registry / @trayai/helix-cli / 0.103.0
@trayai/helix-cli@0.103.0
⚠ Under reviewHelix CLI — helix init, helix dev, helix auth
Static Scan Results
scanned 3mo ago · by rust-scannerStatic analysis flagged 15 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsPossibleObfuscationUrlStrings
Source & flagged code
9 flaggeddist/cli.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @trayai/helix-cli@0.65.0
matchedIdentity = npm:QHRyYXlhaS9oZWxpeC1jbGk:0.65.0
similarity = 0.750
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/cli.jsView on unpkg162${m}
L163: `:typeof u=="string"?`Deploy failed [${u}]: ${m}`:`Deploy failed: ${m}`),process.exit(1)}})}import{existsSync as Ta}from"fs";import{createConfigService as Ca,resolveConfigFile as b...
L164: `):r.write(`[warn] Not a valid UUID after ${xt} attempts \u2014 skipping. Edit helix.config.ts manually.
High
157Open this link to create ${t}:`),console.log(e.url),console.error(`
L158: Press enter once you've finished in the browser.`)}function is(e){return Pr({message:"Finished in the browser?",default:!0})}async function ss(e){return Qi({message:"Alias for this...
L159: \u2713 Workspace "${N.name}" created`);try{await O(p,N.id,{configFile:a})}catch(Qo){throw Fe(N,Qo)}console.log(` \u21B3 workspaceId ${N.id} written to ${Lr(a)??"helix.config.ts"}`...
...
L162: ${m}
L163: `:typeof u=="string"?`Deploy failed [${u}]: ${m}`:`Deploy failed: ${m}`),process.exit(1)}})}import{existsSync as Ta}from"fs";import{createConfigService as Ca,resolveConfigFile as b...
L164: `):r.write(`[warn] Not a valid UUID after ${xt} attempts \u2014 skipping. Edit helix.config.ts manually.
L165: `)}return null}async fun
Findings
1 Critical7 High2 Medium5 Low
CriticalPrevious Version Dangerous Deltadist/cli.js
HighChild Processdist/cli.js
HighSame File Env Network Executiondist/cli.js
HighCredential Redirect Persistencedist/cli.js
HighEntrypoint Foreign Package Code Overwritedist/cli.js
HighCommand Output Exfiltrationdist/cli.js
HighTrigger Reachable Command Output Exfiltrationdist/cli.js
HighSemantic Analysis Limiteddist/cli.js
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowWeak Cryptodist/cli.js
LowFilesystem
Low
Affected versions and remediation
This report applies to @trayai/helix-cli@0.103.0.
See all versions of @trayai/helix-cli for other recorded verdicts.
- Review the evidence and your use of @trayai/helix-cli@0.103.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.