registry / @tinyfiles/cli / 0.1.39

@tinyfiles/cli@0.1.39

AT-1 / TinyFiles CLI — verified-lossless, queryable compression. Native prebuilt binary, no Python required.

Static Scan Results

scanned 5d ago · by rust-scanner

Static analysis flagged 6 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcess

Supply chain

UrlStrings

Manifest

NoLicense

scanned 1 file(s), 1.70 KB of source, external domains: tinyfiles.io

Source & flagged code

3 flagged

bin/at1.cjsView file

Lines 1-43javascript

1#!/usr/bin/env node

2"use strict";

3/**

4 * @tinyfiles/cli launcher. Execs the prebuilt, COMPILED AT-1 binary for this platform.

5 *

6 * No IP leak: the engine ships only as a compiled binary (PyInstaller; engine modules are

7 * Cython-compiled — no readable .py/.pyc) inside a per-platform optionalDependency

8 * (@tinyfiles/cli-<platform>-<arch>). This launcher contains zero engine logic. The per-platform

9 * packages carry `os`/`cpu` fields, so the package manager installs only the matching one —

10 * and because the binary travels inside that dependency, there is NO postinstall script,

11 * which is what makes this work cleanly under pnpm's default script-blocking.

12 */

13const { spawnSync } = require("node:child_process");

High

Child Process

Package source references child process execution.

bin/at1.cjsView on unpkg · L12

15function resolveBinary() {

16 const platform = process.platform; // 'win32' | 'darwin' | 'linux'

17 const arch = process.arch; // 'x64' | 'arm64'

18 const binName = platform === "win32" ? "at1.exe" : "at1";

19 try {

20 return require.resolve(`@tinyfiles/cli-${platform}-${arch}/bin/${binName}`);

21 } catch {

22 return null;

23 }

24}

26const bin = resolveBinary();

27if (!bin) {

28 process.stderr.write(

29 `AT-1: no prebuilt binary for ${process.platform}-${process.arch}.\n` +

30 `Supported: win32-x64, darwin-x64, darwin-arm64, linux-x64.\n` +

31 `If you're on one of those, reinstall so the platform package is fetched ` +

32 `(e.g. npm i -g @tinyfiles/cli). On other platforms, use the desktop app: https://tinyfiles.io/download.\n`

33 );

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/at1.cjsView on unpkg · L12

34 process.exit(1);

35}

37const res = spawnSync(bin, process.argv.slice(2), { stdio: "inherit" });

38if (res.error) {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/at1.cjsView on unpkg · L31

39 process.stderr.write(`AT-1: failed to launch binary: ${res.error.message}\n`);

40 process.exit(1);

41}

42process.exit(res.status === null ? 1 : res.status);

Source & flagged code

3 flagged · loading source

bin/at1.cjsView file

12*/ L13: const { spawnSync } = require("node:child_process"); L14:

High

Child Process

Package source references child process execution.

bin/at1.cjsView on unpkg · L12

12*/ L13: const { spawnSync } = require("node:child_process"); L14: L15: function resolveBinary() { L16: const platform = process.platform; // 'win32' | 'darwin' | 'linux' L17: const arch = process.arch; // 'x64' | 'arm64' ... L27: if (!bin) { L28: process.stderr.write( L29: `AT-1: no prebuilt binary for ${process.platform}-${process.arch}.\n` + ... L31: `If you're on one of those, reinstall so the platform package is fetched ` + L32: `(e.g. npm i -g @tinyfiles/cli). On other platforms, use the desktop app: https://tinyfiles.io/download.\n` L33: );

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/at1.cjsView on unpkg · L12

31`If you're on one of those, reinstall so the platform package is fetched ` + L32: `(e.g. npm i -g @tinyfiles/cli). On other platforms, use the desktop app: https://tinyfiles.io/download.\n` L33: ); ... L36: L37: const res = spawnSync(bin, process.argv.slice(2), { stdio: "inherit" }); L38: if (res.error) {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/at1.cjsView on unpkg · L31

Findings

3 High1 Medium2 Low

HighChild Processbin/at1.cjs

HighSandbox Evasion Gated Capabilitybin/at1.cjs

HighRuntime Package Installbin/at1.cjs

MediumStructural Risk Force Deep Review

LowUrl Strings

LowNo License

Source & flagged code

3 flagged

bin/at1.cjsView file

Lines 1-43javascript

1#!/usr/bin/env node

2"use strict";

3/**

4 * @tinyfiles/cli launcher. Execs the prebuilt, COMPILED AT-1 binary for this platform.

5 *

6 * No IP leak: the engine ships only as a compiled binary (PyInstaller; engine modules are

7 * Cython-compiled — no readable .py/.pyc) inside a per-platform optionalDependency

8 * (@tinyfiles/cli-<platform>-<arch>). This launcher contains zero engine logic. The per-platform

9 * packages carry `os`/`cpu` fields, so the package manager installs only the matching one —

10 * and because the binary travels inside that dependency, there is NO postinstall script,

11 * which is what makes this work cleanly under pnpm's default script-blocking.

12 */

13const { spawnSync } = require("node:child_process");

High

Child Process

Package source references child process execution.

bin/at1.cjsView on unpkg · L12

15function resolveBinary() {

16 const platform = process.platform; // 'win32' | 'darwin' | 'linux'

17 const arch = process.arch; // 'x64' | 'arm64'

18 const binName = platform === "win32" ? "at1.exe" : "at1";

19 try {

20 return require.resolve(`@tinyfiles/cli-${platform}-${arch}/bin/${binName}`);

21 } catch {

22 return null;

23 }

24}

26const bin = resolveBinary();

27if (!bin) {

28 process.stderr.write(

29 `AT-1: no prebuilt binary for ${process.platform}-${process.arch}.\n` +

30 `Supported: win32-x64, darwin-x64, darwin-arm64, linux-x64.\n` +

31 `If you're on one of those, reinstall so the platform package is fetched ` +

32 `(e.g. npm i -g @tinyfiles/cli). On other platforms, use the desktop app: https://tinyfiles.io/download.\n`

33 );

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/at1.cjsView on unpkg · L12

34 process.exit(1);

35}

37const res = spawnSync(bin, process.argv.slice(2), { stdio: "inherit" });

38if (res.error) {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/at1.cjsView on unpkg · L31

39 process.stderr.write(`AT-1: failed to launch binary: ${res.error.message}\n`);

40 process.exit(1);

41}

42process.exit(res.status === null ? 1 : res.status);