registry / @usesocial/cli / 0.12.0

@usesocial/cli@0.12.0

A CLI for LinkedIn and X: outreach, posting, and audience insights from any shell.

Static Scan Results

scanned 17d ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShell

Supply chain

HighEntropyStringsTelemetryUrlStrings

Manifest

NoLicenseWildcardDependency

scanned 2 file(s), 1.27 MB of source, external domains: api.github.com, api.usesocial.dev, docs.x.com, empty.invalid, eu-assets.i.posthog.com, eu.i.posthog.com, github.com, json-schema.org, posthog.com, registry.npmjs.org, sentry.io, social.local, us-assets.i.posthog.com, us.i.posthog.com, usesocial.dev, www.linkedin.com, x.com, yandex.com

Source & flagged code

4 flagged

dist/index.mjsView file

15import { AsyncLocalStorage } from "node:async_hooks"; L16: import process$1, { stdin, stdout } from "node:process"; L17: import { ReadStream } from "node:tty"; L18: import { spawn, spawnSync } from "node:child_process"; L19: //#region \0rolldown/runtime.js ... L408: const sk[redacted] = `npx skills add ${org}/skill`; L409: const publicWebURL = "https://usesocial.dev"; L410: const publicAPIURL = "https://api.usesocial.dev/v1"; ... L699: try { L700: JSON.parse(value); L701: } catch { ... L974: const error = adapter.bodyValidationError?.({

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.mjsView on unpkg · L15

2863try { L2864: new Function(""); L2865: return true;

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/index.mjsView on unpkg · L2863

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/index.mjsView on unpkg · L15

bin/social.mjsView file

Lines 1-14javascript

1#!/usr/bin/env node

2import { dirname, join } from "node:path"

3import { fileURLToPath, pathToFileURL } from "node:url"

5const packageRoot = dirname(dirname(fileURLToPath(

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code