registry / @whop/cli / 0.8.0

@whop/cli@0.8.0

The Whop CLI — build and manage Whop apps from your terminal. Human and agent friendly.

Static Scan Results

scanned 6d ago · by rust-scanner

Static analysis flagged 16 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShell

Supply chain

HighEntropyStringsTelemetryUrlStrings

Manifest

GitDependency

scanned 4 file(s), 2.30 MB of source, external domains: api.whop.com, bun.sh, cdn.whop.com, docs.numeral.com, docs.whop.com, example.com, get.pnpm.io, github.com, json-schema.org, media.whop.com, myapp.apps.whop.com, myapp.example.com, myapp.whop.app, nodejs.org, raw.githubusercontent.com, sandbox-api.whop.com, whop.com, www.w3.org

Source & flagged code

7 flagged

dist/index.jsView file

3252// ../../node_modules/.pnpm/incur@https+++codeload.github.com+whopio+incur+tar.[redacted]node_modules/incur/dist/SyncMcp.js L3253: import { execFile } from "child_process"; L3254: import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L3252

35131} else if (process.platform === "win32") { L35132: execFile2("cmd.exe", ["/c", "start", "", url], ignore); L35133: } else {

High

Shell

Package source references shell execution.

dist/index.jsView on unpkg · L35131

452retryable; L453: /** Process exit code. When set, `serve()` uses this instead of `1`. */ L454: exitCode; ... L499: const headers = new Headers(); L500: const query = new URLSearchParams(); L501: let method; ... L566: function buildRequest(input) { L567: const url = new URL(input.path, "http://localhost"); L568: input.query.forEach((value, key) => url.searchParams.set(key, value)); ... L584: const reader = response.body.getReader(); L585: const decoder = new TextDecoder(); L586: let buffer = "";

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L452

452Cross-file remote execution chain: dist/index.js spawns dist/chunk-KFCNNWPI.js; helper contains network access plus dynamic code execution. L452: retryable; L453: /** Process exit code. When set, `serve()` uses this instead of `1`. */ L454: exitCode; ... L499: const headers = new Headers(); L500: const query = new URLSearchParams(); L501: let method; ... L566: function buildRequest(input) { L567: const url = new URL(input.path, "http://localhost"); L568: input.query.forEach((value, key) => url.searchParams.set(key, value)); ... L584: const reader = response.body.getReader(); L585: const decoder = new TextDecoder(); L586: let buffer = "";

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/index.jsView on unpkg · L452

1#!/usr/bin/env node L2: import { createRequire as __createRequire } from "node:module"; const require = __createRequire(import.meta.url); L3: import {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L1

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/index.jsView on unpkg · L452

dist/dist-2MZJLO2W.jsView file

Lines 6093-6133javascript

6093 } : { ref: sch.schema }),

6094 validateName,

6095 ValidationError: _ValidationError,

6096 schema: sch.schema,

6097 schemaEnv: sch,

6098 rootId,

6099 baseId: sch.baseId || rootId,

Source & flagged code

7 flagged · loading source

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code