registry / @syntharil/cli / 0.2.1

@syntharil/cli@0.2.1

Syntharil CLI — observe seeding/replication/metadata jobs from your terminal or agent

AI Security Review

scanned 2h ago · by lpm-firewall-ai

No confirmed malicious attack surface. The CLI sends explicit user-command API requests and stores its own OAuth token locally after login.

Static reason

One or more suspicious static signals were detected.

Trigger

User invokes syntharil login, logout, or jobs commands.

Impact

Can manage the user's authorized Syntharil jobs and local CLI token only.

Mechanism

Authenticated Syntharil job-management CLI

Rationale

Source inspection shows a conventional CLI with no install-time execution and no concrete exfiltration or persistence beyond its own token config. Scanner signals arise from legitimate authenticated API, environment, filesystem, and bundled dependency use.

Evidence

package.jsonREADME.mddist/index.mjs~/.config/syntharil/config.json

Network endpoints3

prod.syntharil.app/api/v1/oauth/revoke/api/v1/jobs

Decision evidence

public snapshot

AI called this Clean at 96.0% confidence as Benign with low false-positive risk.

Evidence for block

Evidence against

package.json has no preinstall/install/postinstall lifecycle hook.
dist/index.mjs only runs through the declared syntharil CLI bin.
Network requests are authenticated API calls to the configured Syntharil endpoint.
Token persistence is limited to ~/.config/syntharil/config.json with mode 0600.
Job run/cancel actions are explicit user CLI commands.
No harvesting, arbitrary shell execution, remote payload loading, or agent-control writes found.

Behavioral surface

Source

ChildProcessEnvironmentVarsNetwork

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

WildcardDependency

scanned 1 file(s), 360 KB of source, external domains: 127.0.0.1, json-schema.org, prod.syntharil.app

Source & flagged code

3 flagged

dist/index.mjsView file

Lines 1-34javascript

1#!/usr/bin/env node

2import{createRequire}from'module';import{dirname as __bundle_dirname}from'path';import{fileURLToPath as __bundle_fileURLToPath}from'url';const require=createRequire(import.meta.url);const __filename=__bundle_fileURLToPath(import.meta.url);const __dirname=__bundle_dirname(__filename);

3var Hm=Object.create;var Nn=Object.defineProperty;var qm=Object.getOwnPropertyDescriptor;var Bm=Object.getOwnPropertyNames;var Km=Object.getPrototypeOf,Xm=Object.prototype.hasOwnProperty;var ct=(t=>typeof require<"u"?require:typeof Proxy<"u"?new Proxy(t,{get:(r,n)=>(typeof

4`)}displayWidth(r){return uu(r).length}styleTitle(r){return r}styleUsage(r){return r.split(" ").map(n=>n==="[options]"?this.styleOptionText(n):n==="[command]"?this.styleSubcommandText(n)

5`+" ".repeat(n+u)),a+s+" ".repeat(u)+d.replace(/\n/g,`

6${a}`)}boxWrap(r,n){if(n<this.minWidthToWrap)return r;let o=r.split(/\r\n|\n/),e=/[\s]*[^\s]+/g,i=[];return o.forEach(a=>{let s=a.match(e);if(s===null){i.push("");return}let u=[s.shift()],c=this.displayWidth(u[0]);s.forEach(l=>{let d=this.displayWidth(l);if(c+d<=n){u.push(l),c+=d;return}i.push(u.join(""));let f=l.trimStart();u=[f],c=this.displayWidth(f)}),i.push(u.join(""))}),i.join(`

7`)}};function uu(t){let r=/\x1b\[\d*(;\d*)*m/g;return t.replace(r,"")}Vn.Help=Fn;Vn.stripColor=uu});var Hn=ye(Gn=>{var{InvalidArgumentError:np}=ut(),Mn=class{constructor(r,n){this.flags=r,this.description=n||"",this.required=r.includes("<"),this.optional=r.includes("["),this.variadic=/\w\.\.\.[>\]]$/.test(r),this.mandatory=!1;let o=ip(r);this.short=o.shortFlag,this.long=o.longFlag,this.negate=!1,this.long&&(this.negate=this.long.startsWith("--no-")),this.defaultValue=void 0,this.defaultValueDescription=void 0,this.presetArg=void 0,this.envVar=void 0,this.parseArg=void 0,this.hidden=!1,this.arg ...

8- a short flag is a single dash and a single character

9 - either use a single dash and a single character (for a short flag)

10 - or use a double dash for a long option (and can have two, like '--ws, --workspace')`):o.test(a)?new Error(`${s}

11- too many short flags`):e.test(a)?new Error(`${s}

12- too many long flags`):new Error(`${s}

13- unrecognised flag format`)}if(r===void 0&&n===void 0)throw new Error(`option creation failed due to no flags found in '${t}'.`);return{shortFlag:r,longFlag:n}}Gn.Option=Mn;Gn.DualOptions=Wn});var mu=ye(du=>{function op

14(Did you mean one of ${o.join(", ")}?)`:o.length===1?`

15(Did you mean ${o[0]}?)`:""}du.suggestSimilar=ap});var hu=ye(Yn=>{var sp=ct("node:events").EventEmitter,qn=ct("node:child_process"),ae=ct("node:path"),Wt=ct("node:fs"),I=ct("node:process"),{Argument:cp,humanReadableArgName:up}=Mt(),{CommanderError:Bn}=ut(),{Help:lp,stripColor:dp}=Jn(),{Option:pu,DualOptions:mp}=Hn(),{suggestSimilar:fu}=mu(),Kn=class t extends sp{constructor(r){super(),this.commands=[],this.options=[],this.parent=null,this._allowUnknownOption=!1,this._allowExcessArguments=!1,this.registeredArguments=[],this._args=this.registeredArguments,this.args=[],this.rawArgs=[],this.proces ...

16- specify the name in Command constructor or using .name()`);return n=n||{},n.isDefault&&(this._defaultCommandName=r._name),(n.noHelp||n.hidden)&&(r._hidden=!0),this._registerCommand(r),r.parent=this,r._checkForBrokenPassThrough(),this}createArgument(r,n){return new cp(r,n)}argument(r,n,o,e){let i=this.createArgument(r,n);return typeof o=="function"?i.default(e).argParser(o):i.default(o),this.addArgument(i),this}arguments(r){return r.trim().split(/ +/).forEach(n=>{this.argument(n)}),this}addArgument(r){let n=this.registeredArguments.slice(-1)[0];if(n?.variadic)throw new Error(`only the last ar ...

High

Child Process

Package source references child process execution.

dist/index.mjsView on unpkg · L14

17Expecting one of '${o.join("', '")}'`);return this._lifeCycleHooks[r]?this._lifeCycleHooks[r].push(n):this._lifeCycleHooks[r]=[n],this}exitOverride(r){return r?this._exitCallback=r:this._exitCallback=n=>{if(n.code!=="commander.executeSubCommandAsync")throw n},this}_exit(r,n,o){this._exitCallback&&this._exitCallback(new Bn(r,n,o

18- already used by option '${n.flags}'`)}this._initOptionGroup(r),this.options.push(r)}_registerCommand(r){let n=e=>[e.name()].concat(e.aliases()),o=n(r).find(e=>this._findCommand(e));if(o){let e=n(this._findCommand(o)).join("|"),i=n(r).join("|");throw new Error(`cannot add command '${i}' as already have command '${e}'`)}this._initCommandGroup(r),this.commands.push(r)}addOption(r){this._registerOption(r);let n=r.name(),o=r.attributeName();if(r.negate){let i=r.long.replace(/^--no-/,"--");this._findOption(i)||this.setOptionValueWithSource(o,r.defaultValue===void 0?!0:r.defaultValue,"default")}el ...

19- either make a new Command for each call to parse, or stop storing options as properties`);this._name=this._savedState._name,this._scriptPath=null,this.rawArgs=[],this._optionValues={...this._savedState._optionValues},this._optionValueSources={...this._savedState._optionValueSources},this.args=[],this.processedArgs=[]}_checkForMissingExecutable(r,n,o){if(Wt.existsSync(r))return;let e=n?

20 - if '${o}' is not meant to be an executable command, remove description parameter from '.command()' and use '.description()' instead

21 - if the default executable name is not suitable, use the executableFile option to supply a custom name or path

22 - ${e}`;throw new Error(i)}_executeSubCommand(r,n){n=n.slice();let o=!1,e=[".js",".ts",".tsx",".mjs",".cjs"];function i(l,d){let f=ae.resolve(l,d);if(Wt.existsSync(f))return f;if(e.

23`,this._outputConfiguration.writeErr),typeof this._showHelpAfterError=="string"?this._outputConfiguration.writeErr(`${this._showHelpAfterError}

24`):this._showHelpAfterError&&(this._outputConfiguration.writeErr(`

25`),this.outputHelp({error:!0}));let o=n||{},e=o.exitCode||1,i=o.code||"commander.error";this._exit(e,i,r)}_parseOptionsEnv(){this.options.forEach(r=>{if(r.envVar&&r.envVar in I.env){let n=r.attributeName();(this.getOptionValue(n)===void 0||["default","config","env"].includes(this.getOptionValueSource(n)))&&(r.required||r.optional?this.emit(`optionEnv:${r.name()}`,I.env[r.envVar]):this.emit(`optionEnv:${r.name()}`))}})}_parseOptionsImplied(){let r=new mp(this.options),n=o=>this.getOptionValue(o)!==void 0&&!["default","implied"].includes(this.getOptionValueSource(o));this.options.filter(o=>o.imp ...

26`),this._exit(0,"commander.version",r)}),this}description(r,n){return r===void 0&&n===void 0?this._description:(this._description=r,n&&(this._argsDescription=n),this)}summary(r){return r===void 0?this._summary:(this._summary=r,this)}alias

27Expecting one of '${o.join("', '")}'`);let e=`${r}Help`;return this.on(e,i=>{let a;typeof n=="function"?a=n({error:i.error,command:i.command}):a=n,a&&i.write(`${a}

28`)}),this}_outputHelpIfRequested(r){let n=this._getHelpOption();n&&r.find(e=>n.is(e))&&(this.outputHelp(),this._exit(0,"commander.helpDisplayed","(outputHelp)"))}};function gu(t){return t.map(r=>{if(!

29`,{mode:384}),gp(r,384)}function Su(t=ti()){$p(t,{force:!0})}function lt(t,r=process.env,n=ri()){return{apiUrl:t.apiUrl||r.SYNTHARIL_API_URL||n.apiUrl||ei,token:t.token||r.SYNTHARIL_TOKEN||n.token||null}}var y={};oe(y,{$brand:()=>Gt,$input:()=>ka,$output:()=>xa,NEVER:()=>ni,TimePrecision:()=>Ia,ZodAny:()=>hc,ZodArray:()=>bc,ZodBase64:()=>bn,ZodBase64URL:()=>yn,ZodBigInt:()=>st,ZodBigIntFormat:()=>wn,ZodBoolean:()=>at,ZodCIDRv4:()=>$n,ZodCIDRv6:()=>_n,ZodCUID:()=>dn,ZodCUID2:()=>mn,ZodCatch:()=>Vc,ZodCodec:()=>Tn,ZodCustom:()=>Vt,ZodCustomStringFormat:()=>it,ZodDate:()=>Ct,ZodDefault:()=>Nc,Zod ...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.mjsView on unpkg · L14

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.mjsView on unpkg · L14

30`)}var Ze=t=>(r,n,o,e)=>{let i=o?Object.assign(o,{async:!1}):{async:!1},a=r._zod.run({value:n,issues:[]},i);if(a instanceof Promise)throw new K;if(a.issues.

31`).filter(a=>a),e=Math.min(...o.map(a=>a.length-a.trimStart().length)),i=o.map(a=>a.slice(e)).map(a=>" ".repeat(this.indent*2)+a);for(let a of i)this.content.push(a)}compile(){let r=Function,n=this?.args,e=[...(this?.content??[""]).map(i=>` ${i}`)];return new r(...n,e.join(`

32`))}};var lo={major:4,minor:3,patch:6};var k=m("$ZodType",(t,r)=>{var n;t??(t={}),t._zod.def=r,t._zod.bag=t._zod.bag||{},t._zod.version=lo;let o=[...t._zod.def.checks??[]];t._zod.traits.has("$ZodCheck")&&o.unshift(t);for(let e of o)for(let i of e._zod.onattach)i(t);if(o.length===0)(n=t._zod).deferred??(n.deferred=[]),t._zod.deferred?.push(()=>{t._zod.run=t._zod.parse});else{let e=(a,s,u)=>{let c=ge(a),l;for(let d of s){if(d._zod.def.when){if(!d._zod.def.when(a))continue}else if(c)continue;let f=a.issues.length,_=d._zod.check(a);if(_ instanceof Promise&&u?.async===!1)throw new K;if(l||_ instanc ...

33 if (${R}.issues.length) {

34 if (${B} in input) {

Long lines were clipped for display.

Source & flagged code

3 flagged · loading source

dist/index.mjsView file

High

Child Process

Package source references child process execution.

dist/index.mjsView on unpkg · L14

14(Did you mean one of ${o.join(", ")}?)`:o.length===1?` L15: (Did you mean ${o[0]}?)`:""}du.suggestSimilar=ap});var hu=ye(Yn=>{var sp=ct("node:events").EventEmitter,qn=ct("node:child_process"),ae=ct("node:path"),Wt=ct("node:fs"),I=ct("node:p... L16: - specify the name in Command constructor or using .name()`);return n=n||{},n.isDefault&&(this._defaultCommandName=r._name),(n.noHelp||n.hidden)&&(r._hidden=!0),this._registerComma... ... L27: Expecting one of '${o.join("', '")}'`);let e=`${r}Help`;return this.on(e,i=>{let a;typeof n=="function"?a=n({error:i.error,command:i.command}):a=n,a&&i.write(`${a} L28: `)}),this}_outputHelpIfRequested(r){let n=this._getHelpOption();n&&r.find(e=>n.is(e))&&(this.outputHelp(),this._exit(0,"commander.helpDisplayed","(outputHelp)"))}};function gu(t){r... L29: `,{mode:384}),gp(r,384)}function Su(t=ti()){$p(t,{force:!0})}function lt(t,r=process.env,n=ri()){return{apiUrl:t.apiUrl||r.SYNTHARIL_API_URL||n.apiUrl||ei,token:t.token||r.SYNTHARI...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.mjsView on unpkg · L14

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.mjsView on unpkg · L14

Findings

3 High3 Medium3 Low

HighChild Processdist/index.mjs

HighSame File Env Network Executiondist/index.mjs

HighCommand Output Exfiltrationdist/index.mjs

MediumNetwork

MediumEnvironment Vars

MediumWildcard Dependency

LowScripts Present

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

dist/index.mjsView file

Lines 1-34javascript

1#!/usr/bin/env node

4`)}displayWidth(r){return uu(r).length}styleTitle(r){return r}styleUsage(r){return r.split(" ").map(n=>n==="[options]"?this.styleOptionText(n):n==="[command]"?this.styleSubcommandText(n)

5`+" ".repeat(n+u)),a+s+" ".repeat(u)+d.replace(/\n/g,`

8- a short flag is a single dash and a single character

9 - either use a single dash and a single character (for a short flag)

10 - or use a double dash for a long option (and can have two, like '--ws, --workspace')`):o.test(a)?new Error(`${s}

11- too many short flags`):e.test(a)?new Error(`${s}

12- too many long flags`):new Error(`${s}

14(Did you mean one of ${o.join(", ")}?)`:o.length===1?`

High

Child Process

Package source references child process execution.

dist/index.mjsView on unpkg · L14

20 - if '${o}' is not meant to be an executable command, remove description parameter from '.command()' and use '.description()' instead

21 - if the default executable name is not suitable, use the executableFile option to supply a custom name or path

22 - ${e}`;throw new Error(i)}_executeSubCommand(r,n){n=n.slice();let o=!1,e=[".js",".ts",".tsx",".mjs",".cjs"];function i(l,d){let f=ae.resolve(l,d);if(Wt.existsSync(f))return f;if(e.

23`,this._outputConfiguration.writeErr),typeof this._showHelpAfterError=="string"?this._outputConfiguration.writeErr(`${this._showHelpAfterError}

24`):this._showHelpAfterError&&(this._outputConfiguration.writeErr(`

27Expecting one of '${o.join("', '")}'`);let e=`${r}Help`;return this.on(e,i=>{let a;typeof n=="function"?a=n({error:i.error,command:i.command}):a=n,a&&i.write(`${a}

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.mjsView on unpkg · L14

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.mjsView on unpkg · L14

30`)}var Ze=t=>(r,n,o,e)=>{let i=o?Object.assign(o,{async:!1}):{async:!1},a=r._zod.run({value:n,issues:[]},i);if(a instanceof Promise)throw new K;if(a.issues.

33 if (${R}.issues.length) {

34 if (${B} in input) {

Long lines were clipped for display.