registry / @stashr/cli / 0.1.0

@stashr/cli@0.1.0

Search, save, and organize your Stashr library from the command line.

AI Security Review

scanned 2h ago · by lpm-firewall-ai

No confirmed malicious attack surface. The CLI performs user-invoked Stashr API operations and an OAuth browser login.

Static reason

One or more suspicious static signals were detected.

Trigger

User runs the stashr CLI, especially stashr login or bookmark commands.

Impact

Expected account/bookmark operations; no unconsented execution, exfiltration, or persistence was established.

Mechanism

Authenticated Stashr API client with local OAuth token storage.

Rationale

Static signals arise from normal CLI OAuth, browser launching, local token persistence, and API requests. Source inspection found no concrete malicious behavior or install-time execution.

Evidence

package.jsondist/index.jsREADME.md

Network endpoints2

stashr.me127.0.0.1

Decision evidence

public snapshot

AI called this Clean at 96.0% confidence as Benign with low false-positive risk.

Evidence for block

Evidence against

package.json has no preinstall, install, or postinstall hook.
dist/index.js runs only as the declared stashr CLI entrypoint.
Network requests implement Stashr API and OAuth flows; no unrelated endpoint is embedded.
The only child-process use opens the user-requested login URL in a browser.
Credential storage is a mode-0600 Stashr config file; logout revokes and removes tokens.
No eval, dynamic payload loading, harvesting, or foreign agent-control writes found.

Behavioral surface

Source

ChildProcessEnvironmentVars

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

NoLicense

scanned 1 file(s), 67.1 KB of source, external domains: 127.0.0.1, example.com, stashr.me

Source & flagged code

3 flagged

dist/index.jsView file

Lines 1-33javascript

1#!/usr/bin/env node

2import{createRequire as dt}from"node:module";var vt=Object.create;var{getPrototypeOf:Zt,defineProperty:ot,getOwnPropertyNames:Dt}=Object;var Ft=Object.prototype.hasOwnProperty;var Kt=(t,e,r)=>{r=t!=null?vt(Zt(t)):{};let n=e||!t||!t.__esModule?ot(r,"default",{value:t,enumerable:!0}):r;for(let o of Dt(t))if(!Ft.call(n,o))ot(n,o,{get:()=>t[o],enumerable:!0});return n};var P=(t,e)=>()=>(e||t((e={exports:{}}).exports,e),e.exports);var A=dt(import.meta.url);var z=P((Vt)=>{class X extends Error{constructor(t,e,r){super(r);Error.captureStackTrace(this,this.constructor),this.name=this.constructor.name, ...

3`)}displayWidth(t){return ft(t).length}styleTitle(t){return t}styleUsage(t){return t.split(" ").map((e)=>{if(e==="[options]")return this.styleOptionText(e);if(e==="[command]")return this.styleSubcommandText(e);if(e[0]==="["||e[0]==="<")return this.styleArgumentText(e);return this.styleCommandText(e)}).join(" ")}styleCommandDescription(t){return this.styleDescriptionText(t)}styleOptionDescription(t){return this.styleDescriptionText(t)}styleSubcommandDescription(t){return this.styleDescriptionText(t)}styleArgumentDescription(t){return this.styleDescriptionText(t)}styleDescriptionText(t){return t ...

4`+" ".repeat(e+c));return i+s+" ".repeat(c)+a.replace(/\n/g,`

5${i}`)}boxWrap(t,e){if(e<this.minWidthToWrap)return t;let r=t.split(/\r\n|\n/),n=/[\s]*[^\s]+/g,o=[];return r.forEach((i)=>{let s=i.match(n);if(s===null){o.push("");return}let c=[s.shift()],u=this.displayWidth(c[0]);s.forEach((f)=>{let a=this.displayWidth(f);if(u+a<=e){c.push(f),u+=a;return}o.push(c.join(""));let h=f.trimStart();c=[h],u=this.displayWidth(h)}),o.push(c.join(""))}),o.join(`

6`)}}function ft(t){let e=/\x1b\[\d*(;\d*)*m/g;return t.replace(e,"")}ie.Help=ct;ie.stripColor=ft});var Q=P((ue)=>{var{InvalidArgumentError:fe}=z();class

7- a short flag is a single dash and a single character

8 - either use a single dash and a single character (for a short flag)

9 - or use a double dash for a long option (and can have two, like '--ws, --workspace')`);if(n.test(s))throw Error(`${c}

10- too many short flags`);if(o.test(s))throw Error(`${c}

11- too many long flags`);throw Error(`${c}

12- unrecognised flag format`)}if(e===void 0&&r===void 0)throw Error(`option creation failed due to no flags found in '${t}'.`);return{shortFlag:e,longFlag:r}}ue.Option=ut;ue.DualOptions=ht});var kt=P((we)=>{function le(t,e){if(Math.abs(t.length-e.length)>3)return Math.max(t.length,e.length);let r=[];for(let n=0;n<=t.length;n++)r[n]=[n];for(let n=0;n<=e.length;n++)r[0][n]=n;for(let n=1;n<=e.length;n++)for(let o=1;o<=t.length;o++){let i=1;if(t[o-1]===e[n-1])i=0;else i=1;if(r[o][n]=Math.min(r[o-1][n]+1,r[o][n-1]+1,r[o-1][n-1]+i),o>1&&n>1&&t[o-1]===e[n-2]&&t[o-2]===e[n-1])r[o][n]=Math.min(r[o][n],r ...

13(Did you mean one of ${n.join(", ")}?)`;if(n.length===1)return`

14(Did you mean ${n[0]}?)`;return""}we.suggestSimilar=ye});var _t=P(($e)=>{var Se=A("node:events").EventEmitter,v=A("node:child_process"),R=A("node:path"),G=A("node:fs"),k=A("node:process"),{

15- specify the name in Command constructor or using .name()`);if(e=e||{},e.isDefault)this._defaultCommandName=t._name;if(e.noHelp||e.hidden)t._hidden=!0;return this._registerCommand(t),t.parent=this,t._checkForBrokenPassThrough(),this}createArgument(t,e){return new Te(t,e)}argument(t,e,r,n){let o=this.createArgument(t,e);if(typeof r==="function")o.default(n).argParser(r);else o.default(r);return this.addArgument(o),this}arguments(t){return t.trim().split(/ +/).forEach((e)=>{this.argument(e)}),this}addArgument(t){let e=this.registeredArguments.slice(-1)[0];if(e?.variadic)throw Error(`only the la ...

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L13

16Expecting one of '${r.join("', '")}'`);if(this._lifeCycleHooks[t])this._lifeCycleHooks[t].push(e);else this._lifeCycleHooks[t]=[e];return this}exitOverride(t){if(t)this._exitCallback=t;else this._exitCallback=(e)=>{if(e.code!=="commander.executeSubCommandAsync")throw e};return this}_exit(t,e,r){if(this._exitCallback)this._exitCallback(new Z(t,e,r));k.exit(t)}action(t){let e=(r)=>{let n=this.registeredArguments.length,o=r.slice(0,n);if(this._storeOptionsAsProperties)o[n]=this;else o[n]=this.opts();return o.push(this),t.apply(this,o)};return this._actionHandler=e,this}createOption(t,e){return ne ...

17- already used by option '${e.flags}'`)}this._initOptionGroup(t),this.options.push(t)}_registerCommand(t){let e=(n)=>{return[n.name()].concat(n.aliases())},r=e(t).find((n)=>this._findCommand(n));if(r){let n=e(this.

18- either make a new Command for each call to parse, or stop storing options as properties`);this._name=this._savedState._name,this._scriptPath=null,this.rawArgs=[],this._optionValues={...this._savedState._optionValues},this._optionValueSources={...this._savedState._optionValueSources},this.args=[],this.processedArgs=[]}_checkForMissingExecutable(t,e,r){if(G.existsSync(t))return;let n=e?`searched for local subcommand relative to directory '${e}'`:"no directory for search for local subcommand, use .executableDir() to supply a custom directory",o=`'${t}' does not exist

19 - if '${r}' is not meant to be an executable command, remove description parameter from '.command()' and use '.description()' instead

20 - if the default executable name is not suitable, use the executableFile option to supply a custom name or path

21 - ${n}`;throw Error(o)}_executeSubCommand(t,e){e=e.slice();let r=!1,n=[".js",".ts",".tsx",".mjs",".cjs"];function o(f,a){let h=R.resolve(f,a);if(G.existsSync(h))return h;if(n.includes(R.extname(a)))return;let w=n.find((y)=>G.existsSync(`${h}${y}`));if(w)return`${h}${w}`;return}this._checkForMissingMandatoryOptions(),this._checkForConflictingOptions();let i=t._executableFile||`${this._name}-${t._name}`,s=this._executableDir||"";if(this._scriptPath){let f;try{f=G.realpathSync(this._scriptPath)}catch{f=this._scriptPath}s=R.resolve(R.dirname(f),s)}if(s){let f=o(s,i);if(!f&&!t._executableFile&&thi ...

22`,this._outputConfiguration.writeErr),typeof this._showHelpAfterError==="string")this._outputConfiguration.writeErr(`${this._showHelpAfterError}

23`);else if(this._showHelpAfterError)this._outputConfiguration.writeErr(`

24`),this.outputHelp({error:!0});let r=e||{},n=r.exitCode||1,o=r.code||"commander.error";this._exit(n,o,t)}_parseOptionsEnv(){this.options.forEach((t)=>{if(t.envVar&&t.envVar in k.env){let e=t.attributeName();if(this.getOptionValue(e)===void 0||[

25`),this._exit(0,"commander.version",t)}),this}description(t,e){if(t===void 0&&e===void 0)return this._description;if(this._description=t,e)this._argsDescription=e;return this}summary(t){if(t===void 0)return this._summary;return this._summary=t,this}alias(t){if(t===void 0)return this._aliases[0];let e=this;if(this.commands.length!==0&&this.commands[this.commands.length-1]._executableHandler)e=this.commands[this.commands.length-1];if(t===e._name)throw Error("Command alias can't be the same as its name");let r=this.parent?._findCommand(t);if(r){let n=[r.name()].concat(r.aliases()).join("|");throw ...

26Expecting one of '${r.join("', '")}'`);let n=`${t}Help`;return this.on(n,(o)=>{let i;if(typeof e==="function")i=e({error:o.error,command:o.command});else i=e;if(i)o.write(`${i}

27`)}),this}_outputHelpIfRequested(t){let e=this._getHelpOption();if(e&&t.find((n)=>e.is(n)))this.outputHelp(),this._exit(0,"commander.helpDisplayed","(outputHelp)")}}function wt(t){return t.map((e)=>{if(!e.startsWith("--inspect"))return e;let r,n="127.0.0.1",o="9229",i;if((i=e.match(/^

28`,{mode:384}),await Fe(n,r),await ve(r,384).catch(()=>{return})}import{spawn as ge}from"node:child_process";import{createHash as me,randomBytes as It}from"node:crypto";import{createServer as pe}from"node:http";var tr=48173,er=300000,O="read write destructive offline_access",rr=/\/$/;function C(t){let e;try{e=new URL(t)}catch{throw new l({code:"invalid_api_url",exitCode:3,message:"The Stashr API URL must be a valid http or https URL."})}if(!(e.protocol==="https:"||e.protocol==="http:"))throw new l({code:"invalid_api_url",exitCode:3,message:"The Stashr API URL must use http or https."});return e ...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L13

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L13

29`)?t:`${t}

30`}function zt(t){return t.title??t.author?.displayName??(t.author?`@${t.author.username}`:null)??`${t.platform} bookmark`}class tt{json;stderr;stdout;constructor(t,e={}){this.json

31`))}bookmark(t){let e=t.author?t.author.displayName??`@${t.author.username}`:"—",r=t.tags.map((n)=>n.name).join(", ")||"—";this.data(t,[zt(t),`ID: ${t.id}`,`URL: ${t.url}`,

32`))}bookmarks(t){let e=t.items.map((n)=>`${n.id} ${n.platform.padEnd(9)} ${zt(n)}

33 ${n.url}`),r=e.length===0?"No bookmarks found.":[e.join(`

Long lines were clipped for display.

Source & flagged code

3 flagged · loading source

dist/index.jsView file

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L13

13(Did you mean one of ${n.join(", ")}?)`;if(n.length===1)return` L14: (Did you mean ${n[0]}?)`;return""}we.suggestSimilar=ye});var _t=P(($e)=>{var Se=A("node:events").EventEmitter,v=A("node:child_process"),R=A("node:path"),G=A("node:fs"),k=A("node:pr... L15: - specify the name in Command constructor or using .name()`);if(e=e||{},e.isDefault)this._defaultCommandName=t._name;if(e.noHelp||e.hidden)t._hidden=!0;return this._registerCommand... ... L26: Expecting one of '${r.join("', '")}'`);let n=`${t}Help`;return this.on(n,(o)=>{let i;if(typeof e==="function")i=e({error:o.error,command:o.command});else i=e;if(i)o.write(`${i} L27: `)}),this}_outputHelpIfRequested(t){let e=this._getHelpOption();if(e&&t.find((n)=>e.is(n)))this.outputHelp(),this._exit(0,"commander.helpDisplayed","(outputHelp)")}}function wt(t){... L28: `,{mode:384}),await Fe(n,r),await ve(r,384).catch(()=>{return})}import{spawn as ge}from"node:child_process";import{createHash as me,randomBytes as It}from"node:crypto";import{creat...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L13

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L13

Findings

3 High1 Medium4 Low

HighChild Processdist/index.js

HighSame File Env Network Executiondist/index.js

HighCommand Output Exfiltrationdist/index.js

MediumEnvironment Vars

LowScripts Present

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

3 flagged

dist/index.jsView file

Lines 1-33javascript

1#!/usr/bin/env node

4`+" ".repeat(e+c));return i+s+" ".repeat(c)+a.replace(/\n/g,`

6`)}}function ft(t){let e=/\x1b\[\d*(;\d*)*m/g;return t.replace(e,"")}ie.Help=ct;ie.stripColor=ft});var Q=P((ue)=>{var{InvalidArgumentError:fe}=z();class

7- a short flag is a single dash and a single character

8 - either use a single dash and a single character (for a short flag)

9 - or use a double dash for a long option (and can have two, like '--ws, --workspace')`);if(n.test(s))throw Error(`${c}

10- too many short flags`);if(o.test(s))throw Error(`${c}

11- too many long flags`);throw Error(`${c}

13(Did you mean one of ${n.join(", ")}?)`;if(n.length===1)return`

14(Did you mean ${n[0]}?)`;return""}we.suggestSimilar=ye});var _t=P(($e)=>{var Se=A("node:events").EventEmitter,v=A("node:child_process"),R=A("node:path"),G=A("node:fs"),k=A("node:process"),{

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L13

19 - if '${r}' is not meant to be an executable command, remove description parameter from '.command()' and use '.description()' instead

20 - if the default executable name is not suitable, use the executableFile option to supply a custom name or path

22`,this._outputConfiguration.writeErr),typeof this._showHelpAfterError==="string")this._outputConfiguration.writeErr(`${this._showHelpAfterError}

23`);else if(this._showHelpAfterError)this._outputConfiguration.writeErr(`

26Expecting one of '${r.join("', '")}'`);let n=`${t}Help`;return this.on(n,(o)=>{let i;if(typeof e==="function")i=e({error:o.error,command:o.command});else i=e;if(i)o.write(`${i}

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L13

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L13

29`)?t:`${t}

30`}function zt(t){return t.title??t.author?.displayName??(t.author?`@${t.author.username}`:null)??`${t.platform} bookmark`}class tt{json;stderr;stdout;constructor(t,e={}){this.json

31`))}bookmark(t){let e=t.author?t.author.displayName??`@${t.author.username}`:"—",r=t.tags.map((n)=>n.name).join(", ")||"—";this.data(t,[zt(t),`ID: ${t.id}`,`URL: ${t.url}`,

32`))}bookmarks(t){let e=t.items.map((n)=>`${n.id} ${n.platform.padEnd(9)} ${zt(n)}

33 ${n.url}`),r=e.length===0?"No bookmarks found.":[e.join(`

Long lines were clipped for display.