@workover/cli: Suspicious npm security report (Warn)

Loading npm security reports…

Static Scan Results

scanned 1h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 1 file(s), 4.17 KB of source, external domains: api.workover.dev

Source & flagged code

3 flagged

bin/workover.mjsView file

Lines 1-33javascript

1#!/usr/bin/env node

2// Workover CLI — Phase 1: `login` / `logout` / `whoami` via the device-authorization flow (RFC 8628).

3// Auth only for now; document/coworking commands (and the MCP server) build on the stored token.

4import {

5 readFileSync,

6 writeFileSync,

7 mkdirSync,

8 existsSync,

9 chmodSync,

10 rmSync,

11} from 'fs';

12import { homedir } from 'os';

13import { join } from 'path';

14import { spawn } from 'child_process';

High

Child Process

Package source references child process execution.

bin/workover.mjsView on unpkg · L13

16// Point at a different API with WORKOVER_API (e.g. https://api.workover.test for local dev).

17const API = (process.env.WORKOVER_API || 'https://api.workover.dev').replace(/\/+$/, '');

18const CONFIG_DIR = join(homedir(), '.workover');

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

bin/workover.mjsView on unpkg · L13

19const CONFIG_FILE = join(CONFIG_DIR, 'config.json');

21const saveConfig = (cfg) => {

22 mkdirSync(CONFIG_DIR, { recursive: true });

23 writeFileSync(CONFIG_FILE, JSON.stringify(cfg, null, 2));

24 chmodSync(CONFIG_FILE, 0o600); // owner read/write only — it holds a bearer token

25};

26const loadConfig = () => {

27 try {

28 return JSON.parse(readFileSync(CONFIG_FILE, 'utf8'));

29 } catch {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/workover.mjsView on unpkg · L13

30 return null;

31 }

32};

Source & flagged code

3 flagged · loading source

bin/workover.mjsView file

13import { join } from 'path'; L14: import { spawn } from 'child_process'; L15:

@workover/cli: Suspicious npm security report (Warn) | LPM Firewall

@workover/cli@0.1.0

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Behavioral surface

Source & flagged code