registry / @trayai/helix-cli / 0.70.0
@trayai/helix-cli@0.70.0
⚠ Under reviewHelix CLI — helix init, helix dev, helix auth
Static Scan Results
scanned 46m ago · by rust-scannerStatic analysis completed at 93.0% confidence. No malicious behavior was detected; 15 low-signal pattern(s) were surfaced and cleared.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
8 flaggeddist/cli.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @trayai/helix-cli@1.18.1
matchedIdentity = npm:QHRyYXlhaS9oZWxpeC1jbGk:1.18.1
similarity = 0.400
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/cli.jsView on unpkg104`}function pt(e){let o=new Xo({useInMemoryFileSystem:!0,sk[redacted]:!0,sk[redacted]:!0}).createSourceFile("helix.config.ts",e,{overwrite:!0}).getExportAssig...
L105: `,p-1)+1;a=e.slice(c,p)}let l=on(e);return e.slice(0,i)+`${a}${t}: "${r}",${l}`+e.slice(i)}async function O(e,t,r){en.parse(t);let o=await je(e);return Re(o,async()=>{let n=await C...
L106: `):r.write(`[warn] Not a valid UUID after ${Oe} attempts \u2014 skipping. Edit helix.config.ts manually.
High
104`}function pt(e){let o=new Xo({useInMemoryFileSystem:!0,sk[redacted]:!0,sk[redacted]:!0}).createSourceFile("helix.config.ts",e,{overwrite:!0}).getExportAssig...
L105: `,p-1)+1;a=e.slice(c,p)}let l=on(e);return e.slice(0,i)+`${a}${t}: "${r}",${l}`+e.slice(i)}async function O(e,t,r){en.parse(t);let o=await je(e);return Re(o,async()=>{let n=await C...
L106: `):r.write(`[warn] Not a valid UUID after ${Oe} attempts \u2014 skipping. Edit helix.config.ts manually.
L107: `)}return null}async function me(e,t){let r=e.get();if(r.kind==="provisioned"&&r.workspaceId!==void 0)return r;if(!t.stdin.isTTY)return r.kind==="unprovisioned"&&q(t.stdout,"projec...
L108: `)}finally{o.close()}return n?e.reload():r}import{createNitro as Jn,build as Zn,createDevServer as Yn}from"nitropack";import{join as D,d
Findings
1 Critical5 High4 Medium5 Low
CriticalPrevious Version Dangerous Deltadist/cli.js
HighChild Processdist/cli.js
HighSame File Env Network Executiondist/cli.js
HighCredential Redirect Persistencedist/cli.js
HighCommand Output Exfiltrationdist/cli.js
HighTrigger Reachable Command Output Exfiltrationdist/cli.js
MediumDynamic Requiredist/templates/project/_helix/hooks/helix-activate.cjs
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowWeak Cryptodist/cli.js
LowFilesystem
Low
Affected versions and remediation
This report applies to @trayai/helix-cli@0.70.0.
See all versions of @trayai/helix-cli for other recorded verdicts.
- Review the evidence and your use of @trayai/helix-cli@0.70.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.