registry / @sky.ui/cli / 0.0.5

@sky.ui/cli@0.0.5

Sky UI Pro CLI — login, install, status, and npm setup for online licensing

Static Scan Results

scanned 11d ago · by rust-scanner

Static analysis flagged 8 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 10 file(s), 32.3 KB of source, external domains: library.sky-ui.com

Source & flagged code

1 flagged

lib/login.mjsView file

Lines 4-44javascript

4import {

5 CREDENTIALS_PATH,

6 LEGACY_SKY_UI_HOME,

7 postJson,

8 readCredentials,

9 writeCredentials,

10 exists,

11} from "./shared.mjs";

12import * as ui from "./ui.mjs";

14export async function cmdLogin() {

15 ui.intro("Sign in to Sky UI Pro");

17 const start = await postJson("/auth/cli/device/start", {});

19 ui.note(

20 `${color.bold(start.userCode)}\n${color.dim(start.verificationUrl)}`,

21 "Approve this code in your browser",

22 );

24 try {

25 const { default: open } = await import("open");

26 await open(start.verificationUrl);

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

lib/login.mjsView on unpkg · L24

27 ui.info("Browser opened — complete sign-in and approve the code.");

28 } catch {

29 ui.warn("Open the URL above manually if the browser did not launch.");

30 }

32 const spin = ui.spinner();

33 spin.start("Waiting for approval…");

35 try {

36 const deadline = Date.now() + start.expiresIn * 1000;

37 while (Date.now() < deadline) {

38 await new Promise((r) => setTimeout(r, 2000));

39 const poll = await postJson("/auth/cli/device/poll", { deviceCode: start.deviceCode });

40 if (poll.status === "approved" && poll.sessionToken) {

41 const creds = { sessionToken: poll.sessionToken };

42 if (poll.personalToken) creds.personalToken = poll.personalToken;

43 await writeCredentials(creds);

44 spin.stop("Signed in");

Source & flagged code

1 flagged · loading source

lib/login.mjsView file

24package = @sky.ui/cli; repositoryIdentity = sky-ui; dependency = open L24: try { L25: const { default: open } = await import("open"); L26: await open(start.verificationUrl);

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

lib/login.mjsView on unpkg · L24

Findings

1 High3 Medium4 Low

HighCopied Package Dependency Bridgelib/login.mjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

1 flagged

lib/login.mjsView file

Lines 4-44javascript

4import {

5 CREDENTIALS_PATH,

6 LEGACY_SKY_UI_HOME,

7 postJson,

8 readCredentials,

9 writeCredentials,

10 exists,

11} from "./shared.mjs";

12import * as ui from "./ui.mjs";

14export async function cmdLogin() {

15 ui.intro("Sign in to Sky UI Pro");

17 const start = await postJson("/auth/cli/device/start", {});

19 ui.note(

20 `${color.bold(start.userCode)}\n${color.dim(start.verificationUrl)}`,

21 "Approve this code in your browser",

22 );

24 try {

25 const { default: open } = await import("open");

26 await open(start.verificationUrl);

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

lib/login.mjsView on unpkg · L24

27 ui.info("Browser opened — complete sign-in and approve the code.");

28 } catch {

29 ui.warn("Open the URL above manually if the browser did not launch.");

30 }

32 const spin = ui.spinner();

33 spin.start("Waiting for approval…");

35 try {

36 const deadline = Date.now() + start.expiresIn * 1000;

37 while (Date.now() < deadline) {

38 await new Promise((r) => setTimeout(r, 2000));

39 const poll = await postJson("/auth/cli/device/poll", { deviceCode: start.deviceCode });

40 if (poll.status === "approved" && poll.sessionToken) {

41 const creds = { sessionToken: poll.sessionToken };

42 if (poll.personalToken) creds.personalToken = poll.personalToken;

43 await writeCredentials(creds);

44 spin.stop("Signed in");