registry / @zenovay/cli / 1.0.20

@zenovay/cli@1.0.20

Zenovay CLI — AI install wizard + full terminal analytics dashboard

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 15 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

NoLicense

scanned 110 file(s), 545 KB of source, external domains: 127.0.0.1, api.zenovay.com, app.zenovay.com, cli.zenovay.com, docs.zenovay.com, example.com, github.com, hook.example.com, registry.npmjs.org, www.apple.com, zenovay-cli-distribution.zenovay.workers.dev

Source & flagged code

8 flagged

dist/self-test-Cm_BpRoW.jsView file

Lines 1-16javascript

1import{mocha as e}from"./theme-Brz9wK0w.js";import{spawn as t}from"node:child_process";import n from"chalk";const r=3e4,i=4,a=1e3;function o(e,t){let n=e.requires;if(!n)return null;if(n.auth!==!1&&!t.authenticated)return`not authenticated`;if(n.tier&&t.currentTier){let e={free:0,pro:1,scale:2,enterprise:3},r=e[t.currentTier]??0,i=e[n.tier]??99}return n.multipleTeams&&!t.hasMultipleTeams?`requires 2+ teams`:n.freeTeam&&!t.hasFreeTeam?`requires a Free-tier team`:null}function s(e,n,r,i){return new Promise(a=>{let o=/\.[mc]?js$/.test(e),s=o?`node`:e,c=o?[e,...n]:n,l=t(s,c,{env:{...process.env,ZEN ...

2`).filter(e=>e.trim().startsWith(`{`)||e.trim().startsWith(`[`)).pop();if(e)try{return{ok:!0,value:JSON.parse(e)}}catch{}return{ok:!1,reason:`stdout not JSON (got ${t.length} bytes)`}}}function f(e,t,n){if(n!==0)return{ok:!1,reason:`exit ${n}`};let r=d(e);return r.ok?{ok:!0}:{ok:!1,reason:r.reason}}function p(e,t,n){if(n!==0){let r=[e,t];for(let e of r)if(e.includes(`tier_insufficient`))return{ok:!0,detail:{gated:!0}};return{ok:!1,reason:`exit ${n} — ${(t||e).slice(0,80)}`}}let r=d(e);return r.ok?{ok:!0}:{ok:!1,reason:r.reason}}function m(e){if(typeof e!=`object`||!e)return!1;let t=e;if(Array. ...

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/self-test-Cm_BpRoW.jsView on unpkg · L2

Critical

Secret Pattern

AWS access key ID in dist/self-test-Cm_BpRoW.js

dist/self-test-Cm_BpRoW.jsView on unpkg · L2

Critical

Secret Pattern

RSA private key in dist/self-test-Cm_BpRoW.js

dist/self-test-Cm_BpRoW.jsView on unpkg · L2

High

Child Process

3`),i=t(r),a=n.filter(e=>i.includes(`[REDACTED:${e.name}]`)).length,o=e.length,s=Math.max(18,o-4);return a>=s?{ok:!0,detail:{matched:a,total:o}}:{ok:!1,reason:`${a}/${o} patterns redacted (need >= ${s})`}},quick:!0},{name:`help-line-count`,category:`DISCOVERABILITY`,command:[`--help`],assert:(e,t,n)=>{let r=e.split(`

4`).length;return r<90?{ok:!0,detail:{lines:r}}:{ok:!1,reason:`${r} lines (target < 90)`}},dev:!0},{name:`help-no-wave-markers`,category:`DISCOVERABILITY`,command:[`--help`],assert:(e,t,n)=>{let r=/\b(?:Wave\s*\d|

5`),process.stdout.write(_.accent(c)+`

6`),process.stdout.write(_.accent(l)+`

8`)}function T(e,t){let r=e.padEnd(16,` `),i=`· ${t} test${t===1?``:`s`}`;process.stdout.write(n.bold(r)+n.dim(i)+`

9`)}function E(e,t){let r=t.status===`pass`?_.success(`✓`):t.status===`skip`?_.muted(`○`):_.error(`✗`),i=O(e.name,b),a=t.status===`pass`||t.status===`fail`?`${(t.durationMs/1e3).toFixed(2)}s`:`—`,o=a.padEnd

10`)}}function D(e){let t=Math.min(120,C()),r=t-2,i=`${(e.durationMs/1e3).toFixed(1)}s`,a=e.fail===0,o=a?`all checks passed`:`${e.fail

11`+l+`

12`);let u=n.bold(`${e.pass} / ${e.total}`)+n.dim(` pass · `)+(e.fail>0?_.error(`${e.fail} fail`):n.dim(`${e.fail} fail`))+n.dim(

13`),process.stdout.write(n.dim(`│`+` `.repeat(r)+`│`)+`

14`);let f=`Run with --json for machine-readable output, --verbose for full traces.`;process.stdout.write(n.dim(`│ `+f+` `.repeat(Math.max(0,r-f.length-4))+` │`)+`

15`),process.stdout.write(n.dim(`╰`+`─`.repeat(r)+`╯`)+`

16`)}function O(e,t){return e.length>t?e.slice(0,t-1)+`…`:e.padEnd(t,` `)}function k(e){return e.replace(/\x1b\[[0-9;]*m/g,``

Long lines were clipped for display.

dist/health-R0FVZyAu.jsView file

Lines 1-2javascript

1import{configPath as e,readConfig as t}from"./config-JVhBplSX.js";import{fetchManifest as n}from"./check-D9G0N7NB.js";import{ApiClient as r}from"./api-ytLQekr6.js";import{readToken as i}from"./token-store-RBywEspd.js";import{isHeadless as a}from"./emit-D4YlMlzk.js";import{Banner

dist/ensure-latest-2XLXMv9B.jsView file

Lines 1-5javascript

1import{configDir as e,readConfig as t}from"./config-JVhBplSX.js";import{classifyBump as n,fetchManifest as r,manifestSchema as i,platformKey as a}from"./check-D9G0N7NB.js";import{spawn as o}from"node:child_process";import s from"node:path";import{promises as c,realpathSync as

dist/secrets-ApB7yh2A.jsView file

Lines 1-1javascript

1const e=[{name:`openai-proj`,regex:/\bsk-proj-[A-Za-z0-9_-]{20,}\b/g},{name:`anthropic`,regex:/\bsk-ant-[A-Za-z0-9_-]{20,}\b/g},{name:`openai-sk`,regex:/\bsk-[A-Za-z0-9]{20,}\b/g},{name:`github-pat-new`,regex:/\bgithub_pat_

Source & flagged code

8 flagged · loading source

dist/self-test-Cm_BpRoW.jsView file

2patternName = aws_access_key severity = critical line = 2 matchedText = `).filte...in(`

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/self-test-Cm_BpRoW.jsView on unpkg · L2

2patternName = aws_access_key severity = critical line = 2 matchedText = `).filte...in(`

Critical

Secret Pattern

AWS access key ID in dist/self-test-Cm_BpRoW.js

dist/self-test-Cm_BpRoW.jsView on unpkg · L2

2patternName = private_key_rsa severity = critical line = 2 matchedText = `).filte...in(`

Critical

Secret Pattern

RSA private key in dist/self-test-Cm_BpRoW.js

dist/self-test-Cm_BpRoW.jsView on unpkg · L2

1import{mocha as e}from"./theme-Brz9wK0w.js";import{spawn as t}from"node:child_process";import n from"chalk";const r=3e4,i=4,a=1e3;function o(e,t){let n=e.requires;if(!n)return null... L2: `).filter(e=>e.trim().startsWith(`{`)||e.trim().startsWith(`[`)).pop();if(e)try{return{ok:!0,value:JSON.parse(e)}}catch{}return{ok:!1,reason:`stdout not JSON (got ${t.length} bytes...

High

Child Process

Package source references child process execution.

dist/self-test-Cm_BpRoW.jsView on unpkg · L1

dist/health-R0FVZyAu.jsView file

1import{configPath as e,readConfig as t}from"./config-JVhBplSX.js";import{fetchManifest as n}from"./check-D9G0N7NB.js";import{ApiClient as r}from"./api-ytLQekr6.js";import{readToken... L2: `)}const j=2e3,M=5e3;async function N(e,t){let n=`${e}/mcp`,r=Date.now(),i=new AbortController,a=setTimeout(()=>i.abort(),j);try{let a=await t(n,{method:`GET`,signal:i.signal}),o=D...

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/health-R0FVZyAu.jsView on unpkg · L1

dist/ensure-latest-2XLXMv9B.jsView file

1import{configDir as e,readConfig as t}from"./config-JVhBplSX.js";import{classifyBump as n,fetchManifest as r,manifestSchema as i,platformKey as a}from"./check-D9G0N7NB.js";import{s... L2: `),t(r!==`n`&&r!==`no`)},i=()=>{clearTimeout(a),process.stdin.off(`data`,r);try{process.stdin.pause()}catch{}},a=setTimeout(()=>{n||(n=!0,i(),process.stderr.write(`

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/ensure-latest-2XLXMv9B.jsView on unpkg · L1

1import{configDir as e,readConfig as t}from"./config-JVhBplSX.js";import{classifyBump as n,fetchManifest as r,manifestSchema as i,platformKey as a}from"./check-D9G0N7NB.js";import{s... L2: `),t(r!==`n`&&r!==`no`)},i=()=>{clearTimeout(a),process.stdin.off(`data`,r);try{process.stdin.pause()}catch{}},a=setTimeout(()=>{n||(n=!0,i(),process.stderr.write(`

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/ensure-latest-2XLXMv9B.jsView on unpkg · L1

dist/secrets-ApB7yh2A.jsView file

1patternName = private_key_rsa severity = critical line = 1 matchedText = const e=...ts};

Critical

Secret Pattern

RSA private key in dist/secrets-ApB7yh2A.js

dist/secrets-ApB7yh2A.jsView on unpkg · L1

Findings

4 Critical3 High3 Medium5 Low

CriticalCritical Secretdist/self-test-Cm_BpRoW.js

CriticalSecret Patterndist/self-test-Cm_BpRoW.js

CriticalSecret Patterndist/secrets-ApB7yh2A.js

HighChild Processdist/self-test-Cm_BpRoW.js

HighSame File Env Network Executiondist/ensure-latest-2XLXMv9B.js

HighCommand Output Exfiltrationdist/ensure-latest-2XLXMv9B.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/health-R0FVZyAu.js

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

8 flagged

dist/self-test-Cm_BpRoW.jsView file

Lines 1-16javascript

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/self-test-Cm_BpRoW.jsView on unpkg · L2

Critical

Secret Pattern

AWS access key ID in dist/self-test-Cm_BpRoW.js

dist/self-test-Cm_BpRoW.jsView on unpkg · L2

Critical

Secret Pattern

RSA private key in dist/self-test-Cm_BpRoW.js

dist/self-test-Cm_BpRoW.jsView on unpkg · L2

High

Child Process

5`),process.stdout.write(_.accent(c)+`

6`),process.stdout.write(_.accent(l)+`

8`)}function T(e,t){let r=e.padEnd(16,` `),i=`· ${t} test${t===1?``:`s`}`;process.stdout.write(n.bold(r)+n.dim(i)+`

10`)}}function D(e){let t=Math.min(120,C()),r=t-2,i=`${(e.durationMs/1e3).toFixed(1)}s`,a=e.fail===0,o=a?`all checks passed`:`${e.fail

11`+l+`

12`);let u=n.bold(`${e.pass} / ${e.total}`)+n.dim(` pass · `)+(e.fail>0?_.error(`${e.fail} fail`):n.dim(`${e.fail} fail`))+n.dim(

13`),process.stdout.write(n.dim(`│`+` `.repeat(r)+`│`)+`

14`);let f=`Run with --json for machine-readable output, --verbose for full traces.`;process.stdout.write(n.dim(`│ `+f+` `.repeat(Math.max(0,r-f.length-4))+` │`)+`

15`),process.stdout.write(n.dim(`╰`+`─`.repeat(r)+`╯`)+`

16`)}function O(e,t){return e.length>t?e.slice(0,t-1)+`…`:e.padEnd(t,` `)}function k(e){return e.replace(/\x1b\[[0-9;]*m/g,``

Long lines were clipped for display.

dist/health-R0FVZyAu.jsView file

Lines 1-2javascript

dist/ensure-latest-2XLXMv9B.jsView file

Lines 1-5javascript

dist/secrets-ApB7yh2A.jsView file

Lines 1-1javascript