registry  /  @vm0/cli  /  9.230.4

@vm0/cli@9.230.4

CLI application

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 30 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
Supply chain
HighEntropyStringsTelemetryUrlStrings
Manifest
NoLicense
scanned 600 file(s), 8.33 MB of source, external domains: 7i30hpv4bo9ud5mhianq.pika.art, a.klaviyo.com, account-d.docusign.com, account.docusign.com, account.mapbox.com, actions.zapier.com, admin.explorium.ai, admin.typeform.com, aeroapi.flightaware.com, ahrefs.com, ai-gateway.vercel.sh, aistudio.google.com, amplitude.com, analytics.eu.amplitude.com, analyticsadmin.googleapis.com, analyticsdata.googleapis.com, api-cloud.browserstack.com, api-dashboard.search.brave.com, api-inference.huggingface.co, api-ipv4.porkbun.com, api.adzuna.com, api.agentmail.to, api.agora.io, api.ahrefs.com, api.airtable.com, api.amadeus.com, api.anthropic.com, api.apify.com, api.apollo.io, api.ashbyhq.com, api.atlascloud.ai, api.atlassian.com, api.attio.com, api.aviationstack.com, api.axiom.co, api.bfl.ai, api.bitrefill.com, api.bland.ai, api.box.com, api.brevo.com, api.brex.com, api.brightdata.com, api.browser-use.com, api.browserbase.com, api.browserstack.com, api.bubblemaps.io, api.buffer.com, api.bufferapp.com, api.builtwith.com, api.cal.com

Source & flagged code

22 flagged · loading source
doctor-LOMSVTSN.jsView file
4718patternName = stripe_live_secret severity = critical line = 4718 matchedText = "FAL_TOK...eLo"
Critical
Critical Secret

Package contains a critical-looking secret pattern.

doctor-LOMSVTSN.jsView on unpkg · L4718
4718patternName = stripe_live_secret severity = critical line = 4718 matchedText = "FAL_TOK...eLo"
Critical
Secret Pattern

Stripe live secret key in doctor-LOMSVTSN.js

doctor-LOMSVTSN.jsView on unpkg · L4718
4839patternName = github_oauth severity = critical line = 4839 matchedText = "GH_TOKE...f0",
Critical
Secret Pattern

GitHub OAuth access token in doctor-LOMSVTSN.js

doctor-LOMSVTSN.jsView on unpkg · L4839
4840patternName = github_oauth severity = critical line = 4840 matchedText = "GITHUB_...f0",
Critical
Secret Pattern

GitHub OAuth access token in doctor-LOMSVTSN.js

doctor-LOMSVTSN.jsView on unpkg · L4840
4841patternName = github_oauth severity = critical line = 4841 matchedText = "GITHUB_...Of0"
Critical
Secret Pattern

GitHub OAuth access token in doctor-LOMSVTSN.js

doctor-LOMSVTSN.jsView on unpkg · L4841
5757patternName = supabase_service_key severity = critical line = 5757 matchedText = "MONDAY_...oc",
Critical
Secret Pattern

Supabase service role key (JWT) in doctor-LOMSVTSN.js

doctor-LOMSVTSN.jsView on unpkg · L5757
5758patternName = supabase_service_key severity = critical line = 5758 matchedText = "MONDAY_...Loc"
Critical
Secret Pattern

Supabase service role key (JWT) in doctor-LOMSVTSN.js

doctor-LOMSVTSN.jsView on unpkg · L5758
6520patternName = sendgrid_api_key severity = critical line = 6520 matchedText = "SENDGRI...oca"
Critical
Secret Pattern

SendGrid API key in doctor-LOMSVTSN.js

doctor-LOMSVTSN.jsView on unpkg · L6520
6623patternName = slack_bot_token severity = critical line = 6623 matchedText = "SLACK_A...af",
Critical
Secret Pattern

Slack bot token in doctor-LOMSVTSN.js

doctor-LOMSVTSN.jsView on unpkg · L6623
6624patternName = slack_bot_token severity = critical line = 6624 matchedText = "SLACK_T...Saf"
Critical
Secret Pattern

Slack bot token in doctor-LOMSVTSN.js

doctor-LOMSVTSN.jsView on unpkg · L6624
6650patternName = supabase_service_key severity = critical line = 6650 matchedText = "SLOCK_A...ff",
Critical
Secret Pattern

Supabase service role key (JWT) in doctor-LOMSVTSN.js

doctor-LOMSVTSN.jsView on unpkg · L6650
6652patternName = supabase_service_key severity = critical line = 6652 matchedText = "SLOCK_T...0ff"
Critical
Secret Pattern

Supabase service role key (JWT) in doctor-LOMSVTSN.js

doctor-LOMSVTSN.jsView on unpkg · L6652
6818patternName = stripe_live_secret severity = critical line = 6818 matchedText = "STRIPE_...ff",
Critical
Secret Pattern

Stripe live secret key in doctor-LOMSVTSN.js

doctor-LOMSVTSN.jsView on unpkg · L6818
6819patternName = stripe_live_secret severity = critical line = 6819 matchedText = "STRIPE_...off"
Critical
Secret Pattern

Stripe live secret key in doctor-LOMSVTSN.js

doctor-LOMSVTSN.jsView on unpkg · L6819
7001patternName = supabase_service_key severity = critical line = 7001 matchedText = "TWENTY_...eLo"
Critical
Secret Pattern

Supabase service role key (JWT) in doctor-LOMSVTSN.js

doctor-LOMSVTSN.jsView on unpkg · L7001
7127patternName = stripe_live_secret severity = critical line = 7127 matchedText = "WORKOS_...fee"
Critical
Secret Pattern

Stripe live secret key in doctor-LOMSVTSN.js

doctor-LOMSVTSN.jsView on unpkg · L7127
4288patternName = stripe_test_secret severity = high line = 4288 matchedText = "CLERK_T...eSa"
High
Secret Pattern

Stripe test secret key in doctor-LOMSVTSN.js

doctor-LOMSVTSN.jsView on unpkg · L4288
4825patternName = google_api_key severity = high line = 4825 matchedText = "GEMINI_...ffe"
High
Secret Pattern

Google API key in doctor-LOMSVTSN.js

doctor-LOMSVTSN.jsView on unpkg · L4825
esm-SRH3OR6L.jsView file
127break; L128: baggage[keyPair.key] = keyPair.metadata ? { value: keyPair.value, metadata: keyPair.metadata } : { value: keyPair.value }; L129: count2++; ... L378: function getNumberFromEnv(key) { L379: const raw = process.env[key]; L380: if (raw == null || raw.trim() === "") { ... L4436: for (let i = 0; i < namespace.length; i++) { L4437: hash = (hash << 5) - hash + namespace.charCodeAt(i); L4438: hash |= 0; ... L4697: let m; L4698: return typeof document !== "undefined" && document.documentElement && document.documentElement.style && document.documentElement.style.WebkitAppearance || // Is firebug? http://sta... L4699: typeof window !== "undefined" && window.console && (window.console.firebug || window.console.exception && window.console.table) || // Is firefox >= v31?
Medium
Install Persistence

Source writes installer persistence such as shell profile or service configuration.

esm-SRH3OR6L.jsView on unpkg · L127
24683patternName = generic_password severity = medium line = 24683 matchedText = newUrl.p...d%";
Medium
Secret Pattern

Hardcoded password in esm-SRH3OR6L.js

esm-SRH3OR6L.jsView on unpkg · L24683
index.jsView file
122}; L123: const bypassSecret = process.env.VERCEL_AUTOMATION_BYPASS_SECRET; L124: if (bypassSecret) { ... L129: async function requestDeviceCode(apiUrl) { L130: const response = await fetch(`${apiUrl}/api/cli/auth/device`, { L131: method: "POST", L132: headers: buildHeaders(), L133: body: JSON.stringify({}) L134: }); ... L140: } L141: return response.json(); L142: }
High
Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

index.jsView on unpkg · L122
generate-U2GRXN4E.jsView file
•matchType = previous_version_dangerous_delta matchedPackage = @vm0/cli@9.230.3 matchedIdentity = npm:QHZtMC9jbGk:9.230.3 similarity = 0.958 summary = stored previous version shares package body but lacks this dangerous source file
High
Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

generate-U2GRXN4E.jsView on unpkg

Findings

16 Critical4 High5 Medium5 Low
CriticalCritical Secretdoctor-LOMSVTSN.js
CriticalSecret Patterndoctor-LOMSVTSN.js
CriticalSecret Patterndoctor-LOMSVTSN.js
CriticalSecret Patterndoctor-LOMSVTSN.js
CriticalSecret Patterndoctor-LOMSVTSN.js
CriticalSecret Patterndoctor-LOMSVTSN.js
CriticalSecret Patterndoctor-LOMSVTSN.js
CriticalSecret Patterndoctor-LOMSVTSN.js
CriticalSecret Patterndoctor-LOMSVTSN.js
CriticalSecret Patterndoctor-LOMSVTSN.js
CriticalSecret Patterndoctor-LOMSVTSN.js
CriticalSecret Patterndoctor-LOMSVTSN.js
CriticalSecret Patterndoctor-LOMSVTSN.js
CriticalSecret Patterndoctor-LOMSVTSN.js
CriticalSecret Patterndoctor-LOMSVTSN.js
CriticalSecret Patterndoctor-LOMSVTSN.js
HighSandbox Evasion Gated Capabilityindex.js
HighPrevious Version Dangerous Deltagenerate-U2GRXN4E.js
HighSecret Patterndoctor-LOMSVTSN.js
HighSecret Patterndoctor-LOMSVTSN.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistenceesm-SRH3OR6L.js
MediumStructural Risk Force Deep Review
MediumSecret Patternesm-SRH3OR6L.js
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
LowNo License