registry  /  @vention/vention-cli  /  0.24.1

@vention/vention-cli@0.24.1

CLI tool for Vention applications

Static Scan Results

scanned 6d ago · by rust-scanner

Static analysis flagged 7 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
Supply chain
HighEntropyStringsUrlStrings
ManifestNo manifest risk signals triggered.
scanned 1 file(s), 358 KB of source, external domains: 127.0.0.1, bugs.chromium.org, developer.mozilla.org, digital-twin.vention.foo, digital-twin.vention.io, github.com, login.vention.foo, login.vention.io, pastebin.com, stackoverflow.com, tc39.es, url.spec.whatwg.org, vention.foo, vention.io

Source & flagged code

1 flagged · loading source
cli.esm.jsView file
6import path$2 from 'path'; L7: import { exec as exec$9 } from 'child_process'; L8: import http from 'http'; L9: import { URLSearchParams as URLSearchParams$2, fileURLToPath } from 'url'; L10: import { once } from 'events'; ... L2658: var $parseInt$1 = parseInt; L2659: var fromCharCode$3 = String.fromCharCode; L2660: var at$2 = uncurryThis$r(''.charAt); ... L3128: const getConfigPath = () => { L3129: const homeDir = process.env.HOME || process.env.USERPROFILE; L3130: if (!homeDir) { ... L3133: console.warn(chalk.blue("To fix this permanently, set the HOME environment variable."));
High
Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

cli.esm.jsView on unpkg · L6

Findings

1 High3 Medium3 Low
HighSandbox Evasion Gated Capabilitycli.esm.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings