registry / @stashr/cli / 0.2.2

@stashr/cli@0.2.2

Search, save, and organize your Stashr library from the command line.

AI Security Review

scanned 33m ago · by lpm-firewall-ai

No confirmed malicious attack surface. The CLI performs user-invoked Stashr OAuth and API operations, with an optional local OAuth callback listener.

Static reason

One or more suspicious static signals were detected.

Trigger

User runs stashr commands such as login, search, save, or media.

Impact

Normal account and bookmark operations; no install-time execution, credential harvesting, stealth persistence, or foreign AI-agent modification found.

Mechanism

Explicit CLI OAuth, API requests, local token storage, and requested media download.

Rationale

Static signals are explained by normal bundled CLI dependencies and explicit Stashr OAuth/API functionality. No lifecycle hook or concrete malicious data-flow, persistence, destructive behavior, or unconsented control-surface mutation was found.

Evidence

package.jsonREADME.mddist/index.js~/.config/stashr/config.json~/Library/Application Support/Stashr/config.json%APPDATA%/Stashr/config.json

Network endpoints2

stashr.me127.0.0.1

Decision evidence

public snapshot

AI called this Clean at 96.0% confidence as Benign with low false-positive risk.

Evidence for block

Evidence against

package.json has no preinstall/install/postinstall lifecycle hooks.
dist/index.js runs only through the stashr CLI bin entrypoint.
dist/index.js uses child_process only to open the user-requested OAuth URL.
dist/index.js stores OAuth configuration with owner-only file permissions.
dist/index.js sends bearer credentials only to the configured Stashr API base URL.
README.md documents explicit login, search, save, and media commands.

Behavioral surface

Source

ChildProcessEnvironmentVarsEval

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

NoLicense

scanned 1 file(s), 352 KB of source, external domains: 127.0.0.1, example.com, json-schema.org, stashr.me

Source & flagged code

4 flagged

dist/index.jsView file

Lines 1-46javascript

1#!/usr/bin/env node

2import{createRequire as A_}from"node:module";var L_=Object.create;var{getPrototypeOf:q_,defineProperty:xt,getOwnPropertyNames:O_}=Object;var G_=Object.prototype.hasOwnProperty;var X_=(r,i,t)=>{t=r!=null?L_(q_(r)):{};let $=i||!r||!r.__esModule?xt(t,"default",{value:r,enumerable:!0}):t;for(let n of O_(r))if(!G_.call($,n))xt($,n,{get:()=>r[n],enumerable:!0});return $};var zr=(r,i)=>()=>(i||r((i={exports:{}}).exports,i),i.exports);var ur=(r,i)=>{for(var t in i)xt(r,t,{get:i[t],enumerable:!0,configurable:!0,set:($)=>i[t]=()=>$})};var Sn=A_(import.meta.url);var ti=zr((Tc)=>{class ve extends Error{co ...

3`)}displayWidth(r){return y6(r).length}styleTitle(r){return r}styleUsage(r){return r.split(" ").map((i)=>{if(i==="[options]")return this.styleOptionText(i);if(i==="[command]")return this.styleSubcommandText(i);if(i[0]==="["||i[0]==="<")return this.styleArgumentText(i);return this.styleCommandText(i)}).join(" ")}styleCommandDescription(r){return this.styleDescriptionText(r)}styleOptionDescription(r){return this.styleDescriptionText(r)}styleSubcommandDescription(r){return this.styleDescriptionText(r)}styleArgumentDescription(r){return this.styleDescriptionText(r)}styleDescriptionText(r){return r ...

4`+" ".repeat(i+g));return v+u+" ".repeat(g)+e.replace(/\n/g,`

5${v}`)}boxWrap(r,i){if(i<this.minWidthToWrap)return r;let t=r.split(/\r\n|\n/),$=/[\s]*[^\s]+/g,n=[];return t.forEach((v)=>{let u=v.match($);

6`)}}function y6(r){let i=/\x1b\[\d*(;\d*)*m/g;return r.replace(i,"")}Fc.Help=C6;Fc.stripColor=y6});var ue=zr((hc)=>{var{InvalidArgumentError:Cc}=ti();class

7- a short flag is a single dash and a single character

8 - either use a single dash and a single character (for a short flag)

9 - or use a double dash for a long option (and can have two, like '--ws, --workspace')`);if($.test(u))throw Error(`${g}

10- too many short flags`);if(n.test(u))throw Error(`${g}

11- too many long flags`);throw Error(`${g}

12- unrecognised flag format`)}if(i===void 0&&t===void 0)throw Error(`option creation failed due to no flags found in '${r}'.`);return{shortFlag:i,longFlag:t}}hc.Option=m6;hc.DualOptions=d6});var a6=zr((sc)=>{function ac(r,i){if(Math.abs(r.length-i.length)>3)return Math.max(r.length,i.length);let t=[];for(let $=0;$<=r.length;$++)t[$]=[$];for(let $=0;$<=i.length;$++)t[0][$]=$;for(let $=1;$<=i.length;$++)for(let n=1;n<=r.length;n++){let v=1;if(r[n-1]===i[$-1])v=0;else v=1;if(t[n][$]=Math.min(t[n-1][$]+1,t[n][$-1]+1,t[n-1][$-1]+v),n>1&&$>1&&r[n-1]===i[$-2]&&r[n-2]===i[$-1])t[n][$]=Math.min(t[n][$], ...

13(Did you mean one of ${$.join(", ")}?)`;if($.length===1)return`

14(Did you mean ${$[0]}?)`;return""}sc.suggestSimilar=pc});var n_=zr((gb)=>{var nb=Sn("node:events").EventEmitter,ge=Sn("node:child_process"),er=Sn("node:path"),Mt=Sn("node:fs"),O=Sn("node:process"),{Argument

15- specify the name in Command constructor or using .name()`);if(i=i||{},i.isDefault)this._defaultCommandName=r._name;if(i.noHelp||i.hidden)r._hidden=!0;return this._registerCommand(r),r.parent=this,r._checkForBrokenPassThrough(),this}createArgument(r,i){return new ib(r,i)}argument(r,i,t,$){let n=this.createArgument(r,i);if(typeof t==="function")n.default($).argParser(t);else n.default(t);return this.addArgument(n),this}arguments(r){return r.trim().split(/ +/).forEach((i)=>{this.argument(i)}),this}addArgument(r){let i=this.registeredArguments.slice(-1)[0];if(i?.variadic)throw Error(`only the la ...

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L13

16Expecting one of '${t.join("', '")}'`);if(this._lifeCycleHooks[r])this._lifeCycleHooks[r].push(i);else this._lifeCycleHooks[r]=[i];return this}exitOverride(r){if(r)this._exitCallback=r;else this._exitCallback=(i)=>{if(i.code!=="commander.executeSubCommandAsync")throw i};return this}_exit(r,i,t){if(this._exitCallback)this._exitCallback(new oe(r,i,t));O.exit(r)}action(r){let i=(t)=>{let $=this.registeredArguments.length,n=t.slice(0,$);if(this._storeOptionsAsProperties)n[$]=this;else n[$]=this.opts();return n.push(this),r.apply(this,n)};return this._actionHandler=i,this}createOption(r,i){return n ...

17- already used by option '${i.flags}'`)}this._initOptionGroup(r),this.options.push(r)}_registerCommand(r){let i=($)=>{return[$.name()].concat($.aliases())},t=i(r).find(($)=>this._findCommand($));if(t){let $=

18- either make a new Command for each call to parse, or stop storing options as properties`);this._name=this._savedState._name,this._scriptPath=null,this.rawArgs=[],this._optionValues={...this._savedState._optionValues},this._optionValueSources={...this._savedState._optionValueSources},this.args=[],this.processedArgs=[]}_checkForMissingExecutable(r,i,t){if(Mt.existsSync(r))return;let $=i?`searched for local subcommand relative to directory '${i}'`:"no directory for search for local subcommand, use .executableDir() to supply a custom directory",n=`'${r}' does not exist

19 - if '${t}' is not meant to be an executable command, remove description parameter from '.command()' and use '.description()' instead

20 - if the default executable name is not suitable, use the executableFile option to supply a custom name or path

21 - ${$}`;throw Error(n)}_executeSubCommand(r,i){i=i.slice();let t=!1,$=[".js",".ts",".tsx",".mjs",".cjs"];function n(o,e){let _=er.resolve(o,e);if(Mt.existsSync(_))return _;if($.includes(er.extname(e)))return;let b=$.find((c)=>Mt.existsSync(`${_}${c}`));if(b)return`${_}${b}`;return}this._checkForMissingMandatoryOptions(),this._checkForConflictingOptions();let v=r._executableFile||`${this._name}-${r._name}`,u=this._executableDir||"";if(this._scriptPath){let o;try{o=Mt.realpathSync(this._scriptPath)}catch{o=this._scriptPath}u=er.resolve(er.dirname(o),u)}if(u){let o=n(u,v);if(!o&&!r._executableFi ...

22`,this._outputConfiguration.writeErr),typeof this._showHelpAfterError==="string")this._outputConfiguration.writeErr(`${this._showHelpAfterError}

23`);else if(this._showHelpAfterError)this._outputConfiguration.writeErr(`

24`),this.outputHelp({error:!0});let t=i||{},$=t.exitCode||1,n=t.code||"commander.error";this._exit($,n,r)}_parseOptionsEnv(){this.options.forEach((r)=>{if(r.envVar&&r.envVar in O.env){let i=

25`),this._exit(0,"commander.version",r)}),this}description(r,i){if(r===void 0&&i===void 0)return this._description;if(this._description=r,i)this._argsDescription=i;return this}summary(r){if(r===void 0)return this._summary;return this._summary=r,this}alias(r){if(r===void 0)return this._aliases[0];let i=this;if(this.commands.length!==0&&this.commands[this.commands.length-1]._executableHandler)i=this.commands[this.commands.length-1];if(r===i._name)throw Error("Command alias can't be the same as its name");let t=this.parent?._findCommand(r);if(t){let $=[t.name()].concat(t.aliases()).join("|");throw ...

26Expecting one of '${t.join("', '")}'`);let $=`${r}Help`;return this.on($,(n)=>{let v;if(typeof i==="function")v=i({error:n.error,command:n.command});else v=i;if(v)n.write(`${v}

27`)}),this}_outputHelpIfRequested(r){let i=this._getHelpOption();if(i&&r.find(($)=>i.is($)))this.outputHelp(),this._exit(0,"commander.helpDisplayed","(outputHelp)")}}function r_(r){return r.map((i

28`)}var fr=(r)=>(i,t,$,n)=>{let v=$?{...$,async:!1}:{async:!1},u=i._zod.run({value:t,issues:[]},v);if(u instanceof Promise)throw new nr;if

29`).filter((v)=>v),$=Math.min(...t.map((v)=>v.length-v.trimStart().length)),n=t.map((v)=>v.slice($)).map((v)=>" ".repeat(this.indent*2)+v);for(let v of n)this.content.push(v)}compile(){let r=Function,i=this?.args,$=[...(this?.content??[""]).map((n)=>` ${n}`)];return new r(...i,$.join(`

30`))}}var r$={major:4,minor:4,patch:3};var z=U("$ZodType",(r,i)=>{var t;r??(r={}),r._zod.def=i,r._zod.bag=r._zod.bag||{},r._zod.version=r$;let $=[...r._zod.def.checks??[]];if(r._zod.traits.has("$ZodCheck"))$.unshift(r);for(let n of $)for(let v of n._zod.onattach)v(r);if($.length===0)(t=r._zod).deferred??(t.deferred=[]),r._zod.deferred?.push(()=>{r._zod.run=r._zod.parse});else{let n=(u,g,I)=>{let o=br(u),e;for(let _ of g){if(_._zod.def.when){if(iv(u))continue;if(!_._zod.def.when(u))continue}else if(o)continue;let b=u.issues.length,c=_._zod.check(u);if(c instanceof Promise&&I?.async===!1)throw ne ...

31 if (${Q}.issues.length) {

32 if (${Y} in input) {

33 payload.issues = payload.issues.concat(${Q}.issues.map(iss => ({

34 ...iss,

35 path: iss.path ? [${Y}, ...iss.path] : [${Y}]

36 })));

37 }

38 }

40 if (${Q}.value === undefined) {

41 if (${Y} in input) {

42 newResult[${Y}] = undefined;

43 }

44 } else {

45 newResult[${Y}] = ${Q}.value;

46 }

Long lines were clipped for display.

Lines 70-110javascript

70 }

71 }

73 `);else c.write(`

74 if (${Q}.issues.length) {

75 payload.issues = payload.issues.concat(${Q}.issues.map(iss => ({

76 ...iss,

77 path: iss.path ? [${Y}, ...iss.path] : [${Y}]

Source & flagged code

4 flagged · loading source

dist/index.jsView file

13(Did you mean one of ${$.join(", ")}?)`;if($.length===1)return` L14: (Did you mean ${$[0]}?)`;return""}sc.suggestSimilar=pc});var n_=zr((gb)=>{var nb=Sn("node:events").EventEmitter,ge=Sn("node:child_process"),er=Sn("node:path"),Mt=Sn("node:fs"),O=Sn... L15: - specify the name in Command constructor or using .name()`);if(i=i||{},i.isDefault)this._defaultCommandName=r._name;if(i.noHelp||i.hidden)r._hidden=!0;return this._registerCommand...

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L13

90L91: Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.`)}for(let u of r.seen.entries()){let g=u[1];if(i===u[0]){v(u);continue}if(r.external){let o=r.exter... L92: `));break;case"table":{if($.header?.length)t.push($.header.map(A6).join("\t"));for(let n of $.rows)t.push(n.map(A6).join("\t"));break}case"embed":{let n=$.author.displayName?`${$.a... ... L94: L95: `)}function Xc(r){if(!r.author)return null;return r.author.displayName??`@${r.author.username}`}function f6(r){return{archived:r.deletedAt!==null,author:Xc(r),capturedAt:r.captured... L96: `,{mode:384}),await Gb($,t),await Lb(t,384).catch(()=>{return})}import{spawn as Vb}from"node:child_process";import{createHash as Yb,randomBytes as e_}from"node:crypto";import{creat... L97: `)?r:`${r}

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L90

15- specify the name in Command constructor or using .name()`);if(i=i||{},i.isDefault)this._defaultCommandName=r._name;if(i.noHelp||i.hidden)r._hidden=!0;return this._registerCommand... L16: Expecting one of '${t.join("', '")}'`);if(this._lifeCycleHooks[r])this._lifeCycleHooks[r].push(i);else this._lifeCycleHooks[r]=[i];return this}exitOverride(r){if(r)this._exitCallba... L17: - already used by option '${i.flags}'`)}this._initOptionGroup(r),this.options.push(r)}_registerCommand(r){let i=($)=>{return[$.name()].concat($.aliases())},t=i(r).find(($)=>this._... L18: - either make a new Command for each call to parse, or stop storing options as properties`);this._name=this._savedState._name,this._scriptPath=null,this.rawArgs=[],this._optionValu... ... L24: `),this.outputHelp({error:!0});let t=i||{},$=t.exitCode||1,n=t.code||"commander.error";this._exit($,n,r)}_parseOptionsEnv(){this.options.forEach((r)=>{if(r.envVar&&r.envVar in O.en... L25: `),this._exit(0,"commander.version",r)}),this}description(r,i){if(r===void 0&&i===void 0)return this._description;if(this._description=r,i)this._argsDescription=i;return this}summa... L26: Expecting one of '${t.join("', '")}'`);let $=`${r}Help`;r

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L15

26Expecting one of '${t.join("', '")}'`);let $=`${r}Help`;return this.on($,(n)=>{let v;if(typeof i==="function")v=i({error:n.error,command:n.command});else v=i;if(v)n.write(`${v} L27: `)}),this}_outputHelpIfRequested(r){let i=this._getHelpOption();if(i&&r.find(($)=>i.is($)))this.outputHelp(),this._exit(0,"commander.helpDisplayed","(outputHelp)")}}function r_(r){... L28: `)}var fr=(r)=>(i,t,$,n)=>{let v=$?{...$,async:!1}:{async:!1},u=i._zod.run({value:t,issues:[]},v);if(u instanceof Promise)throw new nr;if(u.issues.length){let g=new(n?.Err??r)(u.is...

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/index.jsView on unpkg · L26

Findings

3 High1 Medium5 Low

HighChild Processdist/index.js

HighSame File Env Network Executiondist/index.js

HighCommand Output Exfiltrationdist/index.js

MediumEnvironment Vars

LowScripts Present

LowEvaldist/index.js

LowHigh Entropy Strings

LowUrl Strings

LowNo License