registry  /  @webhook-co/cli  /  0.4.0

@webhook-co/cli@0.4.0

⚠ Under review

Capture, inspect, and replay webhooks from your terminal — the webhook.co CLI (wbhk).

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetwork
Supply chain
HighEntropyStringsMinifiedObfuscatedTelemetryUrlStrings
ManifestNo manifest risk signals triggered.
scanned 1 file(s), 693 KB of source, external domains: 127.0.0.1, api.ebay.com, api.github.com, api.sandbox.ebay.com, api.webhook.co, app.webhook.co, auth.webhook.co, ctfe.sigstore.dev, developer.constantcontact.com, fulcio.sigstore.dev, github.com, json-schema.org, log2025-1.rekor.sigstore.dev, rekor.sigstore.dev, telemetry.wbhk.my, timestamp.sigstore.dev, token.actions.githubusercontent.com

Source & flagged code

6 flagged · loading source
dist/bin.jsView file
1#!/usr/bin/env node L2: import{createRequire as _F}from"node:module";var IF=Object.create;var{getPrototypeOf:PF,defineProperty:a0,getOwnPropertyNames:pW,getOwnPropertyDescriptor:DF}=Object,rW=Object.proto... L3: `).forEach((X)=>{if(X.match(Nk)||X.match(Fk))return;Q+=X}),Buffer.from(Q,"base64")}function Ak($,Q="CERTIFICATE"){let J=$.toString("base64").match(/.{1,64}/g)||"";return[`-----BEGI... ... L7: `,fy=/\u2014 (\S+) (\S+)\n/g;function my($,Q){let X=$.inclusionProof,J=vW.fromString(X.checkpoint.envelope),U=wX.fromString(J.note);if(!ny(J,Q))throw new _8.VerificationError({code... L8: `);if(Q.length<3)throw new _8.VerificationError({code:"TLOG_INCLUSION_PROOF_ERROR",message:"too few lines in checkpoint header"});let X=Q[0],J=BigInt(Q[1]),U=Buffer.from(Q[2],"base... L9: `).join(` ... L11: `)}function ah($){if($)process.env.DEBUG=$;else delete process.env.DEBUG}function sh(){return process.env.DEBUG}function eh($){$.inspectOpts={};let Q=Object.keys(fL.inspectOpts);fo... L12: `).map((Q)=>Q.trim()).join(" ")};gL.O=function($){return this.inspectOpts.colors=this.useColors,RX.inspect($,this.inspectOpts)}});var _W=S((G1$,wW)=>{if(typeof process>"u"||process... L13: `).join(`\r ... L39
Critical
Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/bin.jsView on unpkg · L1
27Trigger-reachable chain: manifest.bin -> dist/bin.js L27: `:`${H} L28: `),Z)return Z(V);return c$.CommandRunError}return c$.Success}var QQ=Symbol("RouteMap"),m8=Symbol("Command");function zz($,Q,X){let J=[...X],U=[],G,Y=$,Z,q=!0,W=!1,V=!1;return{next:... L29: `:`${v} ... L39: `)+` L40: `},getDefaultCommand:()=>{return Y},getOtherAliasesForInput:(q,W)=>{if(Q){if(q===Q)return{original:[""],"convert-camel-to-kebab":[""]};if(q==="")return{original:[Q],"convert-camel-... L41: `)}var S1=($)=>(Q,X,J,U)=>{let G=J?{...J,async:!1}:{async:!1},Y=Q._zod.run({value:X,issues:[]},G);if(Y instanceof Promise)throw new j4;if(Y.issues.length){let Z=new(U?.Err??$)(Y.is... L42: `).filter((G)=>G),J=Math.min(...X.map((G)=>G.length-G.trimStart().length)),U=X.map((G)=>G.slice(J)).map((G)=>" ".repeat(this.indent*2)+G);for(let G of U)this.content.push(G)}compil... L43: `))}}var I5={major:4,minor:4,patch:3};var d=B("$ZodType",($,Q)=>{var X;$??($={}),$._zod.def=Q,$._zod.bag=$._zod.bag||{},$._zod.version=I5;let J=[...$._zod.def.checks??[]];if($._zod... L44: if (${T}.issues.length) {
Critical
Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/bin.jsView on unpkg · L27
313scopes: ${F} L314: `)},parameters:{flags:{...N$}},docs:{brief:"show the authenticated org, scopes, and key handle"}});var DC=j$({routes:{list:BK,get:IK,create:LK,delete:FK,rotate:OK,update:NK,reveal:... L315: `).some((X)=>X.indexOf("(https.js:")!==-1||X.indexOf("node:https:")!==-1)}incrementSockets($){if(this.maxSockets===1/0&&this.maxTotalSockets===1/0)return null;if(!this.sockets[$])t...
High
Child Process

Package source references child process execution.

dist/bin.jsView on unpkg · L313
39`)+` L40: `},getDefaultCommand:()=>{return Y},getOtherAliasesForInput:(q,W)=>{if(Q){if(q===Q)return{original:[""],"convert-camel-to-kebab":[""]};if(q==="")return{original:[Q],"convert-camel-... L41: `)}var S1=($)=>(Q,X,J,U)=>{let G=J?{...J,async:!1}:{async:!1},Y=Q._zod.run({value:X,issues:[]},G);if(Y instanceof Promise)throw new j4;if(Y.issues.length){let Z=new(U?.Err??$)(Y.is...
High
Eval

Package source references dynamic code evaluation.

dist/bin.jsView on unpkg · L39
298`+(U?"opt out anytime: `wbhk telemetry off` (or set WBHK_TELEMETRY=0 / DO_NOT_TRACK=1).\n":"enable with `wbhk telemetry on`.\n"))},parameters:{flags:{...N$}},docs:{brief:"show whet... L299: `).map((Y)=>/^([0-9a-fA-F]+)\s+\*?(.+?)\s*$/.exec(Y.trim())).find((Y)=>Y!==null&&Y[2]===X);if(J===null||J===void 0)throw Error(`no checksum entry for ${X} — refusing to upgrade`);l... L300: `:`${Z.join(` ... L305: `:`${Dv(U,J)} L306: `)},parameters:{flags:{...b}},docs:{brief:"show the org's metering usage for the current billing period"}});var ZI=k({async func($){let Q=await H0(this,$);p$(this,Q);let X=await th... L307: `);return}let F=Z.scopes.length>0?Z.scopes.map((y)=>x(y)).join(", "):"(none)",O=Z.userId!==void 0?`user: ${x(Z.userId)} ... L313: scopes: ${F} L314: `)},parameters:{flags:{...N$}},docs:{brief:"show the authenticated org, scopes, and key handle"}});var DC=j$({routes:{list:BK,get:IK,create:LK,delete:FK,rotate:OK,update:NK,reveal:... L315: `).some((X)=>X.indexOf("(https.js:")!==-1||X.indexOf("node:https:")!==-1)}incrementSockets($){if(this.maxSockets===1/0&&this.maxTotalSockets===1/0)return null;if(!this.sockets[$])t...
High
Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/bin.jsView on unpkg · L298
27`:`${H} L28: `),Z)return Z(V);return c$.CommandRunError}return c$.Success}var QQ=Symbol("RouteMap"),m8=Symbol("Command");function zz($,Q,X){let J=[...X],U=[],G,Y=$,Z,q=!0,W=!1,V=!1;return{next:... L29: `:`${v} ... L39: `)+` L40: `},getDefaultCommand:()=>{return Y},getOtherAliasesForInput:(q,W)=>{if(Q){if(q===Q)return{original:[""],"convert-camel-to-kebab":[""]};if(q==="")return{original:[Q],"convert-camel-... L41: `)}var S1=($)=>(Q,X,J,U)=>{let G=J?{...J,async:!1}:{async:!1},Y=Q._zod.run({value:X,issues:[]},G);if(Y instanceof Promise)throw new j4;if(Y.issues.length){let Z=new(U?.Err??$)(Y.is... L42: `).filter((G)=>G),J=Math.min(...X.map((G)=>G.length-G.trimStart().length)),U=X.map((G)=>G.slice(J)).map((G)=>" ".repeat(this.indent*2)+G);for(let G of U)this.content.push(G)}compil... L43: `))}}var I5={major:4,minor:4,patch:3};var d=B("$ZodType",($,Q)=>{var X;$??($={}),$._zod.def=Q,$._zod.bag=$._zod.bag||{},$._zod.version=I5;let J=[...$._zod.def.checks??[]];if($._zod... L44: if (${T}.issues.length) {
High
Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/bin.jsView on unpkg · L27

Findings

2 Critical5 High3 Medium4 Low
CriticalRemote Asset Decode Executedist/bin.js
CriticalTrigger Reachable Dangerous Capabilitydist/bin.js
HighChild Processdist/bin.js
HighEvaldist/bin.js
HighSame File Env Network Executiondist/bin.js
HighCommand Output Exfiltrationdist/bin.js
HighObfuscated
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings