registry / @thingd/cli / 0.49.1

@thingd/cli@0.49.1

⚠ Under review

CLI, Interactive TUI Dashboard, and MCP server for thingd — a fast object-first data engine for applications and AI agents.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 20 file(s), 348 KB of source, external domains: 127.0.0.1, api.thingd.cloud, svelte.dev, thingd.cloud, thingd.local, www.w3.org

Source & flagged code

4 flagged

dist/index.jsView file

Lines 302-342javascript

302 return;

303 }

304 throw new Error(`Unknown db subcommand: ${sub}. Expected: checkpoint, integrity`);

305 }

306 throw new Error(`Unknown command: ${command}`);

307}

308async function runBench(context) {

309 const target = requiredToken(context.parsed, 1, "benchmark target (rust)");

310 if (target !== "rust") {

311 throw new Error(`Unsupported benchmark target: ${target}`);

312 }

313 const isSmoke = hasFlag(context.parsed, "smoke");

314 const countStr = stringFlag(context.parsed, "count");

315 const count = countStr ? Number.parseInt(countStr, 10) : isSmoke ? 100 : undefined;

316 if (count === undefined) {

317 throw new Error("bench rust requires --smoke or --count <n>");

318 }

319 if (Number.isNaN(count) || count <= 0) {

320 throw new Error("--count must be a positive integer");

321 }

322 try {

323 const { execSync } = await import("node:child_process");

324 try {

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L322

325 execSync("cargo --version", { stdio: "ignore" });

326 }

327 catch {

328 throw new Error("Rust toolchain (cargo) is not installed or not in the PATH. Cannot run Rust benchmarks.");

329 }

330 context.stderr.write(`\n${pc.bold("Running Rust storage benchmark")} (Count: ${pc.cyan(count)})...\n\n`);

331 const { spawn } = await import("node:child_process");

332 const child = spawn("cargo", [

333 "run",

334 "--release",

335 "-p",

336 "thingd",

337 "--example",

338 "storage_bench",

339 "--features",

340 "sqlite",

341 "--",

342 String(count),

Lines 1104-1144javascript

1104 }

1105 try {

1106 return realpathSync(resolve(scriptPath));

1107 }

1108 catch {

1109 return resolve(scriptPath);

1110 }

1111}

1112async function runDashboard(

•matchType = previous_version_dangerous_delta matchedPackage = @thingd/cli@0.44.3 matchedIdentity = npm:QHRoaW5nZC9jbGk:0.44.3 similarity = 0.800 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg

dist/commands/cloud.jsView file

Lines 1-21javascript

1import { execSync } from "node:child_process";

2import { setTimeout as sleep } from "node:timers/promises";

3import pc from "picocolors";

4import { requiredToken, stringFlag } from "../index.js";

5import { addOrganizationMember, CloudApiError, createApiKey, createInstance, createOrganization, createProject, getMe, getOrganization, listInstances, listOrganizationMembers, listOrganizations, listProjects, pollCliAuth, removeOrganizationMember, startCliAuth, }

Source & flagged code

4 flagged · loading source

dist/index.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg

322try { L323: const { execSync } = await import("node:child_process"); L324: try {

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L322

1124const { server: _server, close } = await startDashboardServer(connection, port); L1125: context.stderr.write(`${pc.green("✔ Dashboard successfully loaded.")}\n` + L1126: `Opening browser... (Press ${pc.yellow("Ctrl+C")} to stop the server)\n\n`); L1127: await openBrowser(`http://localhost:${port}`); L1128: return new Promise((_resolve) => { ... L1139: async function openBrowser(url) { L1140: const { exec } = await import("node:child_process"); L1141: const startCommand = process.platform === "darwin" ? "open" : process.platform === "win32" ? "start" : "xdg-open";

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L1124

dist/commands/cloud.jsView file

1import { execSync } from "node:child_process"; L2: import { setTimeout as sleep } from "node:timers/promises"; ... L9: function cliApiUrl(context) { L10: return stringFlag(context.parsed, "url") ?? process.env.THINGD_URL ?? "https://api.thingd.cloud"; L11: } ... L22: try { L23: const platform = process.platform; L24: if (platform === "darwin") { ... L65: default: L66: context.stderr.write(`Unknown cloud subcommand: ${sub}\n` + L67: "Available: login, logout, status, org, project, instance, api-key\n");

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/commands/cloud.jsView on unpkg · L1

Findings

1 Critical4 High3 Medium4 Low

CriticalPrevious Version Dangerous Deltadist/index.js

HighChild Processdist/index.js

HighShell

HighCommand Output Exfiltrationdist/index.js

HighSandbox Evasion Gated Capabilitydist/commands/cloud.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

dist/index.jsView file

Lines 302-342javascript

302 return;

303 }

304 throw new Error(`Unknown db subcommand: ${sub}. Expected: checkpoint, integrity`);

305 }

306 throw new Error(`Unknown command: ${command}`);

307}

308async function runBench(context) {

309 const target = requiredToken(context.parsed, 1, "benchmark target (rust)");

310 if (target !== "rust") {

311 throw new Error(`Unsupported benchmark target: ${target}`);

312 }

313 const isSmoke = hasFlag(context.parsed, "smoke");

314 const countStr = stringFlag(context.parsed, "count");

315 const count = countStr ? Number.parseInt(countStr, 10) : isSmoke ? 100 : undefined;

316 if (count === undefined) {

317 throw new Error("bench rust requires --smoke or --count <n>");

318 }

319 if (Number.isNaN(count) || count <= 0) {

320 throw new Error("--count must be a positive integer");

321 }

322 try {

323 const { execSync } = await import("node:child_process");

324 try {

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L322

325 execSync("cargo --version", { stdio: "ignore" });

326 }

327 catch {

328 throw new Error("Rust toolchain (cargo) is not installed or not in the PATH. Cannot run Rust benchmarks.");

329 }

330 context.stderr.write(`\n${pc.bold("Running Rust storage benchmark")} (Count: ${pc.cyan(count)})...\n\n`);

331 const { spawn } = await import("node:child_process");

332 const child = spawn("cargo", [

333 "run",

334 "--release",

335 "-p",

336 "thingd",

337 "--example",

338 "storage_bench",

339 "--features",

340 "sqlite",

341 "--",

342 String(count),

Lines 1104-1144javascript

1104 }

1105 try {

1106 return realpathSync(resolve(scriptPath));

1107 }

1108 catch {

1109 return resolve(scriptPath);

1110 }

1111}

1112async function runDashboard(

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg

dist/commands/cloud.jsView file

Lines 1-21javascript

1import { execSync } from "node:child_process";

2import { setTimeout as sleep } from "node:timers/promises";

3import pc from "picocolors";

4import { requiredToken, stringFlag } from "../index.js";