registry / @shipeasy/cli / 2.8.2
@shipeasy/cli@2.8.2
CLI for the Shipeasy platform (flags, experiments, translations, bugs)
Static Scan Results
scanned 3mo ago · by rust-scannerStatic analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
One or more suspicious static signals were detected.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
5 flaggeddist/index.jsView file
46var import_node_http = __toESM(require("http"));
L47: var import_node_child_process = require("child_process");
L48:
High
45var import_node_crypto = __toESM(require("crypto"));
L46: var import_node_http = __toESM(require("http"));
L47: var import_node_child_process = require("child_process");
L48:
...
L55: function configPath() {
L56: const xdg = process.env.XDG_CONFIG_HOME;
L57: const root = xdg ? xdg : import_node_path.default.join(import_node_os.default.homedir(), ".config");
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/index.jsView on unpkg · L4545var import_node_crypto = __toESM(require("crypto"));
L46: var import_node_http = __toESM(require("http"));
L47: var import_node_child_process = require("child_process");
L48:
...
L55: function configPath() {
L56: const xdg = process.env.XDG_CONFIG_HOME;
L57: const root = xdg ? xdg : import_node_path.default.join(import_node_os.default.homedir(), ".config");
L58: return import_node_path.default.join(root, "shipeasy", "config.json");
...
L76: const raw = import_node_fs.default.readFileSync(configPath(), "utf-8");
L77: const parsed = JSON.parse(raw);
L78: if (!parsed.project_id || !parsed.cli_token) return null;
...
L136: if (url.pathname !== "/" && url.pathname !== "/callback") {
Findings
4 High4 Medium4 Low
HighChild Processdist/index.js
HighSame File Env Network Executiondist/index.js
HighHost Fingerprint Exfiltrationdist/index.js
HighRuntime Package Installdist/index.js
MediumDynamic Requirebin/shipeasy.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @shipeasy/cli@2.8.2.
See all versions of @shipeasy/cli for other recorded verdicts.
- Review the evidence and your use of @shipeasy/cli@2.8.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.