registry / @vm0/cli / 9.243.0

@vm0/cli@9.243.0

Zero command-line interface for vm0

Static Scan Results

scanned 4h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 63 file(s), 6.48 MB of source, external domains: account.mapbox.com, admin.explorium.ai, admin.typeform.com, ahrefs.com, ai-gateway.vercel.sh, aistudio.google.com, api-dashboard.search.brave.com, api.accounts.nintendo.com, api.anthropic.com, api.atlascloud.ai, api.brex.com, api.builtwith.com, api.deepseek.com, api.github.com, api.imgur.com, api.minimax.io, api.moonshot.ai, api.nyne.ai, api.openai.com, api.podchaser.com, api.slack.com, api.together.ai, api.vm0.ai, api.z.ai, api.zeptomail.com, app.apollo.io, app.attio.com, app.axiom.co, app.bland.ai, app.brevo.com, app.cal.com, app.chatwoot.com, app.clickup.com, app.daytona.io, app.deel.com, app.diffbot.com, app.duffel.com, app.getzep.com, app.gumroad.com, app.heygen.com, app.honcho.dev, app.hume.ai, app.infisical.com, app.instantly.ai, app.intercom.com, app.intercom.io, app.loops.so, app.lp1.znma.srv.nintendo.net, app.mem0.ai, app.netdata.cloud

Source & flagged code

3 flagged

esm-SRH3OR6L.jsView file

24683patternName = generic_password severity = medium line = 24683 matchedText = newUrl.p...d%";

Medium

Secret Pattern

Package contains a possible secret pattern.

esm-SRH3OR6L.jsView on unpkg · L24683

127break; L128: baggage[keyPair.key] = keyPair.metadata ? { value: keyPair.value, metadata: keyPair.metadata } : { value: keyPair.value }; L129: count2++; ... L378: function getNumberFromEnv(key) { L379: const raw = process.env[key]; L380: if (raw == null || raw.trim() === "") { ... L4436: for (let i = 0; i < namespace.length; i++) { L4437: hash = (hash << 5) - hash + namespace.charCodeAt(i); L4438: hash |= 0; ... L4697: let m; L4698: return typeof document !== "undefined" && document.documentElement && document.documentElement.style && document.documentElement.style.WebkitAppearance || // Is firebug? http://sta... L4699: typeof window !== "undefined" && window.console && (window.console.firebug || window.console.exception && window.console.table) || // Is firefox >= v31?

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

esm-SRH3OR6L.jsView on unpkg · L127

index.jsView file

Lines 99-139javascript

99} from "./chunk-B3W2RUBP.js";

100import {

101 __toESM,

102 init_esm_shims

103} from "./chunk-DIRAZ3YX.js";

104

105// src/index.ts

106init_esm_shims();

107

108// src/commands/auth/index.ts

109init_esm_shims();

110

111// src/commands/auth/login.ts

112init_esm_shims();

113

114// src/lib/api/auth.ts

115init_esm_shims();

116function buildHeaders() {

117 const headers = {

118 "Content-Type": "application/json"

119 };

120 const bypassSecret = process.env.VERCEL_AUTOMATION_BYPASS_SECRET;

121 if (bypassSecret) {

122 headers["x-vercel-protection-bypass"] = bypassSecret;

123 }

124 return headers;

125}

126async function requestDeviceCode(apiUrl) {

127 const response = await fetch(`${apiUrl}/api/cli/auth/device`, {

128 method: "POST",

129 headers: headersWithCliClientHeaders(buildHeaders()),

130 body: JSON.stringify({})

131 });

132 if (!response.ok) {

133 if (response.status === 403) {

134 throw new Error("An unexpected network issue occurred");

135 }

136 throw new Error(`Failed to request device code: ${response.statusText}`);

137 }

138 return response.json();

139}

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

index.jsView on unpkg · L119

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code