registry / @sylphai/adal-cli-darwin-arm64 / 1.4.2

@sylphai/adal-cli-darwin-arm64@1.4.2

AI-powered CLI for development and research - darwin-arm64

Static Scan Results

scanned 4h ago · by rust-scanner

Static analysis flagged 24 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNativeBindingsNetwork

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 60 file(s), 2.47 MB of source, external domains: chevrotain.io, codeload.github.com, d35qg8ac0yw4p7.cloudfront.net, docs.sylph.ai, en.wikipedia.org, gist.githubusercontent.com, github.com, jquery.org, langium.org, react.dev, tldrlegal.com, www.w3.org

Oversized source lightweight scan

adal-cli.js3.80 MB file, sampled 256 KB

FilesystemNetworkChildProcessEnvironmentVarsNativeBindingsCryptoObfuscatedHighEntropyStringsMinifiedUrlStringscodeload.github.comd35qg8ac0yw4p7.cloudfront.netdocs.sylph.aigist.githubusercontent.com

web-dist/assets/index-B2DoMuGC.js2.43 MB file, sampled 256 KB

FilesystemNetworkHighEntropyStringsMinifiedUrlStringsreact.dev

Source & flagged code

16 flagged

package.jsonView file

Lines 1-22json

2 "name": "@sylphai/adal-cli-darwin-arm64",

3 "version": "1.4.2",

4 "description": "AI-powered CLI for development and research - darwin-arm64",

5 "type": "module",

6 "bin": {

7 "adal": "adal"

8 },

9 "os": ["darwin"],

10 "cpu": ["arm64"],

11 "files": ["adal", "adal-cli.js", "*.wasm", "*.scm", "backend/", "runtime/", "opentui-native/", "bin/", "web-dist/", "postinstall.cjs", "package.json", "CHANGELOG.md"],

12 "scripts": {

13 "postinstall": "node postinstall.cjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L13

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L13

14 },

15 "keywords": [],

16 "license": "SylphAI Proprietary",

17 "_internal": true,

18 "_adalPackageType": "platform",

19 "_adalBackendLocation": "backend/adal-backend/adal-backend",

20 "_adalRuntime": "bun"

21}

backend/adal-backend/_internal/botocore/data/sts/2011-06-15/examples-1.jsonView file

Lines 16-56json

16 {

17 "Key": "Team",

18 "Value": "Automation"

19 },

20 {

21 "Key": "Cost-Center",

22 "Value": "12345"

bin/rgView file

•path = bin/rg kind = native_binary sizeBytes = 4528512 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/rgView on unpkg

tree-sitter-markdown_inline-j5349f42.wasmView file

•path = tree-sitter-markdown_inline-j5349f42.wasm kind = wasm_module sizeBytes = 426020 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

tree-sitter-markdown_inline-j5349f42.wasmView on unpkg

backend/adal-backend/_internal/botocore/data/s3/2006-03-01/endpoint-rule-set-1.json.gzView file

•path = backend/adal-backend/_internal/botocore/data/s3/2006-03-01/endpoint-rule-set-1.json.gz kind = compressed_blob sizeBytes = 18305 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

backend/adal-backend/_internal/botocore/data/s3/2006-03-01/endpoint-rule-set-1.json.gzView on unpkg

web-dist/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View file

•path = web-dist/assets/KaTeX_Script-Regular-D3wIWfF6.woff2 kind = high_entropy_blob sizeBytes = 9644 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

web-dist/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View on unpkg

web-dist/assets/index-B2DoMuGC.jsView file

•path = web-dist/assets/index-B2DoMuGC.js kind = oversized_source_file sizeBytes = 2550761 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

web-dist/assets/index-B2DoMuGC.jsView on unpkg

backend/adal-backend/_internal/base_library.zipView file

•path = backend/adal-backend/_internal/base_library.zip kind = nested_archive_needs_inspection sizeBytes = 1443565 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

backend/adal-backend/_internal/base_library.zipView on unpkg

adal-cli.jsView file

•path = adal-cli.js kind = oversized_cli_entrypoint sizeBytes = 3987378 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

adal-cli.jsView on unpkg

Source & flagged code

16 flagged · loading source

package.jsonView file

•scripts.postinstall = node postinstall.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node postinstall.cjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

backend/adal-backend/_internal/botocore/data/sts/2011-06-15/examples-1.jsonView file

36patternName = aws_access_key severity = critical line = 36 matchedText = "AccessK...LE",

Critical

Critical Secret

Package contains a critical-looking secret pattern.

backend/adal-backend/_internal/botocore/data/sts/2011-06-15/examples-1.jsonView on unpkg · L36

36patternName = aws_access_key severity = critical line = 36 matchedText = "AccessK...LE",

Critical

Secret Pattern

AWS access key ID in backend/adal-backend/_internal/botocore/data/sts/2011-06-15/examples-1.json

backend/adal-backend/_internal/botocore/data/sts/2011-06-15/examples-1.jsonView on unpkg · L36

108patternName = aws_access_key severity = critical line = 108 matchedText = "AccessK...LE",

Critical

Secret Pattern

AWS access key ID in backend/adal-backend/_internal/botocore/data/sts/2011-06-15/examples-1.json

backend/adal-backend/_internal/botocore/data/sts/2011-06-15/examples-1.jsonView on unpkg · L108

154patternName = aws_access_key severity = critical line = 154 matchedText = "UserId"...PLE"

Critical

Secret Pattern

AWS access key ID in backend/adal-backend/_internal/botocore/data/sts/2011-06-15/examples-1.json

backend/adal-backend/_internal/botocore/data/sts/2011-06-15/examples-1.jsonView on unpkg · L154

172patternName = aws_access_key severity = critical line = 172 matchedText = "UserId"...ame"

Critical

Secret Pattern

AWS access key ID in backend/adal-backend/_internal/botocore/data/sts/2011-06-15/examples-1.json

backend/adal-backend/_internal/botocore/data/sts/2011-06-15/examples-1.jsonView on unpkg · L172

222patternName = aws_access_key severity = critical line = 222 matchedText = "AccessK...LE",

Critical

Secret Pattern

AWS access key ID in backend/adal-backend/_internal/botocore/data/sts/2011-06-15/examples-1.json

backend/adal-backend/_internal/botocore/data/sts/2011-06-15/examples-1.jsonView on unpkg · L222

253patternName = aws_access_key severity = critical line = 253 matchedText = "AccessK...LE",

Critical

Secret Pattern

AWS access key ID in backend/adal-backend/_internal/botocore/data/sts/2011-06-15/examples-1.json

backend/adal-backend/_internal/botocore/data/sts/2011-06-15/examples-1.jsonView on unpkg · L253

bin/rgView file

•path = bin/rg kind = native_binary sizeBytes = 4528512 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/rgView on unpkg

tree-sitter-markdown_inline-j5349f42.wasmView file

•path = tree-sitter-markdown_inline-j5349f42.wasm kind = wasm_module sizeBytes = 426020 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

tree-sitter-markdown_inline-j5349f42.wasmView on unpkg

backend/adal-backend/_internal/botocore/data/s3/2006-03-01/endpoint-rule-set-1.json.gzView file

•path = backend/adal-backend/_internal/botocore/data/s3/2006-03-01/endpoint-rule-set-1.json.gz kind = compressed_blob sizeBytes = 18305 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

backend/adal-backend/_internal/botocore/data/s3/2006-03-01/endpoint-rule-set-1.json.gzView on unpkg

web-dist/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View file

•path = web-dist/assets/KaTeX_Script-Regular-D3wIWfF6.woff2 kind = high_entropy_blob sizeBytes = 9644 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

web-dist/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View on unpkg

web-dist/assets/index-B2DoMuGC.jsView file

•path = web-dist/assets/index-B2DoMuGC.js kind = oversized_source_file sizeBytes = 2550761 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

web-dist/assets/index-B2DoMuGC.jsView on unpkg

backend/adal-backend/_internal/base_library.zipView file

•path = backend/adal-backend/_internal/base_library.zip kind = nested_archive_needs_inspection sizeBytes = 1443565 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

backend/adal-backend/_internal/base_library.zipView on unpkg

adal-cli.jsView file

•path = adal-cli.js kind = oversized_cli_entrypoint sizeBytes = 3987378 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

adal-cli.jsView on unpkg

Findings

7 Critical3 High8 Medium6 Low

CriticalCritical Secretbackend/adal-backend/_internal/botocore/data/sts/2011-06-15/examples-1.json

CriticalSecret Patternbackend/adal-backend/_internal/botocore/data/sts/2011-06-15/examples-1.json

HighInstall Time Lifecycle Scriptspackage.json

HighShips High Entropy Blobweb-dist/assets/KaTeX_Script-Regular-D3wIWfF6.woff2

HighOversized Source Fileweb-dist/assets/index-B2DoMuGC.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumShips Native Binarybin/rg

MediumShips Wasm Moduletree-sitter-markdown_inline-j5349f42.wasm

MediumShips Compressed Blobbackend/adal-backend/_internal/botocore/data/s3/2006-03-01/endpoint-rule-set-1.json.gz

MediumOversized Cli Entrypointadal-cli.js

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

LowNested Archive Needs Inspectionbackend/adal-backend/_internal/base_library.zip

Source & flagged code

16 flagged

package.jsonView file

Lines 1-22json

2 "name": "@sylphai/adal-cli-darwin-arm64",

3 "version": "1.4.2",

4 "description": "AI-powered CLI for development and research - darwin-arm64",

5 "type": "module",

6 "bin": {

7 "adal": "adal"

8 },

9 "os": ["darwin"],

10 "cpu": ["arm64"],

11 "files": ["adal", "adal-cli.js", "*.wasm", "*.scm", "backend/", "runtime/", "opentui-native/", "bin/", "web-dist/", "postinstall.cjs", "package.json", "CHANGELOG.md"],

12 "scripts": {

13 "postinstall": "node postinstall.cjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L13

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L13

14 },

15 "keywords": [],

16 "license": "SylphAI Proprietary",

17 "_internal": true,

18 "_adalPackageType": "platform",

19 "_adalBackendLocation": "backend/adal-backend/adal-backend",

20 "_adalRuntime": "bun"

21}

backend/adal-backend/_internal/botocore/data/sts/2011-06-15/examples-1.jsonView file

Lines 16-56json

16 {

17 "Key": "Team",

18 "Value": "Automation"

19 },

20 {

21 "Key": "Cost-Center",

22 "Value": "12345"

bin/rgView file

•path = bin/rg kind = native_binary sizeBytes = 4528512 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/rgView on unpkg

tree-sitter-markdown_inline-j5349f42.wasmView file

•path = tree-sitter-markdown_inline-j5349f42.wasm kind = wasm_module sizeBytes = 426020 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

tree-sitter-markdown_inline-j5349f42.wasmView on unpkg

backend/adal-backend/_internal/botocore/data/s3/2006-03-01/endpoint-rule-set-1.json.gzView file

•path = backend/adal-backend/_internal/botocore/data/s3/2006-03-01/endpoint-rule-set-1.json.gz kind = compressed_blob sizeBytes = 18305 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

backend/adal-backend/_internal/botocore/data/s3/2006-03-01/endpoint-rule-set-1.json.gzView on unpkg

web-dist/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View file

•path = web-dist/assets/KaTeX_Script-Regular-D3wIWfF6.woff2 kind = high_entropy_blob sizeBytes = 9644 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

web-dist/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View on unpkg

web-dist/assets/index-B2DoMuGC.jsView file

•path = web-dist/assets/index-B2DoMuGC.js kind = oversized_source_file sizeBytes = 2550761 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

web-dist/assets/index-B2DoMuGC.jsView on unpkg

backend/adal-backend/_internal/base_library.zipView file

•path = backend/adal-backend/_internal/base_library.zip kind = nested_archive_needs_inspection sizeBytes = 1443565 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

backend/adal-backend/_internal/base_library.zipView on unpkg

adal-cli.jsView file

•path = adal-cli.js kind = oversized_cli_entrypoint sizeBytes = 3987378 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

adal-cli.jsView on unpkg

Lines 88-192json

88 "title": "To assume a role using a SAML assertion"

89 }

90 ],

91 "AssumeRoleWithWebIdentity": [

92 {

93 "input": {

94 "DurationSeconds": 3600,

95 "Policy": "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Sid\":\"Stmt1\",\"Effect\":\"Allow\",\"Action\":\"s3:ListAllMyBuckets\",\"Resource\":\"*\"}]}",

96 "ProviderId": "www.amazon.com",

97 "RoleArn": "arn:aws:iam::123456789012:role/FederatedWebIdentityRole",

98 "RoleSessionName": "app1",

99 "WebIdentityToken": "Atza%7CIQEBLjAsAhRFiXuWpUXuRvQ9PZL3GMFcYevydwIUFAHZwXZXXXXXXXXJnrulxKDHwy87oGKPznh0D6bEQZTSCzyoCtL_8S07pLpr0zMbn6w1lfVZKNTBdDansFBmtGnIsIapjI6xKR02Yc_2bQ8LZbUXSGm6Ry6_BG7PrtLZtj_dfCTj92xNGed-CrKqjG7nPBjNIL016GGvuS5gSvPRUxWES3VYfm1wl7WTI7jn-Pcb6M-buCgHhFOzTQxod27L9CqnOLio7N3gZAGpsp6n1-AJBOCJckcyXe2c6uD0srOJeZlKUm2eTDVMf8IehDVI0r1QOnTV6KzzAI3OY87Vd_cVMQ"

100 },

101 "output": {

102 "AssumedRoleUser": {

103 "Arn": "arn:aws:sts::123456789012:assumed-role/FederatedWebIdentityRole/app1",

104 "AssumedRoleId": "AROACLKWSDQRAOEXAMPLE:app1"

105 },

106 "Audience": "client.5498841531868486423.1548@apps.example.com",

107 "Credentials": {

108 "AccessKeyId": "AKIAIOSFODNN7EXAMPLE",

Critical

Secret Pattern

AWS access key ID in backend/adal-backend/_internal/botocore/data/sts/2011-06-15/examples-1.json

backend/adal-backend/_internal/botocore/data/sts/2011-06-15/examples-1.jsonView on unpkg · L108

109 "Expiration": "2014-10-24T23:00:23Z",

110 "SecretAccessKey": "wJalrXUtnFEMI/K7MDENG/bPxRfiCYzEXAMPLEKEY",

111 "SessionToken": "AQoDYXdzEE0a8ANXXXXXXXXNO1ewxE5TijQyp+IEXAMPLE"

112 },

113 "PackedPolicySize": 123,

114 "Provider": "www.amazon.com",

115 "SubjectFromWebIdentityToken": "amzn1.account.AF6RHO7KZU5XRVQJGXK6HEXAMPLE"

116 },

117 "comments": {

118 "input": {

119 },

120 "output": {

121 }

122 },

123 "description": "",

124 "id": "to-assume-a-role-as-an-openid-connect-federated-user-1480533445696",

125 "title": "To assume a role as an OpenID Connect-federated user"

126 }

127 ],

128 "DecodeAuthorizationMessage": [

134 "DecodedMessage": "{\"allowed\": \"false\",\"explicitDeny\": \"false\",\"matchedStatements\": \"\",\"failures\": \"\",\"context\": {\"principal\": {\"id\": \"AIDACKCEVSQ6C2EXAMPLE\",\"name

135 },

136 "comments": {

137 "input": {

138 },

139 "output": {

140 }

141 },

142 "description": "",

143 "id": "to-decode-information-about-an-authorization-status-of-a-request-1480533854499",

144 "title": "To decode information about an authorization status of a request"

145 }

146 ],

147 "GetCallerIdentity": [

148 {

149 "input": {

150 },

151 "output": {

152 "Account": "123456789012",

153 "Arn": "arn:aws:iam::123456789012:user/Alice",

154 "UserId": "AKIAI44QH8DHBEXAMPLE"

Critical

Secret Pattern

AWS access key ID in backend/adal-backend/_internal/botocore/data/sts/2011-06-15/examples-1.json

backend/adal-backend/_internal/botocore/data/sts/2011-06-15/examples-1.jsonView on unpkg · L154

155 },

156 "comments": {

157 "input": {

158 },

159 "output": {

160 }

161 },

162 "description": "This example shows a request and response made with the credentials for a user named Alice in the AWS account 123456789012.",

163 "id": "to-get-details-about-a-calling-iam-user-1480540050376",

164 "title": "To get details about a calling IAM user"

165 },

166 {

167 "input": {

168 },

169 "output": {

170 "Account": "123456789012",

171 "Arn": "arn:aws:sts::123456789012:assumed-role/my-role-name/my-role-session-name",

172 "UserId": "AKIAI44QH8DHBEXAMPLE:my-role-session-name"

Critical

Secret Pattern

AWS access key ID in backend/adal-backend/_internal/botocore/data/sts/2011-06-15/examples-1.json

backend/adal-backend/_internal/botocore/data/sts/2011-06-15/examples-1.jsonView on unpkg · L172

173 },

174 "comments": {

175 "input": {

176 },

177 "output": {

178 }

179 },

180 "description": "This example shows a request and response made with temporary credentials created by AssumeRole. The name of the assumed role is my-role-name, and the RoleSessionName is set to my-role-session-name.",

181 "id": "to-get-details-about-a-calling-user-federated-with-assumerole-1480540158545",

182 "title": "To get details about a calling user federated with AssumeRole"

183 },

184 {

185 "input": {

186 },

187 "output": {

188 "Account": "123456789012",

189 "Arn": "arn:aws:sts::123456789012:federated-user/my-federated-user-name",

190 "UserId": "123456789012:my-federated-user-name"

191 },

192 "comments": {