registry  /  @todos-dev/cli  /  0.1.22

@todos-dev/cli@0.1.22

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
Supply chain
HighEntropyStringsObfuscatedUrlStrings
Manifest
NoLicense
scanned 1 file(s), 677 KB of source, external domains: github.com, json-schema.org, todos.dev

Source & flagged code

2 flagged · loading source
dist/index.jsView file
64if (proxyUrlFromEnv()) return; L65: const result = (0, import_child_process.spawnSync)("scutil", ["--proxy"], { encoding: "utf8" }); L66: if (result.status !== 0 || !result.stdout) return;
High
Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L64
53if (httpsEnabled && httpsHost && httpsPort) { L54: const url2 = `http://${httpsHost}:${httpsPort}`; L55: vars.HTTPS_PROXY = url2; ... L60: function proxyUrlFromEnv() { L61: return process.env.HTTPS_PROXY || process.env.https_proxy || process.env.HTTP_PROXY || process.env.http_proxy || void 0; L62: } ... L64: if (proxyUrlFromEnv()) return; L65: const result = (0, import_child_process.spawnSync)("scutil", ["--proxy"], { encoding: "utf8" }); L66: if (result.status !== 0 || !result.stdout) return;
High
Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L53

Findings

3 High3 Medium6 Low
HighChild Processdist/index.js
HighEval
HighSame File Env Network Executiondist/index.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowObfuscated
LowHigh Entropy Strings
LowUrl Strings
LowNo License