registry / @voicethere/cli / 0.3.10

@voicethere/cli@0.3.10

VoiceThere cloud CLI — login, projects, and agent bundle upload

Static Scan Results

scanned 3d ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 45 file(s), 99.7 KB of source, external domains: app.voicethere.dev

Source & flagged code

2 flagged

dist/commands/build/validate.jsView file

Lines 1-35javascript

1import { spawn } from "node:child_process";

2import { logResolvedBundle, logStep, logVerbose } from "../../lib/command-log.js";

High

Child Process

Package source references child process execution.

dist/commands/build/validate.jsView on unpkg · L1

3import { assertBundleExists, resolveBundlePathDetailed, } from "../../lib/project-config.js";

4export const DEFAULT_BUNDLE_PATH = "dist/agent.js";

5export async function runBuildValidate(options) {

6 logStep("Validating agent bundle");

7 const bundle = await resolveBundlePathDetailed(options.file);

8 if (options.logContext !== false) {

9 logResolvedBundle(bundle);

10 }

11 await assertBundleExists(bundle.absolutePath);

12 logStep("Running @voicethere/agent verify on bundle");

13 logVerbose(`verify bundle: ${bundle.absolutePath}`);

14 await spawnAgentVerify(bundle.absolutePath);

15 console.log(`Bundle validated: ${bundle.absolutePath}`);

16}

17async function spawnAgentVerify(bundlePath) {

18 return new Promise((resolve, reject) => {

19 const child = spawn("npx", ["@voicethere/agent", "verify", "--no-build", "--bundle", bundlePath], {

20 stdio: "inherit",

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/commands/build/validate.jsView on unpkg · L18

21 shell: process.platform === "win32",

22 });

23 child.on("error", (error) => {

24 reject(error);

25 });

26 child.on("close", (code) => {

27 if (code === 0) {

28 resolve();

29 return;

30 }

31 reject(new Error(`Agent verify failed with exit code ${code ?? "unknown"}`));

32 });

33 });

34}

35//# sourceMappingURL=validate.js.map

Source & flagged code

2 flagged · loading source

dist/commands/build/validate.jsView file

1import { spawn } from "node:child_process"; L2: import { logResolvedBundle, logStep, logVerbose } from "../../lib/command-log.js";

High

Child Process

Package source references child process execution.

dist/commands/build/validate.jsView on unpkg · L1

18return new Promise((resolve, reject) => { L19: const child = spawn("npx", ["@voicethere/agent", "verify", "--no-build", "--bundle", bundlePath], { L20: stdio: "inherit",

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/commands/build/validate.jsView on unpkg · L18

Findings

3 High3 Medium4 Low

HighChild Processdist/commands/build/validate.js

HighShell

HighRuntime Package Installdist/commands/build/validate.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

dist/commands/build/validate.jsView file

Lines 1-35javascript

1import { spawn } from "node:child_process";

2import { logResolvedBundle, logStep, logVerbose } from "../../lib/command-log.js";

High

Child Process

Package source references child process execution.

dist/commands/build/validate.jsView on unpkg · L1

3import { assertBundleExists, resolveBundlePathDetailed, } from "../../lib/project-config.js";

4export const DEFAULT_BUNDLE_PATH = "dist/agent.js";

5export async function runBuildValidate(options) {

6 logStep("Validating agent bundle");

7 const bundle = await resolveBundlePathDetailed(options.file);

8 if (options.logContext !== false) {

9 logResolvedBundle(bundle);

10 }

11 await assertBundleExists(bundle.absolutePath);

12 logStep("Running @voicethere/agent verify on bundle");

13 logVerbose(`verify bundle: ${bundle.absolutePath}`);

14 await spawnAgentVerify(bundle.absolutePath);

15 console.log(`Bundle validated: ${bundle.absolutePath}`);

16}

17async function spawnAgentVerify(bundlePath) {

18 return new Promise((resolve, reject) => {

19 const child = spawn("npx", ["@voicethere/agent", "verify", "--no-build", "--bundle", bundlePath], {

20 stdio: "inherit",

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/commands/build/validate.jsView on unpkg · L18

21 shell: process.platform === "win32",

22 });

23 child.on("error", (error) => {

24 reject(error);

25 });

26 child.on("close", (code) => {

27 if (code === 0) {

28 resolve();

29 return;

30 }

31 reject(new Error(`Agent verify failed with exit code ${code ?? "unknown"}`));

32 });

33 });

34}

35//# sourceMappingURL=validate.js.map