registry / @sky.ui/cli / 0.0.28

@sky.ui/cli@0.0.28

Sky UI Pro CLI — login, install, status, and npm setup for online licensing

Static Scan Results

scanned 8h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 18 file(s), 72.3 KB of source, external domains: library.sky-ui.com

Source & flagged code

2 flagged

lib/login.mjsView file

Lines 4-44javascript

4import {

5 CREDENTIALS_PATH,

6 LEGACY_SKY_UI_HOME,

7 postJson,

8 readCredentials,

9 writeCredentials,

10 exists,

11} from "./shared.mjs";

12import * as ui from "./ui.mjs";

14export async function cmdLogin() {

15 ui.intro("Sign in to Sky UI Pro");

17 const start = await postJson("/auth/cli/device/start", {});

19 ui.note(

20 `${color.bold(start.userCode)}\n${color.dim(start.verificationUrl)}`,

21 "Approve this code in your browser",

22 );

24 try {

25 const { default: open } = await import("open");

26 await open(start.verificationUrl);

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

lib/login.mjsView on unpkg · L24

27 ui.info("Browser opened — complete sign-in and approve the code.");

28 } catch {

29 ui.warn("Open the URL above manually if the browser did not launch.");

30 }

32 const spin = ui.spinner();

33 spin.start("Waiting for approval…");

35 try {

36 const deadline = Date.now() + start.expiresIn * 1000;

37 while (Date.now() < deadline) {

38 await new Promise((r) => setTimeout(r, 2000));

39 const poll = await postJson("/auth/cli/device/poll", { deviceCode: start.deviceCode });

40 if (poll.status === "approved" && poll.sessionToken) {

41 const creds = { sessionToken: poll.sessionToken };

42 if (poll.personalToken) creds.personalToken = poll.personalToken;

43 await writeCredentials(creds);

44 spin.stop("Signed in");

lib/install.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @sky.ui/cli@0.0.27 matchedIdentity = npm:QHNreS51aS9jbGk:0.0.27 similarity = 0.944 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/install.mjsView on unpkg

Source & flagged code

2 flagged · loading source

lib/login.mjsView file

24package = @sky.ui/cli; repositoryIdentity = sky-ui; dependency = open L24: try { L25: const { default: open } = await import("open"); L26: await open(start.verificationUrl);

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

lib/login.mjsView on unpkg · L24

lib/install.mjsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/install.mjsView on unpkg

Findings

2 High3 Medium5 Low

HighCopied Package Dependency Bridgelib/login.mjs

HighPrevious Version Dangerous Deltalib/install.mjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

2 flagged

lib/login.mjsView file

Lines 4-44javascript

4import {

5 CREDENTIALS_PATH,

6 LEGACY_SKY_UI_HOME,

7 postJson,

8 readCredentials,

9 writeCredentials,

10 exists,

11} from "./shared.mjs";

12import * as ui from "./ui.mjs";

14export async function cmdLogin() {

15 ui.intro("Sign in to Sky UI Pro");

17 const start = await postJson("/auth/cli/device/start", {});

19 ui.note(

20 `${color.bold(start.userCode)}\n${color.dim(start.verificationUrl)}`,

21 "Approve this code in your browser",

22 );

24 try {

25 const { default: open } = await import("open");

26 await open(start.verificationUrl);

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

lib/login.mjsView on unpkg · L24

27 ui.info("Browser opened — complete sign-in and approve the code.");

28 } catch {

29 ui.warn("Open the URL above manually if the browser did not launch.");

30 }

32 const spin = ui.spinner();

33 spin.start("Waiting for approval…");

35 try {

36 const deadline = Date.now() + start.expiresIn * 1000;

37 while (Date.now() < deadline) {

38 await new Promise((r) => setTimeout(r, 2000));

39 const poll = await postJson("/auth/cli/device/poll", { deviceCode: start.deviceCode });

40 if (poll.status === "approved" && poll.sessionToken) {

41 const creds = { sessionToken: poll.sessionToken };

42 if (poll.personalToken) creds.personalToken = poll.personalToken;

43 await writeCredentials(creds);

44 spin.stop("Signed in");

lib/install.mjsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/install.mjsView on unpkg