registry / @verentis/cli / 0.2.4

@verentis/cli@0.2.4

Verentis CLI — pack, sign and publish applications, execution engines and file bundles to the Verentis marketplace

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 142 KB of source, external domains: example.com, registry.npmjs.org

Source & flagged code

2 flagged

dist/index.jsView file

Lines 1-25javascript

1#!/usr/bin/env node

2import { Command } from 'commander';

3import { mkdir, stat, writeFile, readFile, readdir, mkdtemp, rm, glob } from 'fs/promises';

4import { tmpdir, homedir } from 'os';

5import { resolve, basename, dirname, posix, join, sep, relative } from 'path';

6import { spawn, spawnSync } from 'child_process';

7import { generateKeyPairSync, createHash, randomUUID, randomBytes, createCipheriv, createPublicKey, verify, diffieHellman, hkdfSync, sign, createPrivateKey } from 'crypto';

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L5

8import { parse } from 'yaml';

9import { createWriteStream, readFileSync, createReadStream } from 'fs';

10import { Readable } from 'stream';

11import { pipeline } from 'stream/promises';

12import * as tar from 'tar';

13import { fileURLToPath } from 'url';

15var configDir = () => process.env.VERENTIS_CONFIG_DIR ?? join(homedir(), ".verentis");

16var configPath = () => join(configDir(), "config.json");

17var keysDir = () => join(configDir(), "keys");

18async function loadConfig() {

19 try {

20 return JSON.parse(await readFile(configPath(), "utf8"));

21 } catch {

22 return {};

23 }

24}

25async function saveConfig(config) {

Lines 2651-2691javascript

2651 }

2652}

2653

2654// src/commands/update.ts

2655function registerUpdate(program2) {

2656 program2.command("update").description("Update the Verentis CLI to the latest published version").option("--check", "report whether a newer version is available without installing").option("--to <version>", "install a specific version instead of the latest").action(

Source & flagged code

2 flagged · loading source

dist/index.jsView file

5import { resolve, basename, dirname, posix, join, sep, relative } from 'path'; L6: import { spawn, spawnSync } from 'child_process'; L7: import { generateKeyPairSync, createHash, randomUUID, randomBytes, createCipheriv, createPublicKey, verify, diffieHellman, hkdfSync, sign, createPrivateKey } from 'crypto';

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L5

2671Update manually, for example: L2672: npm install -g ${PACKAGE_NAME}@${target}` L2673: ); ... L2676: console.log(`$ ${install.command} ${install.args.join(" ")}`); L2677: const result = spawnSync(install.command, install.args, { stdio: "inherit" }); L2678: if (result.error) {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L2671

Findings

3 High3 Medium4 Low

HighChild Processdist/index.js

HighShell

HighRuntime Package Installdist/index.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

dist/index.jsView file

Lines 1-25javascript

1#!/usr/bin/env node

2import { Command } from 'commander';

3import { mkdir, stat, writeFile, readFile, readdir, mkdtemp, rm, glob } from 'fs/promises';

4import { tmpdir, homedir } from 'os';

5import { resolve, basename, dirname, posix, join, sep, relative } from 'path';

6import { spawn, spawnSync } from 'child_process';

7import { generateKeyPairSync, createHash, randomUUID, randomBytes, createCipheriv, createPublicKey, verify, diffieHellman, hkdfSync, sign, createPrivateKey } from 'crypto';

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L5

8import { parse } from 'yaml';

9import { createWriteStream, readFileSync, createReadStream } from 'fs';

10import { Readable } from 'stream';

11import { pipeline } from 'stream/promises';

12import * as tar from 'tar';

13import { fileURLToPath } from 'url';

15var configDir = () => process.env.VERENTIS_CONFIG_DIR ?? join(homedir(), ".verentis");

16var configPath = () => join(configDir(), "config.json");

17var keysDir = () => join(configDir(), "keys");

18async function loadConfig() {

19 try {

20 return JSON.parse(await readFile(configPath(), "utf8"));

21 } catch {

22 return {};

23 }

24}

25async function saveConfig(config) {

Lines 2651-2691javascript

2651 }

2652}

2653

2654// src/commands/update.ts

2655function registerUpdate(program2) {