cloud.com:443",

380 authMode: "secret-token",

381 secretToken: "elastic-apm-secret-token"

dist/lib/helmValues.test.jsView file

Lines 711-761javascript

711 assert.equal(sb.externalDatabase.bootstrap.masterUsername, "postgres");

712 assert.equal(sb.externalDatabase.bootstrap.masterPassword, "master-pw-change-me");

713 // The shared service-role password the chart hands every service.

714 assert.ok(typeof sb.secret.db.password === "string");

715 assert.equal(sb.secret.db.database, "postgres");

716

dist/lib/helmValues.jsView file

Lines 1925-1965javascript

1925 type: "kafka",

1926 bootstrap_servers: "${KAFKA_BOOTSTRAP_SERVERS:-rulebricks-kafka:9092}",

1927 // KAFKA_LOG_TOPIC carries the namespace prefix (e.g. com.rulebricks.logs).

1928 topics: ["${KAFKA_LOG_TOPIC:-logs}"],

1929 group_id: "vector-consumers",

1930 auto_offset_reset:

Source & flagged code

10 flagged · loading source

dist/components/Wizard/steps/SMTPStep.jsView file

190patternName = generic_password severity = medium line = 190 matchedText = return (...}));

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/components/Wizard/steps/SMTPStep.jsView on unpkg · L190

dist/lib/benchmark.jsView file

3*/ L4: import { execa } from "execa"; L5: import { promises as fs } from "fs"; ... L10: // Directory for benchmark scripts and results L11: const RULEBRICKS_DIR = path.join(os.homedir(), ".rulebricks"); L12: const BENCHMARKS_DIR = path.join(RULEBRICKS_DIR, "benchmarks"); ... L17: const execaError = error; L18: const output = execaError.stderr || execaError.stdout || ""; L19: if (output) { ... L53: export function getK6InstallInstructions() { L54: const platform = process.platform; L55: switch (platform) {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/lib/benchmark.jsView on unpkg · L3

benchmarks/run-qps-test.shView file

•path = benchmarks/run-qps-test.sh kind = build_helper sizeBytes = 2603 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

benchmarks/run-qps-test.shView on unpkg

dist/lib/configFixtures.jsView file

396patternName = generic_password severity = medium line = 396 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in dist/lib/configFixtures.js

dist/lib/configFixtures.jsView on unpkg · L396

505patternName = generic_password severity = medium line = 505 matchedText = password...ss",

Medium

Secret Pattern

Hardcoded password in dist/lib/configFixtures.js

dist/lib/configFixtures.jsView on unpkg · L505

dist/lib/helmValues.test.jsView file

731patternName = generic_password severity = medium line = 731 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in dist/lib/helmValues.test.js

dist/lib/helmValues.test.jsView on unpkg · L731

741patternName = generic_password severity = medium line = 741 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in dist/lib/helmValues.test.js

dist/lib/helmValues.test.jsView on unpkg · L741

dist/lib/helmValues.jsView file

1945patternName = generic_password severity = medium line = 1945 matchedText = password...D}",

Medium

Secret Pattern

Hardcoded password in dist/lib/helmValues.js

dist/lib/helmValues.jsView on unpkg · L1945

2299patternName = generic_password severity = medium line = 2299 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in dist/lib/helmValues.js

dist/lib/helmValues.jsView on unpkg · L2299

2326patternName = generic_password severity = medium line = 2326 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in dist/lib/helmValues.js

dist/lib/helmValues.jsView on unpkg · L2326

Findings

1 High12 Medium4 Low

HighSandbox Evasion Gated Capabilitydist/lib/benchmark.js

MediumSecret Patterndist/components/Wizard/steps/SMTPStep.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperbenchmarks/run-qps-test.sh

MediumStructural Risk Force Deep Review

MediumSecret Patterndist/lib/configFixtures.js

MediumSecret Patterndist/lib/helmValues.test.js

MediumSecret Patterndist/lib/helmValues.js

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

10 flagged

dist/components/Wizard/steps/SMTPStep.jsView file

Lines 170-192javascript

170 smtpFrom: from,

171 smtpFromName: fromName,

172 },

173 });

174 onComplete();

175 };

176 const getCompletedFields = () => {

177 const fields = [];

178 if (host)

179 fields.push({ label: "Host", value: host });

180 if (port && subStep !== "port")

181 fields.push({ label: "Port", value: port });

182 if (user && subStep !== "user")

183 fields.push({ label: "User", value: user });

184 if (pass && subStep !== "pass")

185 fields.push({ label: "Password", value: "••••••••" });

186 if (from && subStep !== "from")

187 fields.push({ label: "From", value: from });

188 return fields;

189 };

191}

192

Long lines were clipped for display.

dist/lib/benchmark.jsView file

Lines 1-23javascript

1/**

2 * Benchmark utilities for running k6 load tests against Rulebricks deployments

3 */

4import { execa } from "execa";

5import { promises as fs } from "fs";

6import path from "path";

7import os from "os"

benchmarks/run-qps-test.shView file

•path = benchmarks/run-qps-test.sh kind = build_helper sizeBytes = 2603 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

benchmarks/run-qps-test.shView on unpkg

dist/lib/configFixtures.jsView file

Lines 376-416javascript

376 enabled: true,

377 samplingRatio: 1,

378 elastic: {

379 endpoint: "https://rb-deployment.apm.us-east-1.aws.elastic-cloud.com:443",

380 authMode: "secret-token",

381 secretToken: "elastic-apm-secret-token"

dist/lib/helmValues.test.jsView file

Lines 711-761javascript

711 assert.equal(sb.externalDatabase.bootstrap.masterUsername, "postgres");

712 assert.equal(sb.externalDatabase.bootstrap.masterPassword, "master-pw-change-me");

713 // The shared service-role password the chart hands every service.

714 assert.ok(typeof sb.secret.db.password === "string");

715 assert.equal(sb.secret.db.database, "postgres");

716

dist/lib/helmValues.jsView file

Lines 1925-1965javascript

1925 type: "kafka",

1926 bootstrap_servers: "${KAFKA_BOOTSTRAP_SERVERS:-rulebricks-kafka:9092}",

1927 // KAFKA_LOG_TOPIC carries the namespace prefix (e.g. com.rulebricks.logs).

1928 topics: ["${KAFKA_LOG_TOPIC:-logs}"],

1929 group_id: "vector-consumers",

1930 auto_offset_reset: