registry / @volter-ai/portable.dev / 3.2.1

@volter-ai/portable.dev@3.2.1

Portable — local-first launcher / tunnel-router (installable CLI)

Static Scan Results

scanned 11d ago · by rust-scanner

Static analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 389 KB of source, external domains: accounts.google.com, api.apify.com, api.fly.io, api.github.com, api.slack.com, app.portable-dev.com, app.portable.dev, bun.sh, cdn.simpleicons.org, claude.com, console.apify.com, console.aws.amazon.com, developers.cloudflare.com, developers.google.com, docs.apify.com, docs.github.com, fly.io, github.com, modal.com, modal.portable-dev.com, modal.portable.dev, oauth2.googleapis.com, playwright.dev, portable-dev.com, portable.dev, slack.com, www.googleapis.com

Oversized source lightweight scan

server.js29.2 MB file, sampled 256 KB

FilesystemNetworkChildProcessEnvironmentVarsCryptoShellHighEntropyStringsUrlStringsaccounts.google.comapi.apify.comapi.fly.ioapi.github.comapi.slack.comapp.portable-dev.comapp.portable.devcdn.simpleicons.orgconsole.apify.comconsole.aws.amazon.comdevelopers.google.comdocs.apify.comdocs.github.comfly.iogithub.commodal.commodal.portable-dev.commodal.portable.devoauth2.googleapis.complaywright.devportable-dev.comportable.devslack.comwww.googleapis.com

Source & flagged code

3 flagged

cli.jsView file

Lines 1-39javascript

1#!/usr/bin/env bun

2// @bun

3var __require = import.meta.require;

5// packages/launcher/src/cli.ts

6import fs11 from "fs";

7import os8 from "os";

8import path11 from "path";

10// packages/shared/src/secrets/LocalSecretStore.ts

11import crypto from "crypto";

12import fs from "fs";

13import os from "os";

14import path from "path";

15var ALGO = "aes-256-gcm";

16var KEY_BYTES = 32;

17var IV_BYTES = 12;

18var ENVELOPE_PREFIX = "v1";

19function resolveDataDir(override) {

20 const fromEnv = override || process.env.PORTABLE_DATA_DIR || process.env.DATA_DIR || (process.env.XDG_DATA_HOME ? path.join(process.env.XDG_DATA_HOME, "portable") : undefined) || path.join(os.homedir(), ".portable");

21 if (fromEnv.startsWith("~")) {

22 return path.join(os.homedir(), fromEnv.slice(1));

23 }

24 return fromEnv;

25}

26function encryptValue(plaintext, key) {

27 if (key.length !== KEY_BYTES) {

28 throw new Error(`LocalSecretStore: key must be ${KEY_BYTES} bytes, got ${key.length}`);

29 }

30 const iv = crypto.randomBytes(IV_BYTES);

31 const cipher = crypto.createCipheriv(ALGO, key, iv);

32 const ciphertext = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);

33 const tag = cipher.getAuthTag();

34 return [

35 ENVELOPE_PREFIX,

36 iv.toString("base64"),

37 tag.toString("base64"),

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

cli.jsView on unpkg · L19

38 ciphertext.toString("base64")

39 ].join(":");

server.jsView file

•path = server.js kind = oversized_source_file sizeBytes = 30594069 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

server.jsView on unpkg

package.jsonView file

•scripts registry_only=start

Critical

Manifest Confusion

Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.

package.jsonView on unpkg

Source & flagged code

3 flagged · loading source

cli.jsView file

19function resolveDataDir(override) { L20: const fromEnv = override || process.env.PORTABLE_DATA_DIR || process.env.DATA_DIR || (process.env.XDG_DATA_HOME ? path.join(process.env.XDG_DATA_HOME, "portable") : undefined) || p... L21: if (fromEnv.startsWith("~")) { ... L35: ENVELOPE_PREFIX, L36: iv.toString("base64"), L37: tag.toString("base64"), ... L183: }; L184: this.write(next); L185: return next; ... L234: var LOCAL_BIND_HOST = "127.0.0.1"; L235: var DEFAULT_RELAY_BASE_URL = "https://app.portable.dev"; L236: var DEV_RELAY_BASE_URL = "https://app.portable-dev.com";

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

cli.jsView on unpkg · L19

server.jsView file

•path = server.js kind = oversized_source_file sizeBytes = 30594069 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

server.jsView on unpkg

package.jsonView file

•scripts registry_only=start

Critical

Manifest Confusion

Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.

package.jsonView on unpkg

Findings

1 Critical2 High3 Medium3 Low

CriticalManifest Confusionpackage.json

HighSandbox Evasion Gated Capabilitycli.js

HighOversized Source Fileserver.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

cli.jsView file

Lines 1-39javascript

1#!/usr/bin/env bun

2// @bun

3var __require = import.meta.require;

5// packages/launcher/src/cli.ts

6import fs11 from "fs";

7import os8 from "os";

8import path11 from "path";

10// packages/shared/src/secrets/LocalSecretStore.ts

11import crypto from "crypto";

12import fs from "fs";

13import os from "os";

14import path from "path";

15var ALGO = "aes-256-gcm";

16var KEY_BYTES = 32;

17var IV_BYTES = 12;

18var ENVELOPE_PREFIX = "v1";

19function resolveDataDir(override) {

21 if (fromEnv.startsWith("~")) {

22 return path.join(os.homedir(), fromEnv.slice(1));

23 }

24 return fromEnv;

25}

26function encryptValue(plaintext, key) {

27 if (key.length !== KEY_BYTES) {

28 throw new Error(`LocalSecretStore: key must be ${KEY_BYTES} bytes, got ${key.length}`);

29 }

30 const iv = crypto.randomBytes(IV_BYTES);

31 const cipher = crypto.createCipheriv(ALGO, key, iv);

32 const ciphertext = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);

33 const tag = cipher.getAuthTag();

34 return [

35 ENVELOPE_PREFIX,

36 iv.toString("base64"),

37 tag.toString("base64"),

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

cli.jsView on unpkg · L19

38 ciphertext.toString("base64")

39 ].join(":");

server.jsView file

•path = server.js kind = oversized_source_file sizeBytes = 30594069 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

server.jsView on unpkg

package.jsonView file

•scripts registry_only=start

Critical

Manifest Confusion

Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.

package.jsonView on unpkg