registry / @stashr/cli / 0.2.0

@stashr/cli@0.2.0

Search, save, and organize your Stashr library from the command line.

AI Security Review

scanned 34m ago · by lpm-firewall-ai

No confirmed malicious attack surface. The package is a user-invoked Stashr CLI that performs authenticated API and OAuth operations.

Static reason

One or more suspicious static signals were detected.

Trigger

Running the stashr CLI, especially login or media commands.

Impact

Performs the requested Stashr account and bookmark operations; no stealth harvesting, foreign control-surface mutation, or install-time execution was found.

Mechanism

User-invoked Stashr OAuth, API requests, config persistence, and requested preview download.

Rationale

Static source inspection shows expected CLI behavior rather than a concrete malicious chain. Scanner hits map to bundled dependencies and legitimate OAuth/API functionality.

Evidence

package.jsonREADME.mddist/index.js

Network endpoints2

stashr.me127.0.0.1

Decision evidence

public snapshot

AI called this Clean at 96.0% confidence as Benign with low false-positive risk.

Evidence for block

Evidence against

package.json has no preinstall, install, or postinstall hook.
dist/index.js only runs its CLI parser when the bin is invoked.
Network requests use the Stashr API and OAuth endpoints; default base URL is https://stashr.me.
STASHR_API_KEY and OAuth tokens are used as Authorization bearer credentials for Stashr requests.
Child-process use opens the user OAuth URL; it does not execute collected commands.
Filesystem writes are limited to Stashr OAuth config and user-requested media output.

Behavioral surface

Source

ChildProcessEnvironmentVarsEval

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

NoLicense

scanned 1 file(s), 350 KB of source, external domains: 127.0.0.1, example.com, json-schema.org, stashr.me

Source & flagged code

4 flagged

dist/index.jsView file

Lines 1-46javascript

1#!/usr/bin/env node

2import{createRequire as q_}from"node:module";var O_=Object.create;var{getPrototypeOf:f_,defineProperty:Mi,getOwnPropertyNames:L_}=Object;var J_=Object.prototype.hasOwnProperty;var E_=(r,t,i)=>{i=r!=null?O_(f_(r)):{};let e=t||!r||!r.__esModule?Mi(i,"default",{value:r,enumerable:!0}):i;for(let n of L_(r))if(!J_.call(e,n))Mi(e,n,{get:()=>r[n],enumerable:!0});return e};var Nr=(r,t)=>()=>(t||r((t={exports:{}}).exports,t),t.exports);var ur=(r,t)=>{for(var i in t)Mi(r,i,{get:t[i],enumerable:!0,configurable:!0,set:(e)=>t[i]=()=>e})};var kn=q_(import.meta.url);var nt=Nr((WU)=>{class tl extends Error{co ...

3`)}displayWidth(r){return dI(r).length}styleTitle(r){return r}styleUsage(r){return r.split(" ").map((t)=>{if(t==="[options]")return this.styleOptionText(t);if(t==="[command]")return this.styleSubcommandText(t);if(t[0]==="["||t[0]==="<")return this.styleArgumentText(t);return this.styleCommandText(t)}).join(" ")}styleCommandDescription(r){return this.styleDescriptionText(r)}styleOptionDescription(r){return this.styleDescriptionText(r)}styleSubcommandDescription(r){return this.styleDescriptionText(r)}styleArgumentDescription(r){return this.styleDescriptionText(r)}styleDescriptionText(r){return r ...

4`+" ".repeat(t+v));return o+u+" ".repeat(v)+l.replace(/\n/g,`

5${o}`)}boxWrap(r,t){if(t<this.minWidthToWrap)return r;let i=r.split(/\r\n|\n/),e=/[\s]*[^\s]+/g,n=[];return i.forEach((o)=>{let u=o.match(e);

6`)}}function dI(r){let t=/\x1b\[\d*(;\d*)*m/g;return r.replace(t,"")}mU.Help=mI;mU.stripColor=dI});var ol=Nr((hU)=>{var{InvalidArgumentError:CU}=nt();class

7- a short flag is a single dash and a single character

8 - either use a single dash and a single character (for a short flag)

9 - or use a double dash for a long option (and can have two, like '--ws, --workspace')`);if(e.test(u))throw Error(`${v}

10- too many short flags`);if(n.test(u))throw Error(`${v}

11- too many long flags`);throw Error(`${v}

12- unrecognised flag format`)}if(t===void 0&&i===void 0)throw Error(`option creation failed due to no flags found in '${r}'.`);return{shortFlag:t,longFlag:i}}hU.Option=CI;hU.DualOptions=ZI});var hI=Nr((rb)=>{function pU(r,t){if(Math.abs(r.length-t.length)>3)return Math.max(r.length,t.length);let i=[];for(let e=0;e<=r.length;e++)i[e]=[e];for(let e=0;e<=t.length;e++)i[0][e]=e;for(let e=1;e<=t.length;e++)for(let n=1;n<=r.length;n++){let o=1;if(r[n-1]===t[e-1])o=0;else o=1;if(i[n][e]=Math.min(i[n-1][e]+1,i[n][e-1]+1,i[n-1][e-1]+o),n>1&&e>1&&r[n-1]===t[e-2]&&r[n-2]===t[e-1])i[n][e]=Math.min(i[n][e], ...

13(Did you mean one of ${e.join(", ")}?)`;if(e.length===1)return`

14(Did you mean ${e[0]}?)`;return""}rb.suggestSimilar=sU});var sI=Nr(($b)=>{var tb=kn("node:events").EventEmitter,el=kn("node:child_process"),lr=kn("node:path"),Vi=kn("node:fs"),J=kn("node:process"),{Argument

15- specify the name in Command constructor or using .name()`);if(t=t||{},t.isDefault)this._defaultCommandName=r._name;if(t.noHelp||t.hidden)r._hidden=!0;return this._registerCommand(r),r.parent=this,r._checkForBrokenPassThrough(),this}createArgument(r,t){return new ib(r,t)}argument(r,t,i,e){let n=this.createArgument(r,t);if(typeof i==="function")n.default(e).argParser(i);else n.default(i);return this.addArgument(n),this}arguments(r){return r.trim().split(/ +/).forEach((t)=>{this.argument(t)}),this}addArgument(r){let t=this.registeredArguments.slice(-1)[0];if(t?.variadic)throw Error(`only the la ...

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L13

16Expecting one of '${i.join("', '")}'`);if(this._lifeCycleHooks[r])this._lifeCycleHooks[r].push(t);else this._lifeCycleHooks[r]=[t];return this}exitOverride(r){if(r)this._exitCallback=r;else this._exitCallback=(t)=>{if(t.code!=="commander.executeSubCommandAsync")throw t};return this}_exit(r,t,i){if(this._exitCallback)this._exitCallback(new ul(r,t,i));J.exit(r)}action(r){let t=(i)=>{let e=this.registeredArguments.length,n=i.slice(0,e);if(this._storeOptionsAsProperties)n[e]=this;else n[e]=this.opts();return n.push(this),r.apply(this,n)};return this._actionHandler=t,this}createOption(r,t){return n ...

17- already used by option '${t.flags}'`)}this._initOptionGroup(r),this.options.push(r)}_registerCommand(r){let t=(e)=>{return[e.name()].concat(e.aliases())},i=t(r).find((e)=>this._findCommand(e));if(i){let e=

18- either make a new Command for each call to parse, or stop storing options as properties`);this._name=this._savedState._name,this._scriptPath=null,this.rawArgs=[],this._optionValues={...this._savedState._optionValues},this._optionValueSources={...this._savedState._optionValueSources},this.args=[],this.processedArgs=[]}_checkForMissingExecutable(r,t,i){if(Vi.existsSync(r))return;let e=t?`searched for local subcommand relative to directory '${t}'`:"no directory for search for local subcommand, use .executableDir() to supply a custom directory",n=`'${r}' does not exist

19 - if '${i}' is not meant to be an executable command, remove description parameter from '.command()' and use '.description()' instead

20 - if the default executable name is not suitable, use the executableFile option to supply a custom name or path

21 - ${e}`;throw Error(n)}_executeSubCommand(r,t){t=t.slice();let i=!1,e=[".js",".ts",".tsx",".mjs",".cjs"];function n($,l){let g=lr.resolve($,l);if(Vi.existsSync(g))return g;if(e.includes(lr.extname(l)))return;let b=e.find((U)=>Vi.existsSync(`${g}${U}`));if(b)return`${g}${b}`;return}this._checkForMissingMandatoryOptions(),this._checkForConflictingOptions();let o=r._executableFile||`${this._name}-${r._name}`,u=this._executableDir||"";if(this._scriptPath){let $;try{$=Vi.realpathSync(this._scriptPath)}catch{$=this._scriptPath}u=lr.resolve(lr.dirname($),u)}if(u){let $=n(u,o);if(!$&&!r._executableFi ...

22`,this._outputConfiguration.writeErr),typeof this._showHelpAfterError==="string")this._outputConfiguration.writeErr(`${this._showHelpAfterError}

23`);else if(this._showHelpAfterError)this._outputConfiguration.writeErr(`

24`),this.outputHelp({error:!0});let i=t||{},e=i.exitCode||1,n=i.code||"commander.error";this._exit(e,n,r)}_parseOptionsEnv(){this.options.forEach((r)=>{if(r.envVar&&r.envVar in J.env){let t=

25`),this._exit(0,"commander.version",r)}),this}description(r,t){if(r===void 0&&t===void 0)return this._description;if(this._description=r,t)this._argsDescription=t;return this}summary(r){if(r===void 0)return this._summary;return this._summary=r,this}alias(r){if(r===void 0)return this._aliases[0];let t=this;if(this.commands.length!==0&&this.commands[this.commands.length-1]._executableHandler)t=this.commands[this.commands.length-1];if(r===t._name)throw Error("Command alias can't be the same as its name");let i=this.parent?._findCommand(r);if(i){let e=[i.name()].concat(i.aliases()).join("|");throw ...

26Expecting one of '${i.join("', '")}'`);let e=`${r}Help`;return this.on(e,(n)=>{let o;if(typeof t==="function")o=t({error:n.error,command:n.command});else o=t;if(o)n.write(`${o}

27`)}),this}_outputHelpIfRequested(r){let t=this._getHelpOption();if(t&&r.find((e)=>t.is(e)))this.outputHelp(),this._exit(0,"commander.helpDisplayed","(outputHelp)")}}function pI(r){return r.map((t

28`)}var Qr=(r)=>(t,i,e,n)=>{let o=e?{...e,async:!1}:{async:!1},u=t._zod.run({value:i,issues:[]},o);if(u instanceof Promise)throw new nr;if

29`).filter((o)=>o),e=Math.min(...i.map((o)=>o.length-o.trimStart().length)),n=i.map((o)=>o.slice(e)).map((o)=>" ".repeat(this.indent*2)+o);for(let o of n)this.content.push(o)}compile(){let r=Function,t=this?.args,e=[...(this?.content??[""]).map((n)=>` ${n}`)];return new r(...t,e.join(`

30`))}}var so={major:4,minor:4,patch:3};var z=I("$ZodType",(r,t)=>{var i;r??(r={}),r._zod.def=t,r._zod.bag=r._zod.bag||{},r._zod.version=so;let e=[...r._zod.def.checks??[]];if(r._zod.traits.has("$ZodCheck"))e.unshift(r);for(let n of e)for(let o of n._zod.onattach)o(r);if(e.length===0)(i=r._zod).deferred??(i.deferred=[]),r._zod.deferred?.push(()=>{r._zod.run=r._zod.parse});else{let n=(u,v,c)=>{let $=Ur(u),l;for(let g of v){if(g._zod.def.when){if(ro(u))continue;if(!g._zod.def.when(u))continue}else if($)continue;let b=u.issues.length,U=g._zod.check(u);if(U instanceof Promise&&c?.async===!1)throw ne ...

31 if (${X}.issues.length) {

32 if (${Y} in input) {

33 payload.issues = payload.issues.concat(${X}.issues.map(iss => ({

34 ...iss,

35 path: iss.path ? [${Y}, ...iss.path] : [${Y}]

36 })));

37 }

38 }

40 if (${X}.value === undefined) {

41 if (${Y} in input) {

42 newResult[${Y}] = undefined;

43 }

44 } else {

45 newResult[${Y}] = ${X}.value;

46 }

Long lines were clipped for display.

Lines 70-110javascript

70 }

71 }

73 `);else U.write(`

74 if (${X}.issues.length) {

75 payload.issues = payload.issues.concat(${X}.issues.map(iss => ({

76 ...iss,

77 path: iss.path ? [${Y}, ...iss.path] : [${Y}]

Source & flagged code

4 flagged · loading source

dist/index.jsView file

13(Did you mean one of ${e.join(", ")}?)`;if(e.length===1)return` L14: (Did you mean ${e[0]}?)`;return""}rb.suggestSimilar=sU});var sI=Nr(($b)=>{var tb=kn("node:events").EventEmitter,el=kn("node:child_process"),lr=kn("node:path"),Vi=kn("node:fs"),J=kn... L15: - specify the name in Command constructor or using .name()`);if(t=t||{},t.isDefault)this._defaultCommandName=r._name;if(t.noHelp||t.hidden)r._hidden=!0;return this._registerCommand...

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L13

90L91: Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.`)}for(let u of r.seen.entries()){let v=u[1];if(t===u[0]){o(u);continue}if(r.external){let $=r.exter... L92: `));break;case"table":{if(e.header?.length)i.push(e.header.map(JI).join("\t"));for(let n of e.rows)i.push(n.map(JI).join("\t"));break}case"embed":{let n=e.author.displayName?`${e.a... ... L94: L95: `)}function QI(r){return r.title??r.author?.displayName??(r.author?`@${r.author.username}`:null)??`${r.platform} bookmark`}function AU(r){if(!r.author)return null;return r.author.d... L96: `,{mode:384}),await qb(e,i),await Lb(i,384).catch(()=>{return})}import{spawn as Yb}from"node:child_process";import{createHash as Kb,randomBytes as $_}from"node:crypto";import{creat... L97: `)?r:`${r}

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L90

15- specify the name in Command constructor or using .name()`);if(t=t||{},t.isDefault)this._defaultCommandName=r._name;if(t.noHelp||t.hidden)r._hidden=!0;return this._registerCommand... L16: Expecting one of '${i.join("', '")}'`);if(this._lifeCycleHooks[r])this._lifeCycleHooks[r].push(t);else this._lifeCycleHooks[r]=[t];return this}exitOverride(r){if(r)this._exitCallba... L17: - already used by option '${t.flags}'`)}this._initOptionGroup(r),this.options.push(r)}_registerCommand(r){let t=(e)=>{return[e.name()].concat(e.aliases())},i=t(r).find((e)=>this._... L18: - either make a new Command for each call to parse, or stop storing options as properties`);this._name=this._savedState._name,this._scriptPath=null,this.rawArgs=[],this._optionValu... ... L24: `),this.outputHelp({error:!0});let i=t||{},e=i.exitCode||1,n=i.code||"commander.error";this._exit(e,n,r)}_parseOptionsEnv(){this.options.forEach((r)=>{if(r.envVar&&r.envVar in J.en... L25: `),this._exit(0,"commander.version",r)}),this}description(r,t){if(r===void 0&&t===void 0)return this._description;if(this._description=r,t)this._argsDescription=t;return this}summa... L26: Expecting one of '${i.join("', '")}'`);let e=`${r}Help`;r

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L15

26Expecting one of '${i.join("', '")}'`);let e=`${r}Help`;return this.on(e,(n)=>{let o;if(typeof t==="function")o=t({error:n.error,command:n.command});else o=t;if(o)n.write(`${o} L27: `)}),this}_outputHelpIfRequested(r){let t=this._getHelpOption();if(t&&r.find((e)=>t.is(e)))this.outputHelp(),this._exit(0,"commander.helpDisplayed","(outputHelp)")}}function pI(r){... L28: `)}var Qr=(r)=>(t,i,e,n)=>{let o=e?{...e,async:!1}:{async:!1},u=t._zod.run({value:i,issues:[]},o);if(u instanceof Promise)throw new nr;if(u.issues.length){let v=new(n?.Err??r)(u.is...

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/index.jsView on unpkg · L26

Findings

3 High1 Medium5 Low

HighChild Processdist/index.js

HighSame File Env Network Executiondist/index.js

HighCommand Output Exfiltrationdist/index.js

MediumEnvironment Vars

LowScripts Present

LowEvaldist/index.js

LowHigh Entropy Strings

LowUrl Strings

LowNo License