registry / @stashr/cli / 0.2.0

@stashr/cli@0.2.0

Search, save, and organize your Stashr library from the command line.

AI Security Review

scanned 1h ago · by lpm-firewall-ai

No confirmed malicious attack surface. The package is a user-invoked Stashr CLI that performs authenticated API and OAuth operations.

Static reason

One or more suspicious static signals were detected.

Trigger

Running the stashr CLI, especially login or media commands.

Impact

Performs the requested Stashr account and bookmark operations; no stealth harvesting, foreign control-surface mutation, or install-time execution was found.

Mechanism

User-invoked Stashr OAuth, API requests, config persistence, and requested preview download.

Rationale

Static source inspection shows expected CLI behavior rather than a concrete malicious chain. Scanner hits map to bundled dependencies and legitimate OAuth/API functionality.

Evidence

package.jsonREADME.mddist/index.js

Network endpoints2

stashr.me127.0.0.1

Decision evidence

public snapshot

AI called this Clean at 96.0% confidence as Benign with low false-positive risk.

Evidence for block

Evidence against

package.json has no preinstall, install, or postinstall hook.
dist/index.js only runs its CLI parser when the bin is invoked.
Network requests use the Stashr API and OAuth endpoints; default base URL is https://stashr.me.
STASHR_API_KEY and OAuth tokens are used as Authorization bearer credentials for Stashr requests.
Child-process use opens the user OAuth URL; it does not execute collected commands.
Filesystem writes are limited to Stashr OAuth config and user-requested media output.

Behavioral surface

Source

ChildProcessEnvironmentVarsEval

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

NoLicense

scanned 1 file(s), 350 KB of source, external domains: 127.0.0.1, example.com, json-schema.org, stashr.me

Source & flagged code

4 flagged

dist/index.jsView file

Lines 1-46javascript

1#!/usr/bin/env node

2import{createRequire as q_}from"node:module";var O_=Object.create;var{getPrototypeOf:f_,defineProperty:Mi,getOwnPropertyNames:L_}=Object;var J_=Object.prototype.hasOwnProperty;var E_=(r,t,i)=>{i=r!=null?O_(f_(r)):{};let e=t||!r||!r.__esModule?Mi(i,"default",{value:r,enumerable:!0}):i;for(let n of L_(r))if(!J_.call(e,n))Mi(e,n,{get:()=>r[n],enumerable:!0});return e};var Nr=(r,t)=>()=>(t||r((t={exports:{}}).exports,t),t.exports);var ur=(r,t)=>{for(var i in t)Mi(r,i,{get:t[i],enumerable:!0,configurable:!0,set:(e)=>t[i]=()=>e})};var kn=q_(import.meta.url);var nt=Nr((WU)=>{class tl extends Error{co ...

3`)}displayWidth(r){return dI(r).length}styleTitle(r){return r}styleUsage(r){return r.split(" ").map((t)=>{if(t==="[options]")return this.styleOptionText(t);if(t==="[command]")return this.styleSubcommandText(t);if(t[0]==="["||t[0]==="<")return this.styleArgumentText(t);return this.styleCommandText(t)}).join(" ")}styleCommandDescription(r){return this.styleDescriptionText(r)}styleOptionDescription(r){return this.styleDescriptionText(r)}styleSubcommandDescription(r){return this.styleDescriptionText(r)}styleArgumentDescription(r){return this.styleDescriptionText(r)}styleDescriptionText(r){return r ...

4`+" ".repeat(t+v));return o+u+" ".repeat(v)+l.replace(/\n/g,`

5${o}`)}boxWrap(r,t){if(t<this.minWidthToWrap)return r;let i=r.split(/\r\n|\n/),e=/[\s]*[^\s]+/g,n=[];return i.forEach((o)=>{let u=o.match(e);if(u===null){n.push("");return}let v=[u.shift()],c=this.displayWidth(v[0]);u.forEach(($)=>{let l=this.displayWidth($);if(c+l<=t){v.push($),c+=l;return}n.push(v.join(""));let g=$.trimStart();v=[g],c=this.displayWidth(g)}),n.push(v.join(""))}),n.join(`

6`)}}function dI(r){let t=/\x1b\[\d*(;\d*)*m/g;return r.replace(t,"")}mU.Help=mI;mU.stripColor=dI});var ol=Nr((hU)=>{var{InvalidArgumentError:CU}=nt();class CI{constructor(r,t){this.flags=r,this.description=t||"",this.required=r.includes("<"),this.optional=r.includes("["),this.variadic=/\w\.\.\.[>\]]$/.test(r),this.mandatory=!1;let i=ZU(r);if(this.short=i.shortFlag,this.long=i.longFlag,this.negate=!1,this.long)this.negate=this.long.startsWith("--no-");this.defaultValue=void 0,this.defaultValueDescription=void 0,this.presetArg=void 0,this.envVar=void 0,this.parseArg=void 0,this.hidden=!1,this.ar ...

7- a short flag is a single dash and a single character

8 - either use a single dash and a single character (for a short flag)

9 - or use a double dash for a long option (and can have two, like '--ws, --workspace')`);if(e.test(u))throw Error(`${v}

10- too many short flags`);if(n.test(u))throw Error(`${v}

11- too many long flags`);throw Error(`${v}

12- unrecognised flag format`)}if(t===void 0&&i===void 0)throw Error(`option creation failed due to no flags found in '${r}'.`);return{shortFlag:t,longFlag:i}}hU.Option=CI;hU.DualOptions=ZI});var hI=Nr((rb)=>{function pU(r,t){if(Math.abs(r.length-t.length)>3)return Math.max(r.length,t.length);let i=[];for(let e=0;e<=r.length;e++)i[e]=[e];for(let e=0;e<=t.length;e++)i[0][e]=e;for(let e=1;e<=t.length;e++)for(let n=1;n<=r.length;n++){let o=1;if(r[n-1]===t[e-1])o=0;else o=1;if(i[n][e]=Math.min(i[n-1][e]+1,i[n][e-1]+1,i[n-1][e-1]+o),n>1&&e>1&&r[n-1]===t[e-2]&&r[n-2]===t[e-1])i[n][e]=Math.min(i[n][e], ...

13(Did you mean one of ${e.join(", ")}?)`;if(e.length===1)return`

14(Did you mean ${e[0]}?)`;return""}rb.suggestSimilar=sU});var sI=Nr(($b)=>{var tb=kn("node:events").EventEmitter,el=kn("node:child_process"),lr=kn("node:path"),Vi=kn("node:fs"),J=kn("node:process"),{Argument:ib,humanReadableArgName:ob}=Ki(),{CommanderError:ul}=nt(),{Help:eb,stripColor:ub}=il(),{Option:yI,DualOptions:vb}=ol(),{suggestSimilar:aI}=hI();class $l extends tb{constructor(r){super();this.commands=[],this.options=[],this.parent=null,this._allowUnknownOption=!1,this._allowExcessArguments=!1,this.registeredArguments=[],this._args=this.registeredArguments,this.args=[],this.rawArgs=[],this. ...

15- specify the name in Command constructor or using .name()`);if(t=t||{},t.isDefault)this._defaultCommandName=r._name;if(t.noHelp||t.hidden)r._hidden=!0;return this._registerCommand(r),r.parent=this,r._checkForBrokenPassThrough(),this}createArgument(r,t){return new ib(r,t)}argument(r,t,i,e){let n=this.createArgument(r,t);if(typeof i==="function")n.default(e).argParser(i);else n.default(i);return this.addArgument(n),this}arguments(r){return r.trim().split(/ +/).forEach((t)=>{this.argument(t)}),this}addArgument(r){let t=this.registeredArguments.slice(-1)[0];if(t?.variadic)throw Error(`only the la ...

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L13

16Expecting one of '${i.join("', '")}'`);if(this._lifeCycleHooks[r])this._lifeCycleHooks[r].push(t);else this._lifeCycleHooks[r]=[t];return this}exitOverride(r){if(r)this._exitCallback=r;else this._exitCallback=(t)=>{if(t.code!=="commander.executeSubCommandAsync")throw t};return this}_exit(r,t,i){if(this._exitCallback)this._exitCallback(new ul(r,t,i));J.exit(r)}action(r){let t=(i)=>{let e=this.registeredArguments.length,n=i.slice(0,e);if(this._storeOptionsAsProperties)n[e]=this;else n[e]=this.opts();return n.push(this),r.apply(this,n)};return this._actionHandler=t,this}createOption(r,t){return n ...

17- already used by option '${t.flags}'`)}this._initOptionGroup(r),this.options.push(r)}_registerCommand(r){let t=(e)=>{return[e.name()].concat(e.aliases())},i=t(r).find((e)=>this._findCommand(e));if(i){let e=t(this._findCommand(i)).join("|"),n=t(r).join("|");throw Error(`cannot add command '${n}' as already have command '${e}'`)}this._initCommandGroup(r),this.commands.push(r)}addOption(r){this._registerOption(r);let t=r.name(),i=r.attributeName();if(r.negate){let n=r.long.replace(/^--no-/,"--");if(!this._findOption(n))this.setOptionValueWithSource(i,r.defaultValue===void 0?!0:r.defaultValue,"d ...

18- either make a new Command for each call to parse, or stop storing options as properties`);this._name=this._savedState._name,this._scriptPath=null,this.rawArgs=[],this._optionValues={...this._savedState._optionValues},this._optionValueSources={...this._savedState._optionValueSources},this.args=[],this.processedArgs=[]}_checkForMissingExecutable(r,t,i){if(Vi.existsSync(r))return;let e=t?`searched for local subcommand relative to directory '${t}'`:"no directory for search for local subcommand, use .executableDir() to supply a custom directory",n=`'${r}' does not exist

19 - if '${i}' is not meant to be an executable command, remove description parameter from '.command()' and use '.description()' instead

20 - if the default executable name is not suitable, use the executableFile option to supply a custom name or path

21 - ${e}`;throw Error(n)}_executeSubCommand(r,t){t=t.slice();let i=!1,e=[".js",".ts",".tsx",".mjs",".cjs"];function n($,l){let g=lr.resolve($,l);if(Vi.existsSync(g))return g;if(e.includes(lr.extname(l)))return;let b=e.find((U)=>Vi.existsSync(`${g}${U}`));if(b)return`${g}${b}`;return}this._checkForMissingMandatoryOptions(),this._checkForConflictingOptions();let o=r._executableFile||`${this._name}-${r._name}`,u=this._executableDir||"";if(this._scriptPath){let $;try{$=Vi.realpathSync(this._scriptPath)}catch{$=this._scriptPath}u=lr.resolve(lr.dirname($),u)}if(u){let $=n(u,o);if(!$&&!r._executableFi ...

22`,this._outputConfiguration.writeErr),typeof this._showHelpAfterError==="string")this._outputConfiguration.writeErr(`${this._showHelpAfterError}

23`);else if(this._showHelpAfterError)this._outputConfiguration.writeErr(`

24`),this.outputHelp({error:!0});let i=t||{},e=i.exitCode||1,n=i.code||"commander.error";this._exit(e,n,r)}_parseOptionsEnv(){this.options.forEach((r)=>{if(r.envVar&&r.envVar in J.env){let t=r.attributeName();if(this.getOptionValue(t)===void 0||["default","config","env"].includes(this.getOptionValueSource(t)))if(r.required||r.optional)this.emit(`optionEnv:${r.name()}`,J.env[r.envVar]);else this.emit(`optionEnv:${r.name()}`)}})}_parseOptionsImplied(){let r=new vb(this.options),t=(i)=>{return this.getOptionValue(i)!==void 0&&!["default","implied"].includes(this.getOptionValueSource(i))};this.optio ...

25`),this._exit(0,"commander.version",r)}),this}description(r,t){if(r===void 0&&t===void 0)return this._description;if(this._description=r,t)this._argsDescription=t;return this}summary(r){if(r===void 0)return this._summary;return this._summary=r,this}alias(r){if(r===void 0)return this._aliases[0];let t=this;if(this.commands.length!==0&&this.commands[this.commands.length-1]._executableHandler)t=this.commands[this.commands.length-1];if(r===t._name)throw Error("Command alias can't be the same as its name");let i=this.parent?._findCommand(r);if(i){let e=[i.name()].concat(i.aliases()).join("|");throw ...

26Expecting one of '${i.join("', '")}'`);let e=`${r}Help`;return this.on(e,(n)=>{let o;if(typeof t==="function")o=t({error:n.error,command:n.command});else o=t;if(o)n.write(`${o}

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L15

27`)}),this}_outputHelpIfRequested(r){let t=this._getHelpOption();if(t&&r.find((e)=>t.is(e)))this.outputHelp(),this._exit(0,"commander.helpDisplayed","(outputHelp)")}}function pI(r){return r.map((t)=>{if(!t.startsWith("--inspect"))return t;let i,e="127.0.0.1",n="9229",o;if((o=t.match(/^(--inspect(-brk)?)$/))!==null)i=o[1];else if((o=t.match(/^(--inspect(-brk|-port)?)=([^:]+)$/))!==null)if(i=o[1],/^\d+$/.test(o[3]))n=o[3];else e=o[3];else if((o=t.match(/^(--inspect(-brk|-port)?)=([^:]+):(\d+)$/))!==null)i=o[1],e=o[3],n=o[4];if(i&&n!=="0")return`${i}=${e}:${parseInt(n)+1}`;return t})}function vl() ...

28`)}var Qr=(r)=>(t,i,e,n)=>{let o=e?{...e,async:!1}:{async:!1},u=t._zod.run({value:i,issues:[]},o);if(u instanceof Promise)throw new nr;if(u.issues.length){let v=new(n?.Err??r)(u.issues.map((c)=>Q(c,o,B())));throw et(v,n?.callee),v}return u.value},ut=Qr(x),Rr=(r)=>async(t,i,e,n)=>{let o=e?{...e,async:!0}:{async:!0},u=t._zod.run({value:i,issues:[]},o);if(u instanceof Promise)u=await u;if(u.issues.length){let v=new(n?.Err??r)(u.issues.map((c)=>Q(c,o,B())));throw et(v,n?.callee),v}return u.value},vt=Rr(x),Mr=(r)=>(t,i,e)=>{let n=e?{...e,async:!1}:{async:!1},o=t._zod.run({value:i,issues:[]},n);if(o ...

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/index.jsView on unpkg · L26

29`).filter((o)=>o),e=Math.min(...i.map((o)=>o.length-o.trimStart().length)),n=i.map((o)=>o.slice(e)).map((o)=>" ".repeat(this.indent*2)+o);for(let o of n)this.content.push(o)}compile(){let r=Function,t=this?.args,e=[...(this?.content??[""]).map((n)=>` ${n}`)];return new r(...t,e.join(`

30`))}}var so={major:4,minor:4,patch:3};var z=I("$ZodType",(r,t)=>{var i;r??(r={}),r._zod.def=t,r._zod.bag=r._zod.bag||{},r._zod.version=so;let e=[...r._zod.def.checks??[]];if(r._zod.traits.has("$ZodCheck"))e.unshift(r);for(let n of e)for(let o of n._zod.onattach)o(r);if(e.length===0)(i=r._zod).deferred??(i.deferred=[]),r._zod.deferred?.push(()=>{r._zod.run=r._zod.parse});else{let n=(u,v,c)=>{let $=Ur(u),l;for(let g of v){if(g._zod.def.when){if(ro(u))continue;if(!g._zod.def.when(u))continue}else if($)continue;let b=u.issues.length,U=g._zod.check(u);if(U instanceof Promise&&c?.async===!1)throw ne ...

31 if (${X}.issues.length) {

32 if (${Y} in input) {

33 payload.issues = payload.issues.concat(${X}.issues.map(iss => ({

34 ...iss,

35 path: iss.path ? [${Y}, ...iss.path] : [${Y}]

36 })));

37 }

38 }

40 if (${X}.value === undefined) {

41 if (${Y} in input) {

42 newResult[${Y}] = undefined;

43 }

44 } else {

45 newResult[${Y}] = ${X}.value;

46 }

Long lines were clipped for display.

Lines 70-110javascript

70 }

71 }

73 `);else U.write(`

74 if (${X}.issues.length) {

75 payload.issues = payload.issues.concat(${X}.issues.map(iss => ({

76 ...iss,

77 path: iss.path ? [${Y}, ...iss.path] : [${Y}]

78 })));

79 }

81 if (${X}.value === undefined) {

82 if (${Y} in input) {

83 newResult[${Y}] = undefined;

84 }

85 } else {

86 newResult[${Y}] = ${X}.value;

87 }

89 `)}U.write("payload.value = newResult;"),U.write("return payload;");let j_=U.compile();return(rr,X)=>j_(b,rr,X)},o,u=Or,v=!jr.jitless,$=v&&Zi.value,l=t.catchall,g;r._zod.parse=(b,U)=>{g??(g=e.value);let j=b.value;if(!u(j))return b.issues.push({expected:"object",code:"invalid_type",input:j,inst:r}),b;if(v&&$&&U?.async===!1&&U.jitless!==!0){if(!o)o=n(t.shape);if(b=o(b,U),!l)return b;return pl([],j,b,U,g,r)}return i(b,U)}});function Yl(r,t,i,e){for(let o of r)if(o.issues.length===0)return t.value=o.value,t;let n=r.filter((o)=>!Ur(o));if(n.length===1)return t.value=n[0].value,n[0];return t.i ...

91Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.`)}for(let u of r.seen.entries()){let v=u[1];if(t===u[0]){o(u);continue}if(r.external){let $=r.external.registry.get(u[0])?.id;if(t!==u[0]&&$){o(u);continue}}if(r.metadataRegistry.get(u[0])?.id){o(u);continue}if(v.cycle){o(u);continue}if(v.count>1){if(r.reused==="ref"){o(u);continue}}}}function Sr(r,t){let i=r.seen.get(t);if(!i)throw Error("Unprocessed schema. This is a bug in Zod.");let e=(v)=>{let c=r.seen.get(v);if(c.ref===null)return;let $=c.def??c.schema,l={...$},g=c.ref;if(c.ref=null,g){e(g);let U=r.seen.get( ...

92`));break;case"table":{if(e.header?.length)i.push(e.header.map(JI).join("\t"));for(let n of e.rows)i.push(n.map(JI).join("\t"));break}case"embed":{let n=e.author.displayName?`${e.author.displayName} (@${e.author.username})`:`@${e.author.username}`;i.push(n),i.push(Yi(e.content,t));break}case"divider":break;default:break}return i.filter(Boolean).join(`

93`)}var sc={instagram:{authorHandles:!0,contentTypes:{image:{label:"Image"},post:{label:"Post"},video:{label:"Video"}},label:"Instagram"},reddit:{authorHandles:!1,contentTypes:{comment:{label:"Comment"},post:{label:"Post"}},label:"Reddit"},tiktok:{authorHandles:!0,contentTypes:{image:{label:"Image"},post:{label:"Post"},video:{label:"Video"}},label:"TikTok"},twitter:{authorHandles:!0,contentTypes:{article:{label:"Article"},post:{label:"Post"}},label:"Twitter"},web:{authorHandles:!1,contentTypes:{image:{label:"Image"},snippet:{label:"Snippet"}},label:"Web"},youtube:{authorHandles:!0,contentTypes: ...

95`)}function QI(r){return r.title??r.author?.displayName??(r.author?`@${r.author.username}`:null)??`${r.platform} bookmark`}function AU(r){if(!r.author)return null;return r.author.displayName??`@${r.author.username}`}function HI(r){return{archived:r.deletedAt!==null,author:AU(r),capturedAt:r.capturedAt,contentType:r.contentType,favorite:r.isFavorite,id:r.id,mediaCount:r.media.length,platform:r.platform,tags:r.tags.map((t)=>t.name),text:rl(qU(r),fU),title:QI(r),url:r.url}}function TU(r,t,i){return{altText:r?.altText?rl(r.altText,JU):null,caption:rl(t,LU),height:r?.height??null,ref:i,type:r?.type ...

96`,{mode:384}),await qb(e,i),await Lb(i,384).catch(()=>{return})}import{spawn as Yb}from"node:child_process";import{createHash as Kb,randomBytes as $_}from"node:crypto";import{createServer as Vb}from"node:http";var Hb=48173,Qb=300000,Il="read write destructive offline_access",Rb=/\/$/;function Br(r){let t;try{t=new URL(r)}catch{throw new L({code:"invalid_api_url",exitCode:3,message:"The Stashr API URL must be a valid http or https URL."})}if(!(t.protocol==="https:"||t.protocol==="http:"))throw new L({code:"invalid_api_url",exitCode:3,message:"The Stashr API URL must use http or https."});return ...

97`)?r:`${r}

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L90

98`}function U_(r){return r.title??r.author?.displayName??(r.author?`@${r.author.username}`:null)??`${r.platform} bookmark`}class Dl{json;stderr;stdout;constructor(r,t={}){this.json=r,this.stderr=t.stderr??((i)=>process.stderr.write(i)),this.stdout=t.stdout??((i)=>process.stdout.write(i))}data(r,t){this.stdout(Hi(this.json?JSON.stringify(r,null,2):t))}info(r){this.stderr(Hi(r))}account(r,t){let i="No active plan";if(r.access.hasProAccess)i="Pro";else if(r.access.hasPaidPlan)i="Hobby";else if(r.access.trial)i="Trial";this.data(t?{...r,authentication:t}:r,[`${r.name} <${r.email}>`,`Account: ${r.id ...

99`))}bookmark(r){let t=r.author?r.author.displayName??`@${r.author.username}`:"—",i=r.tags.map((e)=>e.name).join(", ")||"—";this.data(r,[U_(r),`ID: ${r.id}`,`URL: ${r.url}`,`Platform: ${r.platform}`,`Author: ${t}`,`Tags: ${i}`,`Favorite: ${r.isFavorite?"yes":"no"}`,`Archived: ${r.deletedAt?"yes":"no"}`,...r.note?[`Note: ${r.note}`]:[]].join(`

100`))}bookmarks(r,t){let i=r.items.map((n)=>`${n.id} ${n.platform.padEnd(9)} ${U_(n)}

101 ${n.url}`),e=i.length===0?"No bookmarks found.":[i.join(`

102`),...r.nextCursor?[`

103Next cursor: ${r.nextCursor}`]:[]].join(`

104`);this.data(t?nl(r,t):r,e)}tags(r){this.data(r,r.length===0?"No tags found.":r.map((t)=>`${t.id} ${t.name}`).join(`

105`))}collections(r){this.data(r,r.length===0?"No collections found.":r.map((t)=>`${t.id} ${t.name}`).join(`

106`))}}function b_(r,t){if(t)return Hi(JSON.stringify({error:{code:r.code,...r.details===void 0?{}:{details:r.details},message:r.message},...r.requestId?{requestId:r.requestId}:{}},null,2));return Hi(`Error: ${r.message}${r.requestId?`

107Request ID: ${r.requestId}`:""}`)}var w_="https://stashr.me",Sl="0.2.0";function F(r){let t=r.at(-1);if(!(t instanceof ll))throw new L({code:"invalid_command",message:"Could not read command options."});return t}function Wr(r,t=[]){return[...t,r]}function sb(r,t=[]){let i=["image","video","any-media","text-only"];if(!i.includes(r))throw new tt(`Allowed media values: ${i.join(", ")}`);return[...t,r]}function rw(r){let t=Number(r);if(!(Number.isInteger(t)&&t>=1&&t<=100))throw new tt("Limit must be an integer from 1 to 100.");return t}function k_(r){let t;try{t=JSON.parse(r)}catch{throw new tt("F ...

108Examples:

109${t.map((i)=>` ${i}`).join(`

110`)}

Long lines were clipped for display.

Source & flagged code

4 flagged · loading source

dist/index.jsView file

13(Did you mean one of ${e.join(", ")}?)`;if(e.length===1)return` L14: (Did you mean ${e[0]}?)`;return""}rb.suggestSimilar=sU});var sI=Nr(($b)=>{var tb=kn("node:events").EventEmitter,el=kn("node:child_process"),lr=kn("node:path"),Vi=kn("node:fs"),J=kn... L15: - specify the name in Command constructor or using .name()`);if(t=t||{},t.isDefault)this._defaultCommandName=r._name;if(t.noHelp||t.hidden)r._hidden=!0;return this._registerCommand...

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L13

90L91: Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.`)}for(let u of r.seen.entries()){let v=u[1];if(t===u[0]){o(u);continue}if(r.external){let $=r.exter... L92: `));break;case"table":{if(e.header?.length)i.push(e.header.map(JI).join("\t"));for(let n of e.rows)i.push(n.map(JI).join("\t"));break}case"embed":{let n=e.author.displayName?`${e.a... ... L94: L95: `)}function QI(r){return r.title??r.author?.displayName??(r.author?`@${r.author.username}`:null)??`${r.platform} bookmark`}function AU(r){if(!r.author)return null;return r.author.d... L96: `,{mode:384}),await qb(e,i),await Lb(i,384).catch(()=>{return})}import{spawn as Yb}from"node:child_process";import{createHash as Kb,randomBytes as $_}from"node:crypto";import{creat... L97: `)?r:`${r}

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L90

15- specify the name in Command constructor or using .name()`);if(t=t||{},t.isDefault)this._defaultCommandName=r._name;if(t.noHelp||t.hidden)r._hidden=!0;return this._registerCommand... L16: Expecting one of '${i.join("', '")}'`);if(this._lifeCycleHooks[r])this._lifeCycleHooks[r].push(t);else this._lifeCycleHooks[r]=[t];return this}exitOverride(r){if(r)this._exitCallba... L17: - already used by option '${t.flags}'`)}this._initOptionGroup(r),this.options.push(r)}_registerCommand(r){let t=(e)=>{return[e.name()].concat(e.aliases())},i=t(r).find((e)=>this._... L18: - either make a new Command for each call to parse, or stop storing options as properties`);this._name=this._savedState._name,this._scriptPath=null,this.rawArgs=[],this._optionValu... ... L24: `),this.outputHelp({error:!0});let i=t||{},e=i.exitCode||1,n=i.code||"commander.error";this._exit(e,n,r)}_parseOptionsEnv(){this.options.forEach((r)=>{if(r.envVar&&r.envVar in J.en... L25: `),this._exit(0,"commander.version",r)}),this}description(r,t){if(r===void 0&&t===void 0)return this._description;if(this._description=r,t)this._argsDescription=t;return this}summa... L26: Expecting one of '${i.join("', '")}'`);let e=`${r}Help`;r

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L15

26Expecting one of '${i.join("', '")}'`);let e=`${r}Help`;return this.on(e,(n)=>{let o;if(typeof t==="function")o=t({error:n.error,command:n.command});else o=t;if(o)n.write(`${o} L27: `)}),this}_outputHelpIfRequested(r){let t=this._getHelpOption();if(t&&r.find((e)=>t.is(e)))this.outputHelp(),this._exit(0,"commander.helpDisplayed","(outputHelp)")}}function pI(r){... L28: `)}var Qr=(r)=>(t,i,e,n)=>{let o=e?{...e,async:!1}:{async:!1},u=t._zod.run({value:i,issues:[]},o);if(u instanceof Promise)throw new nr;if(u.issues.length){let v=new(n?.Err??r)(u.is...

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/index.jsView on unpkg · L26

Findings

3 High1 Medium5 Low

HighChild Processdist/index.js

HighSame File Env Network Executiondist/index.js

HighCommand Output Exfiltrationdist/index.js

MediumEnvironment Vars

LowScripts Present

LowEvaldist/index.js

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

4 flagged

dist/index.jsView file

Lines 1-46javascript

1#!/usr/bin/env node

4`+" ".repeat(t+v));return o+u+" ".repeat(v)+l.replace(/\n/g,`

7- a short flag is a single dash and a single character

8 - either use a single dash and a single character (for a short flag)

9 - or use a double dash for a long option (and can have two, like '--ws, --workspace')`);if(e.test(u))throw Error(`${v}

10- too many short flags`);if(n.test(u))throw Error(`${v}

11- too many long flags`);throw Error(`${v}

13(Did you mean one of ${e.join(", ")}?)`;if(e.length===1)return`

15- specify the name in Command constructor or using .name()`);if(t=t||{},t.isDefault)this._defaultCommandName=r._name;if(t.noHelp||t.hidden)r._hidden=!0;return this._registerCommand(r),r.parent=this,r._checkForBrokenPassThrough(),this}createArgument(r,t){return new ib(r,t)}argument(r,t,i,e){let n=this.createArgument(r,t);if(typeof i==="function")n.default(e).argParser(i);else n.default(i);return this.addArgument(n),this}arguments(r){return r.trim().split(/ +/).forEach((t)=>{this.argument(t)}),this}addArgument(r){let t=this.registeredArguments.slice(-1)[0];if(t?.variadic)throw Error(`only the la ...

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L13

19 - if '${i}' is not meant to be an executable command, remove description parameter from '.command()' and use '.description()' instead

20 - if the default executable name is not suitable, use the executableFile option to supply a custom name or path

22`,this._outputConfiguration.writeErr),typeof this._showHelpAfterError==="string")this._outputConfiguration.writeErr(`${this._showHelpAfterError}

23`);else if(this._showHelpAfterError)this._outputConfiguration.writeErr(`

26Expecting one of '${i.join("', '")}'`);let e=`${r}Help`;return this.on(e,(n)=>{let o;if(typeof t==="function")o=t({error:n.error,command:n.command});else o=t;if(o)n.write(`${o}

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L15

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/index.jsView on unpkg · L26

31 if (${X}.issues.length) {

32 if (${Y} in input) {

33 payload.issues = payload.issues.concat(${X}.issues.map(iss => ({

34 ...iss,

35 path: iss.path ? [${Y}, ...iss.path] : [${Y}]

36 })));

37 }

38 }

40 if (${X}.value === undefined) {

41 if (${Y} in input) {

42 newResult[${Y}] = undefined;

43 }

44 } else {

45 newResult[${Y}] = ${X}.value;

46 }

Long lines were clipped for display.

Lines 70-110javascript

70 }

71 }

73 `);else U.write(`

74 if (${X}.issues.length) {

75 payload.issues = payload.issues.concat(${X}.issues.map(iss => ({

76 ...iss,

77 path: iss.path ? [${Y}, ...iss.path] : [${Y}]

78 })));

79 }

81 if (${X}.value === undefined) {

82 if (${Y} in input) {

83 newResult[${Y}] = undefined;

84 }

85 } else {

86 newResult[${Y}] = ${X}.value;

87 }

97`)?r:`${r}

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L90

100`))}bookmarks(r,t){let i=r.items.map((n)=>`${n.id} ${n.platform.padEnd(9)} ${U_(n)}

101 ${n.url}`),e=i.length===0?"No bookmarks found.":[i.join(`

102`),...r.nextCursor?[`

103Next cursor: ${r.nextCursor}`]:[]].join(`

104`);this.data(t?nl(r,t):r,e)}tags(r){this.data(r,r.length===0?"No tags found.":r.map((t)=>`${t.id} ${t.name}`).join(`

105`))}collections(r){this.data(r,r.length===0?"No collections found.":r.map((t)=>`${t.id} ${t.name}`).join(`

108Examples:

109${t.map((i)=>` ${i}`).join(`

110`)}

Long lines were clipped for display.