registry / @thingd/cli / 0.49.1

@thingd/cli@0.49.1

⚠ Under review

CLI, Interactive TUI Dashboard, and MCP server for thingd — a fast object-first data engine for applications and AI agents.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 20 file(s), 348 KB of source, external domains: 127.0.0.1, api.thingd.cloud, svelte.dev, thingd.cloud, thingd.local, www.w3.org

Source & flagged code

4 flagged

dist/index.jsView file

Lines 302-342javascript

302 return;

303 }

304 throw new Error(`Unknown db subcommand: ${sub}. Expected: checkpoint, integrity`);

305 }

306 throw new Error(`Unknown command: ${command}`

Source & flagged code

4 flagged · loading source

dist/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @thingd/cli@0.44.3 matchedIdentity = npm:QHRoaW5nZC9jbGk:0.44.3 similarity = 0.800 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg

322try { L323: const { execSync } = await import("node:child_process"); L324: try {

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L322

1124const { server: _server, close } = await startDashboardServer(connection, port); L1125: context.stderr.write(`${pc.green("✔ Dashboard successfully loaded.")}\n` + L1126: `Opening browser... (Press ${pc.yellow("Ctrl+C")} to stop the server)\n\n`); L1127: await openBrowser(`http://localhost:${port}`); L1128: return new Promise((_resolve) => { ... L1139: async function openBrowser(url) { L1140: const { exec } = await import("node:child_process"); L1141: const startCommand = process.platform === "darwin" ? "open" : process.platform === "win32" ? "start" : "xdg-open";

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L1124

dist/commands/cloud.jsView file

1import { execSync } from "node:child_process"; L2: import { setTimeout as sleep } from "node:timers/promises"; ... L9: function cliApiUrl(context) { L10: return stringFlag(context.parsed, "url") ?? process.env.THINGD_URL ?? "https://api.thingd.cloud"; L11: } ... L22: try { L23: const platform = process.platform; L24: if (platform === "darwin") { ... L65: default: L66: context.stderr.write(`Unknown cloud subcommand: ${sub}\n` + L67: "Available: login, logout, status, org, project, instance, api-key\n");

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/commands/cloud.jsView on unpkg · L1

Findings

1 Critical4 High3 Medium4 Low

CriticalPrevious Version Dangerous Deltadist/index.js

HighChild Processdist/index.js

HighShell

HighCommand Output Exfiltrationdist/index.js

HighSandbox Evasion Gated Capabilitydist/commands/cloud.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Lines 1104-1144javascript

1104 }

1105 try {

1106 return realpathSync(resolve(scriptPath));

1107 }

1108 catch {

1109 return resolve(scriptPath);

1110 }

1111}

1112async function runDashboard(context) {

1113 const portStr = stringFlag(context.parsed, "port");

1114 const port = portStr ? Number.parseInt(portStr, 10) : 8758;

1115 if (Number.isNaN(port) || port <= 0) {

1116 throw new Error("--port must be a positive integer");

1117 }

1118 const connection = resolveConnection(context);

1119 context.stderr.write(`\n${pc.bold(pc.blue("thingd Inspector Dashboard"))}\n` +

1120 `Starting local REST server on ${pc.cyan(`http://localhost:${port}`)}...\n` +

1121 `Database path: ${pc.green(connection.path)}\n` +

1122 `Storage engine: ${pc.cyan(connection.driver || "memory")}\n\n`);

1123 const { startDashboardServer } = await import("./dashboard/server.js");

1124 const { server: _server, close } = await startDashboardServer(connection, port);

1125 context.stderr.write(`${pc.green("✔ Dashboard successfully loaded.")}\n` +

1126 `Opening browser... (Press ${pc.yellow("Ctrl+C")} to stop the server)\n\n`);

1127 await openBrowser(`http://localhost:${port}`);

1128 return new Promise((_resolve) => {

1129 process.on("SIGINT", async () => {

1130 await close();

1131 process.exit(0);

1132 });

1133 process.on("SIGTERM", async () => {

1134 await close();

1135 process.exit(0);

1136 });

1137 });

1138}

1139async function openBrowser(url) {

1140 const { exec } = await import("node:child_process");

1141 const startCommand = process.platform === "darwin" ? "open" : process.platform === "win32" ? "start" : "xdg-open";

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L1124

1142 exec(`${startCommand} ${url}`, () => {

1143 // Ignore browser spawn errors silently

1144 });

dist/commands/cloud.jsView file

Lines 1-21javascript

1import { execSync } from "node:child_process";

2import { setTimeout as sleep } from "node:timers/promises";

3import pc from "picocolors";

4import { requiredToken, stringFlag } from "../index.js";

5import { addOrganizationMember, CloudApiError, createApiKey, createInstance, createOrganization, createProject, getMe, getOrganization, listInstances, listOrganizationMembers, listOrganizations, listProjects, pollCliAuth, removeOrganizationMember, startCliAuth, } from "../lib/cloud-api.js";

6import { readCloudConfig, removeCloudConfig, writeCloudConfig, } from "../lib/cloud-config.js";

7const POLL_INTERVAL_MS = 2_000;

8const POLL_TIMEOUT_MS = 5 * 60 * 1_000;

9function cliApiUrl(context) {

10 return stringFlag(context.parsed, "url") ?? process.env.THINGD_URL ?? "https://api.thingd.cloud";

11}

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/commands/cloud.jsView on unpkg · L1

12function buildWebUrl(apiUrl) {

13 if (apiUrl.includes("//api.") || apiUrl.startsWith("api.")) {

14 return apiUrl.replace("api.", "");

15 }

16 if (apiUrl.includes("localhost:8787") || apiUrl.includes("127.0.0.1:8787")) {

17 return "http://localhost:5173";

18 }

19 return apiUrl;

20}

21function openBrowser(url) {