registry / @whop/cli / 0.0.5

@whop/cli@0.0.5

The Whop CLI — build and manage Whop apps from your terminal. Human and agent friendly.

Static Scan Results

scanned 18d ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNativeBindingsNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

GitDependency

scanned 5 file(s), 2.00 MB of source, external domains: api.whop.com, example.com, github.com, json-schema.org, mysite.com, raw.githubusercontent.com, whop.com

Source & flagged code

5 flagged

dist/chunk-O66TV7ZF.jsView file

26671// ../../node_modules/.pnpm/incur@https+++codeload.github.com+whopio+incur+tar.gz+ea62f88/node_modules/incur/dist/SyncMcp.js L26672: import { execFile } from "child_process"; L26673: import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";

High

Child Process

Package source references child process execution.

dist/chunk-O66TV7ZF.jsView on unpkg · L26671

29837} else if (process.platform === "win32") { L29838: execFile2("cmd.exe", ["/c", "start", "", url], ignore); L29839: } else {

High

Shell

Package source references shell execution.

dist/chunk-O66TV7ZF.jsView on unpkg · L29837

2570Cross-file remote execution chain: dist/chunk-O66TV7ZF.js spawns dist/chunk-TZPTBY4K.js; helper contains network access plus dynamic code execution. L2570: if (typeof node_buffer.Buffer === "function") { L2571: return node_buffer.Buffer.from(src, "base64"); L2572: } else if (typeof atob === "function") { ... L5175: yield* this.next(token); L5176: yield* this.end(forceDoc, endOffset); L5177: } ... L5179: *next(token) { L5180: if (node_process.env.LOG_STREAM) L5181: console.dir(token, { depth: null }); ... L7311: { L7312: url: "https://{defaultHost}", L7313: variables: {

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/chunk-O66TV7ZF.jsView on unpkg · L2570

2570if (typeof node_buffer.Buffer === "function") { L2571: return node_buffer.Buffer.from(src, "base64"); L2572: } else if (typeof atob === "function") { ... L5175: yield* this.next(token); L5176: yield* this.end(forceDoc, endOffset); L5177: } ... L5179: *next(token) { L5180: if (node_process.env.LOG_STREAM) L5181: console.dir(token, { depth: null }); ... L7311: { L7312: url: "https://{defaultHost}", L7313: variables: {

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/chunk-O66TV7ZF.jsView on unpkg · L2570

dist/chunk-TZPTBY4K.jsView file

19890if (this.opts.code.process) sourceCode = this.opts.code.process(sourceCode, sch); L19891: const validate2 = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode)(this, this.scope.get()); L19892: this.scope.value(validateName, { ref: validate2 });

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/chunk-TZPTBY4K.jsView on unpkg · L19890

Source & flagged code

5 flagged · loading source

dist/chunk-O66TV7ZF.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code