registry / @sellable/admin-install / 0.1.22

@sellable/admin-install@0.1.22

Internal Sellable Admin installer for Claude Code and Codex

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 15 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 12 file(s), 234 KB of source, external domains: 127.0.0.1, api.browser-use.com, api.grain.com, app.sellable.dev, browser-use.com, contracts.sellable.dev, example.com, json.schemastore.org, sellable.dev, slack.com, www.notion.so

Source & flagged code

7 flagged

bin/sellable-admin-install.mjsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import { spawnSync } from "node:child_process";

3import { createHash } from "node:crypto";

High

Child Process

Package source references child process execution.

bin/sellable-admin-install.mjsView on unpkg · L1

4import {

5 cpSync,

6 chmodSync,

7 existsSync,

8 lstatSync,

9 mkdirSync,

10 readdirSync,

11 readFileSync,

12 rmSync,

13 writeFileSync,

14} from "node:fs";

15import { homedir } from "node:os";

16import { basename, dirname, join, resolve, relative } from "node:path";

17import { fileURLToPath } from "node:url";

18import { parseDocument } from "yaml";

19import { verifyMcpRuntime } from "../lib/runtime-verify.mjs";

21const here = dirname(fileURLToPath(import.meta.url));

Lines 49-89javascript

49 ".claude/commands/sales/create-artifacts.md",

50 ".claude/commands/sales/orchestrator.md",

51 ".claude/skills",

52 "docs/codex-working-paths.md",

53];

55const SECRET_PATTERNS = [

56 /skt_(?:live|test|dev)_[A-Za-z0-9_-]+/g,

runtime/scripts/update-reply-draft.mjsView file

Lines 75-115javascript

75 const configPath =

76 process.env.SELLABLE_ADMIN_CONFIG_PATH ||

77 path.join(adminHome, "settings.json");

78 if (!existsSync(configPath)) {

79 throw new Error(`Missing settings file: ${configPath

runtime/scripts/notion-publish-harness.pyView file

•path = runtime/scripts/notion-publish-harness.py kind = build_helper sizeBytes = 19344 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

runtime/scripts/notion-publish-harness.pyView on unpkg

runtime/scripts/install-local-mcp.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @sellable/admin-install@0.1.12 matchedIdentity = npm:QHNlbGxhYmxlL2FkbWluLWluc3RhbGw:0.1.12 similarity = 0.833 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

runtime/scripts/install-local-mcp.mjsView on unpkg

scripts/sync-runtime-assets.mjsView file

Lines 22-62javascript

22 "scripts/grain-lightfield-sync.py",

23 "scripts/run-lightfield-crm.sh",

24 "scripts/run-lightfield-crm-scanner.sh",

25 "scripts/sellable-codex-run.sh",

26 "scripts/slack-pp-cli",

27 "tools/registry.json",

28 "mcp/skills",

29 ".claude/commands/content/engage.md"

Source & flagged code

7 flagged · loading source

bin/sellable-admin-install.mjsView file

69patternName = private_key_rsa severity = critical line = 69 matchedText = /-----BE...-/g,

Critical

Critical Secret

Package contains a critical-looking secret pattern.

bin/sellable-admin-install.mjsView on unpkg · L69

69patternName = private_key_rsa severity = critical line = 69 matchedText = /-----BE...-/g,

Critical

Secret Pattern

RSA private key in bin/sellable-admin-install.mjs

bin/sellable-admin-install.mjsView on unpkg · L69

1#!/usr/bin/env node L2: import { spawnSync } from "node:child_process"; L3: import { createHash } from "node:crypto";

High

Child Process

Package source references child process execution.

bin/sellable-admin-install.mjsView on unpkg · L1

runtime/scripts/update-reply-draft.mjsView file

95token: sellable.token, L96: apiUrl: sellable.apiUrl || "https://app.sellable.dev", L97: }; ... L101: return ( L102: process.env.SLACK_PP_CLI || L103: path.join(repoRoot, "scripts", "slack-pp-cli") ... L107: function runSlack(args) { L108: const result = spawnSync(slackCliPath(), args, { L109: cwd: repoRoot,

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

runtime/scripts/update-reply-draft.mjsView on unpkg · L95

runtime/scripts/notion-publish-harness.pyView file

•path = runtime/scripts/notion-publish-harness.py kind = build_helper sizeBytes = 19344 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

runtime/scripts/notion-publish-harness.pyView on unpkg

runtime/scripts/install-local-mcp.mjsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

runtime/scripts/install-local-mcp.mjsView on unpkg

scripts/sync-runtime-assets.mjsView file

42patternName = private_key_rsa severity = critical line = 42 matchedText = /-----BE...-/g,

Critical

Secret Pattern

RSA private key in scripts/sync-runtime-assets.mjs

scripts/sync-runtime-assets.mjsView on unpkg · L42

Findings

3 Critical4 High4 Medium4 Low

CriticalCritical Secretbin/sellable-admin-install.mjs

CriticalSecret Patternbin/sellable-admin-install.mjs

CriticalSecret Patternscripts/sync-runtime-assets.mjs

HighChild Processbin/sellable-admin-install.mjs

HighShell

HighSame File Env Network Executionruntime/scripts/update-reply-draft.mjs

HighPrevious Version Dangerous Deltaruntime/scripts/install-local-mcp.mjs

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperruntime/scripts/notion-publish-harness.py

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

7 flagged

bin/sellable-admin-install.mjsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import { spawnSync } from "node:child_process";

3import { createHash } from "node:crypto";

High

Child Process

Package source references child process execution.

bin/sellable-admin-install.mjsView on unpkg · L1

4import {

5 cpSync,

6 chmodSync,

7 existsSync,

8 lstatSync,

9 mkdirSync,

10 readdirSync,

11 readFileSync,

12 rmSync,

13 writeFileSync,

14} from "node:fs";

15import { homedir } from "node:os";

16import { basename, dirname, join, resolve, relative } from "node:path";

17import { fileURLToPath } from "node:url";

18import { parseDocument } from "yaml";

19import { verifyMcpRuntime } from "../lib/runtime-verify.mjs";

21const here = dirname(fileURLToPath(import.meta.url));

Lines 49-89javascript

49 ".claude/commands/sales/create-artifacts.md",

50 ".claude/commands/sales/orchestrator.md",

51 ".claude/skills",

52 "docs/codex-working-paths.md",

53];

55const SECRET_PATTERNS = [

56 /skt_(?:live|test|dev)_[A-Za-z0-9_-]+/g,

runtime/scripts/update-reply-draft.mjsView file

Lines 75-115javascript

75 const configPath =

76 process.env.SELLABLE_ADMIN_CONFIG_PATH ||

77 path.join(adminHome, "settings.json");

78 if (!existsSync(configPath)) {

79 throw new Error(`Missing settings file: ${configPath

runtime/scripts/notion-publish-harness.pyView file

•path = runtime/scripts/notion-publish-harness.py kind = build_helper sizeBytes = 19344 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

runtime/scripts/notion-publish-harness.pyView on unpkg

runtime/scripts/install-local-mcp.mjsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

runtime/scripts/install-local-mcp.mjsView on unpkg

scripts/sync-runtime-assets.mjsView file

Lines 22-62javascript

22 "scripts/grain-lightfield-sync.py",

23 "scripts/run-lightfield-crm.sh",

24 "scripts/run-lightfield-crm-scanner.sh",

25 "scripts/sellable-codex-run.sh",

26 "scripts/slack-pp-cli",

27 "tools/registry.json",

28 "mcp/skills",

29 ".claude/commands/content/engage.md"