registry / @topolo/cli / 0.9.4

@topolo/cli@0.9.4

Public command-line interface for Topolo customer organizations, developers, and agents.

Static Scan Results

scanned 21d ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 8 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 1 file(s), 231 KB of source, external domains: auth.stg.topolo.us, auth.topolo.app, auth.topolo.dev, developers.stg.topolo.us, developers.topolo.app, developers.topolo.dev

Source & flagged code

1 flagged

dist/index.jsView file

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/index.js: import { createInterface } from "readline/promises"; headers.set("Authorization", `Bearer ${credential.accessToken}`); "action_runtime_authorization_required", "authorization_pending", return "The current identity or resource context is not authorized. Review the structured details and published authorization contract."; const apiBaseUrl = firstString(entry.apiBaseUrl, entry.api_base_url); if (apiBaseUrl) return apiBaseUrl; if (["authorization", "cookie", "set-cookie", "proxy-authorization", "x-api-key"].includes(header.toLowerCase())) {

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/index.jsView on unpkg

Source & flagged code

1 flagged · loading source

dist/index.jsView file

@topolo/cli@0.9.4

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code