registry / @whatalo/cli / 1.2.2

@whatalo/cli@1.2.2

Official CLI for Whatalo development — plugins, themes, and more

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 8 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 105 KB of source, external domains: app.whatalo.com, developers.whatalo.com, nodejs.org, pnpm.io, registry.npmjs.org

Source & flagged code

1 flagged

dist/index.mjsView file

Lines 15-55javascript

16// src/commands/login.ts

17import open from "open";

18import {

19 getSession,

20 isSessionValid,

21 saveSession,

22 requestDeviceCode,

23 pollForToken,

24 POLL_STATUS

25} from "@whatalo/cli-kit/session";

26import {

27 banner,

28 success,

29 error,

30 info,

31 link,

32 createSpinner

33} from "@whatalo/cli-kit/output";

34import { readConfig } from "@whatalo/cli-kit/config";

35function getPortalUrl(optionUrl, configUrl) {

36 const raw = optionUrl?.trim() || configUrl?.trim() || process.env.WHATALO_DEVELOPER_PORTAL_URL?.trim() || "https://developers.whatalo.com";

37 return raw.endsWith("/") ? raw.slice(0, -1) : raw;

38}

39function loginCommand(program2) {

40 program2.command("login").description("Authenticate with the Whatalo Developer Portal").option("--portal-url <url>", "Developer Portal base URL").option("--force", "Force re-authentication even if already logged in").action(async (options) => {

41 let configPortalUrl;

42 try {

43 const config = await readConfig(process.cwd());

44 configPortalUrl = config.dev.portal_url;

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.mjsView on unpkg · L35

45 } catch {

46 }

47 const portalUrl = getPortalUrl(options.portalUrl, configPortalUrl);

48 if (!options.force) {

49 const existing = await getSession();

50 if (existing && isSessionValid(existing)) {

51 info(

52 `Already logged in as ${existing.email}. Use --force to re-authenticate.`

53 );

54 return;

55 }

Source & flagged code

1 flagged · loading source

dist/index.mjsView file

35function getPortalUrl(optionUrl, configUrl) { L36: const raw = optionUrl?.trim() || configUrl?.trim() || process.env.WHATALO_DEVELOPER_PORTAL_URL?.trim() || "https://developers.whatalo.com"; L37: return raw.endsWith("/") ? raw.slice(0, -1) : raw; ... L42: try { L43: const config = await readConfig(process.cwd()); L44: configPortalUrl = config.dev.portal_url; ... L131: headers: { "Content-Type": "application/json" }, L132: body: JSON.stringify({ refreshToken: session.refreshToken }), L133: signal: AbortSignal.timeout(5e3) ... L192: } L193: const profile = await res.json(); L194: const expiresAt = new Date(session.expiresAt);

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.mjsView on unpkg · L35

Findings

1 High3 Medium4 Low

HighSandbox Evasion Gated Capabilitydist/index.mjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

1 flagged

dist/index.mjsView file

Lines 15-55javascript

16// src/commands/login.ts

17import open from "open";

18import {

19 getSession,

20 isSessionValid,

21 saveSession,

22 requestDeviceCode,

23 pollForToken,

24 POLL_STATUS

25} from "@whatalo/cli-kit/session";

26import {

27 banner,

28 success,

29 error,

30 info,

31 link,

32 createSpinner

33} from "@whatalo/cli-kit/output";

34import { readConfig } from "@whatalo/cli-kit/config";

35function getPortalUrl(optionUrl, configUrl) {

36 const raw = optionUrl?.trim() || configUrl?.trim() || process.env.WHATALO_DEVELOPER_PORTAL_URL?.trim() || "https://developers.whatalo.com";

37 return raw.endsWith("/") ? raw.slice(0, -1) : raw;

38}

39function loginCommand(program2) {

41 let configPortalUrl;

42 try {

43 const config = await readConfig(process.cwd());

44 configPortalUrl = config.dev.portal_url;

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.mjsView on unpkg · L35

45 } catch {

46 }

47 const portalUrl = getPortalUrl(options.portalUrl, configPortalUrl);

48 if (!options.force) {

49 const existing = await getSession();

50 if (existing && isSessionValid(existing)) {

51 info(

52 `Already logged in as ${existing.email}. Use --force to re-authenticate.`

53 );

54 return;

55 }