registry / @topolo/cli / 0.9.3

@topolo/cli@0.9.3

Public command-line interface for Topolo customer organizations, developers, and agents.

Static Scan Results

scanned 1mo ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 9 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 1 file(s), 230 KB of source, external domains: auth.stg.topolo.us, auth.topolo.app, auth.topolo.dev, developers.stg.topolo.us, developers.topolo.app, developers.topolo.dev

Source & flagged code

2 flagged

dist/index.jsView file

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/index.js: import { createInterface } from "readline/promises"; headers.set("Authorization", `Bearer ${credential.accessToken}`); "action_runtime_authorization_required", "authorization_pending", return "The current identity or resource context is not authorized. Review the structured details and published authorization contract."; const apiBaseUrl = firstString(entry.apiBaseUrl, entry.api_base_url); if (apiBaseUrl) return apiBaseUrl; if (["authorization", "cookie", "set-cookie", "proxy-authorization", "x-api-key"].includes(header.toLowerCase())) {

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/index.jsView on unpkg

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. dist/index.js: // node_modules/@topolo/sdk/dist/index.js auth: "https://auth.topolo.app", developers: "https://developers.topolo.app" // node_modules/@topolo/sdk/dist/node/credential-store.js import { mkdir, readFile, writeFile, chmod, rm, stat } from "fs/promises"; auth: "https://auth.topolo.app", developers: "https://developers.topolo.app" auth: "https://auth.topolo.app",

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

dist/index.jsView on unpkg

Source & flagged code

2 flagged · loading source

dist/index.jsView file

@topolo/cli@0.9.3

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code