registry / @stigmer/cli / 3.1.11

@stigmer/cli@3.1.11

Stigmer command-line interface — manage agents, workflows, MCP servers, skills, and executions from the terminal

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 8 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 479 file(s), 1.73 MB of source, external domains: 127.0.0.1, a.b, api.stigmer.ai, api.stigmer.com, app.stigmer.ai, console.example, docs.example.com, example.com, github.com, stigmer-prod.us.auth0.com

Source & flagged code

2 flagged

commands/share.jsView file

Lines 45-75javascript

45 const audience = parseAudience(options.audience);

46 const resetLink = options.resetLink === true;

47 if (resetLink && !enabled) {

48 throw new UsageError("--reset-link cannot be combined with --off\n\n" +

49 "Disabling sharing already kills the link. Reset is for keeping\n" +

50 "sharing on while invalidating the current URL.");

51 }

52 const result = await shareAgent(client.stigmer, ref, org, {

53 enabled,

54 ...(audience !== undefined ? { audience } : {}),

55 resetLink,

56 appOrigin,

57 isLocal: backendType === "local",

58 });

59 renderResult(result, format);

60 if (options.open === true && enabled) {

61 // Best-effort: the link is already rendered above, so a launch failure

62 // only needs a nudge, never an error exit (mirrors auth login).

63 const url = result.sections.find((s) => s.title.endsWith("chat link"))?.items[0];

64 if (url !== undefined) {

65 try {

66 const { default: open } = await import("open");

67 await open(url);

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

commands/share.jsView on unpkg · L65

68 }

69 catch {

70 process.stderr.write("Could not open the browser automatically. Please open the link above.\n");

71 }

72 }

73 }

74}

75//# sourceMappingURL=share.js.map

local/runtime/node.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @stigmer/cli@3.1.3 matchedIdentity = npm:QHN0aWdtZXIvY2xp:3.1.3 similarity = 0.808 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

local/runtime/node.jsView on unpkg

Source & flagged code

2 flagged · loading source

commands/share.jsView file

65package = @stigmer/cli; repositoryIdentity = stigmer; dependency = open L65: try { L66: const { default: open } = await import("open"); L67: await open(url);

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

commands/share.jsView on unpkg · L65

local/runtime/node.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

local/runtime/node.jsView on unpkg

Findings

2 High3 Medium3 Low

HighCopied Package Dependency Bridgecommands/share.js

HighPrevious Version Dangerous Deltalocal/runtime/node.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

commands/share.jsView file

Lines 45-75javascript

45 const audience = parseAudience(options.audience);

46 const resetLink = options.resetLink === true;

47 if (resetLink && !enabled) {

48 throw new UsageError("--reset-link cannot be combined with --off\n\n" +

49 "Disabling sharing already kills the link. Reset is for keeping\n" +

50 "sharing on while invalidating the current URL.");

51 }

52 const result = await shareAgent(client.stigmer, ref, org, {

53 enabled,

54 ...(audience !== undefined ? { audience } : {}),

55 resetLink,

56 appOrigin,

57 isLocal: backendType === "local",

58 });

59 renderResult(result, format);

60 if (options.open === true && enabled) {

61 // Best-effort: the link is already rendered above, so a launch failure

62 // only needs a nudge, never an error exit (mirrors auth login).

63 const url = result.sections.find((s) => s.title.endsWith("chat link"))?.items[0];

64 if (url !== undefined) {

65 try {

66 const { default: open } = await import("open");

67 await open(url);

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

commands/share.jsView on unpkg · L65

68 }

69 catch {

70 process.stderr.write("Could not open the browser automatically. Please open the link above.\n");

71 }

72 }

73 }

74}

75//# sourceMappingURL=share.js.map

local/runtime/node.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

local/runtime/node.jsView on unpkg