registry  /  @todos-dev/cli  /  0.1.38

@todos-dev/cli@0.1.38

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
Supply chain
HighEntropyStringsObfuscatedUrlStrings
Manifest
NoLicense
scanned 1 file(s), 671 KB of source, external domains: github.com, json-schema.org, todos.dev

Source & flagged code

2 flagged · loading source
dist/index.jsView file
64// src/lib/workspace.ts L65: var import_node_child_process = require("node:child_process"); L66: var import_node_fs2 = require("node:fs");
High
Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L64
17949function proxyUrlFromEnv() { L17950: return process.env.HTTPS_PROXY || process.env.https_proxy || process.env.HTTP_PROXY || process.env.http_proxy || void 0; L17951: } ... L17953: if (proxyUrlFromEnv()) return; L17954: const result = (0, import_child_process4.spawnSync)("scutil", ["--proxy"], { encoding: "utf8" }); L17955: if (result.status !== 0 || !result.stdout) return; ... L17961: var installed2 = false; L17962: async function installProxyFetch(logPrefix) { L17963: if (installed2) return true;
High
Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L17949

Findings

3 High3 Medium6 Low
HighChild Processdist/index.js
HighEval
HighSame File Env Network Executiondist/index.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowObfuscated
LowHigh Entropy Strings
LowUrl Strings
LowNo License