registry  /  @todos-dev/cli  /  0.1.14

@todos-dev/cli@0.1.14

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
Supply chain
HighEntropyStringsObfuscatedUrlStrings
Manifest
NoLicense
scanned 1 file(s), 674 KB of source, external domains: github.com, json-schema.org, todos.dev

Source & flagged code

2 flagged · loading source
dist/index.jsView file
40// src/lib/proxy.ts L41: var import_child_process = require("child_process"); L42: function parseScutilProxy(output) {
High
Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L40
50if (httpEnabled && httpHost && httpPort) { L51: const url2 = `http://${httpHost}:${httpPort}`; L52: vars.HTTP_PROXY = url2; ... L62: function injectSystemProxy() { L63: if (process.env.HTTP_PROXY || process.env.http_proxy || process.env.HTTPS_PROXY || process.env.https_proxy) return; L64: const result = (0, import_child_process.spawnSync)("scutil", ["--proxy"], { encoding: "utf8" }); L65: if (result.status !== 0 || !result.stdout) return;
High
Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L50

Findings

3 High3 Medium6 Low
HighChild Processdist/index.js
HighEval
HighSame File Env Network Executiondist/index.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowObfuscated
LowHigh Entropy Strings
LowUrl Strings
LowNo License