registry / @zdravoai/cli / 1.0.8

@zdravoai/cli@1.0.8

Zdravo AI CLI - Branded terminal experience for memory operations

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 7 file(s), 49.2 KB of source, external domains: ollama.ai, www.zdravo.ai

Source & flagged code

4 flagged

dist/commands/private.jsView file

Lines 1-22javascript

1import chalk from 'chalk';

2import ora from 'ora';

3import { spawn } from 'child_process';

4const LOCAL_API = 'http://localhost:3000';

High

Source & flagged code

4 flagged · loading source

dist/commands/private.jsView file

2import ora from 'ora'; L3: import { spawn } from 'child_process'; L4: const LOCAL_API = 'http://localhost:3000';

High

Child Process

Package source references child process execution.

dist/commands/private.jsView on unpkg · L2

94console.log(chalk.gray(` Fish: set -x ${key} ${val}`)); L95: console.log(chalk.gray(` PowerShell: $env:${key}="${val}"\n`)); L96: console.log(chalk.yellow(' Or add to ~/.bashrc / ~/.zshrc for persistence.\n'));

High

Shell

Package source references shell execution.

dist/commands/private.jsView on unpkg · L94

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/commands/private.jsView on unpkg · L2

2import ora from 'ora'; L3: import { spawn } from 'child_process'; L4: const LOCAL_API = 'http://localhost:3000'; L5: const OLLAMA_URL = process.env.OLLAMA_BASE_URL || 'http://localhost:11434'; L6: export function registerPrivate(program) { L7: const cmd = program.command('private').description('Manage local private mode (Ollama + Qdrant)'); ... L58: try { L59: if (process.platform === 'win32') { L60: spawn('taskkill', ['/IM', 'ollama.exe', '/F'], { stdio: 'pipe' }).unref(); ... L95: console.log(chalk.gray(` PowerShell: $env:${key}="${val}"\n`)); L96: console.log(chalk.yellow(' Or add to ~/.bashrc / ~/.zshrc for persistence.\n')); L97: });

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/commands/private.jsView on unpkg · L2

Findings

4 High3 Medium5 Low

HighChild Processdist/commands/private.js

HighShelldist/commands/private.js

HighSame File Env Network Executiondist/commands/private.js

HighSandbox Evasion Gated Capabilitydist/commands/private.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Lines 74-114javascript

74 .description('Show private mode status')

75 .action(async () => {

76 const o = await checkOllama();

77 const q = await checkQdrant();

78 console.log('');

79 console.log(chalk.hex('#3B82F6').bold('🔒 Private Mode Status\n'));

80 console.log(`${o ? chalk.green('✓') : chalk.red('✗')} Ollama ${o ? chalk.green('running') : chalk.red('not running')}`);

81 console.log(`${q ? chalk.green('✓') : chalk.red('✗')} Qdrant ${q ? chalk.green('reachable') : chalk.red('not reachable')}`);

82 console.log(chalk.gray(`\n API URL: ${process.env.ZDRAVO_API_URL || 'https://www.zdravo.ai (cloud mode)'}`));

83 console.log(chalk.gray(` OLLAMA_BASE_URL: ${process.env.OLLAMA_BASE_URL || 'http://localhost:11434'}`));

84 console.log('');

85 });

86 cmd

87 .command('use')

88 .description('Switch current session to local-only mode')

89 .action(() => {

90 const key = 'ZDRAVO_API_URL';

91 const val = LOCAL_API;

92 console.log(chalk.green(`✓ Export ${key}=${val}`));

93 console.log(chalk.gray(`\n Bash/Zsh: export ${key}=${val}`));

94 console.log(chalk.gray(` Fish: set -x ${key} ${val}`));

95 console.log(chalk.gray(` PowerShell: $env:${key}="${val}"\n`));

96 console.log(chalk.yellow(' Or add to ~/.bashrc / ~/.zshrc for persistence.\n'));

High

Shell

Package source references shell execution.

dist/commands/private.jsView on unpkg · L94

97 });

98 cmd

99 .command('doctor')

100 .description('Health check for private-only stack')

101 .action(async () => {

102 console.log(chalk.hex('#3B82F6').bold('\n🔒 Private Stack Diagnostics\n'));

103 const o = await checkOllama();

104 const q = await checkQdrant();

105 console.log(`${o ? chalk.green('✓') : chalk.red('✗')} Ollama`);

106 console.log(`${q ? chalk.green('✓') : chalk.red('✗')} Qdrant`);

107 console.log(chalk.gray(`\n Expected API: ${LOCAL_API}\n`));

108 });

109}

110async function checkOllama() {

111 try {

112 const res = await fetch(`${OLLAMA_URL}/api/tags`, { signal: AbortSignal.timeout(3000) });

113 return res.ok;

114 }