registry  /  @vention/vention-cli  /  0.25.2

@vention/vention-cli@0.25.2

CLI tool for Vention applications

Static Scan Results

scanned 4h ago · by rust-scanner

Static analysis flagged 7 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
Supply chain
HighEntropyStringsUrlStrings
ManifestNo manifest risk signals triggered.
scanned 1 file(s), 356 KB of source, external domains: 127.0.0.1, bugs.chromium.org, developer.mozilla.org, digital-twin.vention.com, digital-twin.vention.foo, github.com, login.vention.foo, login.vention.io, pastebin.com, stackoverflow.com, tc39.es, url.spec.whatwg.org, vention.com, vention.foo

Source & flagged code

1 flagged · loading source
main.esm.jsView file
7import path$2 from 'path'; L8: import { exec as exec$9 } from 'child_process'; L9: import http from 'http'; L10: import { URLSearchParams as URLSearchParams$2 } from 'url'; L11: import { once } from 'events'; ... L2601: var $parseInt$1 = parseInt; L2602: var fromCharCode$3 = String.fromCharCode; L2603: var at$2 = uncurryThis$s(''.charAt); ... L3071: const getConfigPath = () => { L3072: const homeDir = process.env.HOME || process.env.USERPROFILE; L3073: if (!homeDir) { ... L3076: console.warn(chalk.blue("To fix this permanently, set the HOME environment variable."));
High
Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

main.esm.jsView on unpkg · L7

Findings

1 High3 Medium3 Low
HighSandbox Evasion Gated Capabilitymain.esm.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings