registry / @weactive8/8contentpro / 0.1.4

@weactive8/8contentpro@0.1.4

ICP-driven content marketing as a CLI. Runs the WeActive8 Blog Protocol on your own Claude (BYOC).

Static Scan Results

scanned 6h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 33 file(s), 217 KB of source, external domains: 8contentpro.com, 8cp-upload.wa8.us, 8cp.wa8.us, api.sapling.ai, go.timesolv.com, weactive8.com, yourcompany.com

Source & flagged code

3 flagged

dist/ink/App.jsView file

Lines 1-26javascript

1import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";

2import { useState, useEffect, useRef } from "react";

3import { Box, Text, useApp, useInput } from "ink";

4import { homedir } from "node:os";

5import { join } from "node:path";

6import { mkdirSync } from "node:fs";

7import { exec } from "node:child_process";

8import { InputBox, Menu, Spinner, StatusBar, Header, Picker } from "./components.js";

High

Child Process

Package source references child process execution.

dist/ink/App.jsView on unpkg · L6

9import { theme } from "./theme.js";

10import { loadProfile, saveProfile, getAccount } from "../store.js";

11import { QUESTIONS, synthesizeProfile, summarizeAttachment, tuneSitemap, tunePersonas, tuneServices, tuneVoice } from "../onboarding/setup.js";

12import { isProfileComplete } from "../onboarding/schema.js";

13import { generateArticle, generateGuide, reviseArticle, AI_THRESHOLD, MAX_REVISES } from "../pipeline.js";

14import { ideate, targetedBrief } from "../plan/targeting.js";

15import { keywordContext, strikingDistanceFor, gscPropertyFor, gscRegister, gscVerify, GSC_SERVICE_ACCOUNT } from "../intel.js";

16import { createUploadSession, openBrowser, pollUploadStatus } from "../attach.js";

17import { checkForUpdate, versionLine } from "../update.js";

18import { BUILD } from "../build-info.js";

19import { loadTopics, addTopics, markUsed } from "../topics.js";

20import { loadBrand, saveBrand } from "../brand.js";

21import { buildBrand } from "../brandgen.js";

22const HINT_MENU = "↑↓ move · Enter select · Ctrl+C quit";

23const HINT_INPUT = "type your answer · Enter to submit · / for commands · Esc to go back";

24const HINT_SETUP = "type your answer + Enter · / for commands · Esc to go back";

25const HINT_WORK = "working… · Esc to interrupt";

26const COMMANDS = [

dist/attach.jsView file

Lines 1-21javascript

1import { exec } from "node:child_process";

2import { startSpinner, updateSpinner, stopSpinner } from "./ui/spinner.js";

3/**

4 * Attach a file for context — the privacy-preserving way. The CLI never reads the

5 * user's disk. Instead it opens a browser to the WeActive8 upload page, the user

6 * chooses a file, and it comes back as an https URL that Claude fetches during

7 * generation. See server/upload.mjs (https://8cp-upload.wa8.us).

8 */

9const

Source & flagged code

3 flagged · loading source

dist/ink/App.jsView file

6import { mkdirSync } from "node:fs"; L7: import { exec } from "node:child_process"; L8: import { InputBox, Menu, Spinner, StatusBar, Header, Picker } from "./components.js";

High

Child Process

Package source references child process execution.

dist/ink/App.jsView on unpkg · L6

dist/attach.jsView file

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/attach.jsView on unpkg · L1

1import { exec } from "node:child_process"; L2: import { startSpinner, updateSpinner, stopSpinner } from "./ui/spinner.js"; ... L6: * chooses a file, and it comes back as an https URL that Claude fetches during L7: * generation. See server/upload.mjs (https://8cp-upload.wa8.us). L8: */ L9: const UPLOAD_BASE = process.env.CONTENTPRO_UPLOAD_URL?.trim() || "https://8cp-upload.wa8.us"; L10: export function openBrowser(url) { L11: const cmd = process.platform === "darwin" ? "open" : process.platform === "win32" ? 'start ""' : "xdg-open"; L12: exec(`${cmd} "${url}"`, () => { }); // best-effort; the URL is also printed for manual open ... L19: return null; L20: return (await res.json()); L21: }

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/attach.jsView on unpkg · L1

Findings

4 High3 Medium5 Low

HighChild Processdist/ink/App.js

HighShell

HighSame File Env Network Executiondist/attach.js

HighSandbox Evasion Gated Capabilitydist/attach.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License