registry / @vonzio/cli / 0.2.0

@vonzio/cli@0.2.0

Terminal client for Vonzio — device-flow auth to any instance, run agents, resume and continue workspace chats.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 120 KB of source, external domains: app.vonz.io, registry.npmjs.org

Source & flagged code

4 flagged

dist/index.jsView file

Lines 1-35javascript

1#!/usr/bin/env node

3// src/index.ts

4import { createRequire } from "module";

5import { spawnSync } from "child_process";

6import { Command } from "commander";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L4

8// src/brand.ts

9import chalk from "chalk";

10var SODIUM = "#FF5722";

11function wordmark() {

12 return `v${chalk.hex(SODIUM)("o")}nzio`;

13}

15// src/update-notifier.ts

16import { spawn } from "child_process";

18// src/config.ts

19import { homedir } from "os";

20import { join } from "path";

21import { mkdirSync, readFileSync, writeFileSync, chmodSync } from "fs";

22var DEFAULT_BASE_URL = "https://app.vonz.io";

23function configDir() {

24 const xdg = process.env.XDG_CONFIG_HOME;

25 return xdg ? join(xdg, "vonzio") : join(homedir(), ".config", "vonzio");

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L15

26}

27function configPath() {

28 return join(configDir(), "config.json");

29}

30function loadConfig() {

31 try {

32 const c = JSON.parse(readFileSync(configPath(), "utf8"));

33 return { currentInstance: c.currentInstance ?? "default", instances: c.instances ?? {}, update: c.update };

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L4

34 } catch {

35 return { currentInstance: "default", instances: {} };

Lines 110-150javascript

110 const data = await res.json();

111 return data.version ?? null;

112 } catch {

113 return null;

114 }

115}

116async function runUpdateCheck() {

Source & flagged code

4 flagged · loading source

dist/index.jsView file

4import { createRequire } from "module"; L5: import { spawnSync } from "child_process"; L6: import { Command } from "commander";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L4

15// src/update-notifier.ts L16: import { spawn } from "child_process"; L17: ... L21: import { mkdirSync, readFileSync, writeFileSync, chmodSync } from "fs"; L22: var DEFAULT_BASE_URL = "https://app.vonz.io"; L23: function configDir() { L24: const xdg = process.env.XDG_CONFIG_HOME; L25: return xdg ? join(xdg, "vonzio") : join(homedir(), ".config", "vonzio");

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L15

4import { createRequire } from "module"; L5: import { spawnSync } from "child_process"; L6: import { Command } from "commander"; ... L21: import { mkdirSync, readFileSync, writeFileSync, chmodSync } from "fs"; L22: var DEFAULT_BASE_URL = "https://app.vonz.io"; L23: function configDir() { L24: const xdg = process.env.XDG_CONFIG_HOME; L25: return xdg ? join(xdg, "vonzio") : join(homedir(), ".config", "vonzio"); L26: } ... L31: try { L32: const c = JSON.parse(readFileSync(configPath(), "utf8")); L33: return { currentInstance: c.currentInstance ?? "default", instances: c.instances ?? {}, update: c.update };

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L4

130process.stderr.write(` L131: \u2191 vonzio ${current} \u2192 ${latest} update: vz upgrade (or npm i -g @vonzio/cli@latest) L132: `); ... L136: try { L137: spawn(process.execPath, [entryPath, "__check-update"], { detached: true, stdio: "ignore" }).unref(); L138: } catch {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L130

Findings

5 High3 Medium5 Low

HighChild Processdist/index.js

HighShell

HighSame File Env Network Executiondist/index.js

HighSandbox Evasion Gated Capabilitydist/index.js

HighRuntime Package Installdist/index.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

dist/index.jsView file

Lines 1-35javascript

1#!/usr/bin/env node

3// src/index.ts

4import { createRequire } from "module";

5import { spawnSync } from "child_process";

6import { Command } from "commander";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L4

8// src/brand.ts

9import chalk from "chalk";

10var SODIUM = "#FF5722";

11function wordmark() {

12 return `v${chalk.hex(SODIUM)("o")}nzio`;

13}

15// src/update-notifier.ts

16import { spawn } from "child_process";

18// src/config.ts

19import { homedir } from "os";

20import { join } from "path";

21import { mkdirSync, readFileSync, writeFileSync, chmodSync } from "fs";

22var DEFAULT_BASE_URL = "https://app.vonz.io";

23function configDir() {

24 const xdg = process.env.XDG_CONFIG_HOME;

25 return xdg ? join(xdg, "vonzio") : join(homedir(), ".config", "vonzio");

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L15

26}

27function configPath() {

28 return join(configDir(), "config.json");

29}

30function loadConfig() {

31 try {

32 const c = JSON.parse(readFileSync(configPath(), "utf8"));

33 return { currentInstance: c.currentInstance ?? "default", instances: c.instances ?? {}, update: c.update };

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L4

34 } catch {

35 return { currentInstance: "default", instances: {} };

Lines 110-150javascript

110 const data = await res.json();

111 return data.version ?? null;

112 } catch {

113 return null;

114 }

115}

116async function runUpdateCheck() {