registry / @share2us/cli / 0.1.5

@share2us/cli@0.1.5

Share2Us CLI (s2u) — share files and text from your terminal, browser, or AI agent via one opaque, expiring link.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetwork

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 4.67 KB of source, external domains: github.com, share2.us

Source & flagged code

5 flagged

package.jsonView file

Lines 11-49json

11 "cli",

12 "p2p",

13 "qr",

14 "mcp",

15 "e2e"

16 ],

17 "homepage": "https://share2.us",

18 "bugs": "https://github.com/share2us/cli/issues",

19 "repository": {

20 "type": "git",

21 "url": "git+https://github.com/share2us/cli.git",

22 "directory": "npm"

23 },

24 "license": "MIT",

25 "author": "Share2Us",

26 "bin": {

27 "s2u": "bin/s2u.js",

28 "share2us": "bin/s2u.js"

29 },

30 "scripts": {

31 "postinstall": "node install.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L31

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L31

32 },

33 "files": [

34 "bin/s2u.js",

35 "install.js"

36 ],

37 "os": [

38 "linux",

39 "darwin"

40 ],

41 "cpu": [

42 "x64",

43 "arm64"

44 ],

45 "engines": {

46 "node": ">=16"

47 }

48}

49

bin/s2u.jsView file

Lines 1-24javascript

1#!/usr/bin/env node

2// Thin launcher: exec the native Share2Us CLI binary that install.js placed here.

3"use strict";

4

5const fs = require("fs");

6const path = require(

install.jsView file

Lines 1-23javascript

1#!/usr/bin/env node

2// postinstall: download the prebuilt Share2Us CLI binary for this platform from

3// GitHub Releases (built by CI for every platform) and place it next to the shim.

4// Mirrors https://share2.us/install.sh (system tar + cksum; no runtime deps).

5"use strict";

6

7const fs = require("fs");

8const

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.json

View on unpkg

•scripts.postinstall = node install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/s2u.jsView file

6const path = require("path"); L7: const { spawnSync } = require("child_process"); L8:

High

Child Process

Package source references child process execution.

bin/s2u.jsView on unpkg · L6

install.jsView file

3// GitHub Releases (built by CI for every platform) and place it next to the shim. L4: // Mirrors https://share2.us/install.sh (system tar + cksum; no runtime deps). L5: "use strict"; ... L10: const https = require("https"); L11: const { execFileSync } = require("child_process"); L12: L13: const REPO = process.env.SHARE2US_INSTALL_REPO || "share2us/cli"; L14:

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

install.jsView on unpkg · L3

3// GitHub Releases (built by CI for every platform) and place it next to the shim. L4: // Mirrors https://share2.us/install.sh (system tar + cksum; no runtime deps). L5: "use strict"; ... L10: const https = require("https"); L11: const { execFileSync } = require("child_process"); L12: L13: const REPO = process.env.SHARE2US_INSTALL_REPO || "share2us/cli"; L14: L15: // The release this npm version maps to. CI pins `share2usCliVersion` in L16: // package.json to the matching release tag at publish time, so a given npm L17: // version always installs the same binary. Falls back to the latest release. ... L32: function platform() {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

install.jsView on unpkg · L3

Findings

4 High4 Medium3 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processbin/s2u.js

HighSame File Env Network Executioninstall.js

HighSandbox Evasion Gated Capabilityinstall.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowUrl Strings

LPM CLI

6.64 KB · 4 files1 signature(s)

Install lifecyclepostinstall

Behavioral surface

ChildProcessEnvironmentVarsFilesystemNetworkUrlStringsManifest: clean

Source & flagged code

5 flagged

package.jsonView file

Lines 11-49json

11 "cli",

12 "p2p",

13 "qr",

14 "mcp",

15 "e2e"

16 ],

17 "homepage": "https://share2.us",

18 "bugs": "https://github.com/share2us/cli/issues",

19 "repository": {

20 "type": "git",

21 "url": "git+https://github.com/share2us/cli.git",

22 "directory": "npm"

23 },

24 "license": "MIT",

25 "author": "Share2Us",

26 "bin": {

27 "s2u": "bin/s2u.js",

28 "share2us": "bin/s2u.js"

29 },

30 "scripts": {

31 "postinstall": "node install.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L31

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L31

32 },

33 "files": [

34 "bin/s2u.js",

35 "install.js"

36 ],

37 "os": [

38 "linux",

39 "darwin"

40 ],

41 "cpu": [

42 "x64",

43 "arm64"

44 ],

45 "engines": {

46 "node": ">=16"

47 }

48}

49

bin/s2u.jsView file

Lines 1-24javascript

1#!/usr/bin/env node

2// Thin launcher: exec the native Share2Us CLI binary that install.js placed here.

3"use strict";

4

5const fs = require("fs");

6const path = require(

install.jsView file

Lines 1-23javascript

1#!/usr/bin/env node

2// postinstall: download the prebuilt Share2Us CLI binary for this platform from

3// GitHub Releases (built by CI for every platform) and place it next to the shim.

4// Mirrors https://share2.us/install.sh (system tar + cksum; no runtime deps).

5"use strict";

6

7const fs = require("fs");

8const

"path"

);

7const { spawnSync } = require("child_process");

8

High

Child Process

Package source references child process execution.

bin/s2u.jsView on unpkg · L6

9const bin = path.join(__dirname, "share2us-bin");

10

11if (!fs.existsSync(bin)) {

12 console.error("share2us: the CLI binary is missing (install scripts may have been skipped).");

13 console.error("Reinstall with `npm i -g @share2us/cli`, or run:");

14 console.error(" node " + path.join(__dirname, "..", "install.js"));

15 process.exit(1);

16}

17

18const res = spawnSync(bin, process.argv.slice(2), { stdio: "inherit" });

19if (res.error) {

20 console.error("share2us: " + res.error.message);

21 process.exit(1);

22}

23process.exit(res.status === null ? 1 : res.status);

24

os

=

require

(

"os"

);

9const path = require("path");

10const https = require("https");

11const { execFileSync } = require("child_process");

12

13const REPO = process.env.SHARE2US_INSTALL_REPO || "share2us/cli";

14

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

install.jsView on unpkg · L3

15// The release this npm version maps to. CI pins `share2usCliVersion` in

16// package.json to the matching release tag at publish time, so a given npm

17// version always installs the same binary. Falls back to the latest release.

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

install.jsView on unpkg · L3

18function pinnedVersion() {

19 try {

20 return require("./package.json").share2usCliVersion || "latest";

21 } catch (e) {

22 return "latest";

23 }