registry / @vectorplane/ctrl-cli / 0.9.15

@vectorplane/ctrl-cli@0.9.15

Continuity CLI for teams that operate with AI every day.

Static Scan Results

scanned 1h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 83 file(s), 851 KB of source, external domains: 127.0.0.1, absolute-urls-only.invalid, api.github.com, api.ipify.org, app.vectorplane.ai, bitbucket.org, github.com, gitlab.com, proxy-pn.vectorplane.ai

Source & flagged code

2 flagged

dist/commands/runner.jsView file

Lines 177-217javascript

177}

178const runnerStdoutLogger = {

179 debug: (_message, _ctx) => undefined,

180 info: (message, ctx) => {

181 process.stdout.write(`[runner] ${message}${ctx ? ` ${JSON.stringify(ctx)}` : ""}\n`);

182 },

183 warn: (message, ctx) => {

184 process.stderr.write(`[runner] AVISO ${message}${ctx ? ` ${JSON.stringify(ctx)}` : ""}\n`);

185 },

186 error: (message, ctx) => {

187 process.stderr.write(`[runner] ERRO ${message}${ctx ? ` ${JSON.stringify(ctx)}` : ""}\n`);

188 },

189};

190/**

191 * Canal de wake por push (plano 1c): WS autenticado em

192 * /workspace/{id}/stream via `ws` (o WebSocket padrão não aceita headers).

193 * Sem `ws` disponível ou com --no-wake, o runner vive só do poll (1b).

194 */

195async function buildWakeChannel(options) {

196 let WsCtor;

197 try {

198 WsCtor = (await import("ws")).WebSocket;

199 }

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/commands/runner.jsView on unpkg · L197

200 catch {

201 process.stderr.write("[runner] wake por push indisponível (pacote ws ausente); seguindo em poll\n");

202 return undefined;

203 }

204 const wsUrl = `${options.gatewayBaseUrl.replace(/^http/, "ws")}/workspace/${encodeURIComponent(options.workspaceId)}/stream`;

205 return new WakeChannel({

206 connect: async () => new WsCtor(wsUrl, {

207 headers: { Authorization: `Bearer ${await options.getToken()}` },

208 }),

209 capability: options.capability,

210 wakeTypes: options.wakeTypes,

211 });

212}

213function requirePlaneOption(parsed, flag, envName) {

214 const value = getStringOption(parsed, flag) ?? process.env[envName]?.trim();

215 if (!value) {

216 throw new ValidationError(`Configuração obrigatória ausente: --${flag} ou env ${envName}.`);

217 }

dist/core/git-checkout.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @vectorplane/ctrl-cli@0.9.14 matchedIdentity = npm:QHZlY3RvcnBsYW5lL2N0cmwtY2xp:0.9.14 similarity = 0.987 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/core/git-checkout.jsView on unpkg

Source & flagged code

2 flagged · loading source

dist/commands/runner.jsView file

197package = @vectorplane/ctrl-cli; repositoryIdentity = vectorplane-ctrl-cli; dependency = ws L197: try { L198: WsCtor = (await import("ws")).WebSocket; L199: }

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/commands/runner.jsView on unpkg · L197

dist/core/git-checkout.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/core/git-checkout.jsView on unpkg

Findings

2 High3 Medium5 Low

HighCopied Package Dependency Bridgedist/commands/runner.js

HighPrevious Version Dangerous Deltadist/core/git-checkout.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

dist/commands/runner.jsView file

Lines 177-217javascript

177}

178const runnerStdoutLogger = {

179 debug: (_message, _ctx) => undefined,

180 info: (message, ctx) => {

181 process.stdout.write(`[runner] ${message}${ctx ? ` ${JSON.stringify(ctx)}` : ""}\n`);

182 },

183 warn: (message, ctx) => {

184 process.stderr.write(`[runner] AVISO ${message}${ctx ? ` ${JSON.stringify(ctx)}` : ""}\n`);

185 },

186 error: (message, ctx) => {

187 process.stderr.write(`[runner] ERRO ${message}${ctx ? ` ${JSON.stringify(ctx)}` : ""}\n`);

188 },

189};

190/**

191 * Canal de wake por push (plano 1c): WS autenticado em

192 * /workspace/{id}/stream via `ws` (o WebSocket padrão não aceita headers).

193 * Sem `ws` disponível ou com --no-wake, o runner vive só do poll (1b).

194 */

195async function buildWakeChannel(options) {

196 let WsCtor;

197 try {

198 WsCtor = (await import("ws")).WebSocket;

199 }

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/commands/runner.jsView on unpkg · L197

200 catch {

201 process.stderr.write("[runner] wake por push indisponível (pacote ws ausente); seguindo em poll\n");

202 return undefined;

203 }

204 const wsUrl = `${options.gatewayBaseUrl.replace(/^http/, "ws")}/workspace/${encodeURIComponent(options.workspaceId)}/stream`;

205 return new WakeChannel({

206 connect: async () => new WsCtor(wsUrl, {

207 headers: { Authorization: `Bearer ${await options.getToken()}` },

208 }),

209 capability: options.capability,

210 wakeTypes: options.wakeTypes,

211 });

212}

213function requirePlaneOption(parsed, flag, envName) {

214 const value = getStringOption(parsed, flag) ?? process.env[envName]?.trim();

215 if (!value) {

216 throw new ValidationError(`Configuração obrigatória ausente: --${flag} ou env ${envName}.`);

217 }

dist/core/git-checkout.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/core/git-checkout.jsView on unpkg