registry / @zenovay/cli / 1.0.26

@zenovay/cli@1.0.26

Zenovay CLI — AI install wizard + full terminal analytics dashboard

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 15 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

NoLicense

scanned 116 file(s), 588 KB of source, external domains: 127.0.0.1, api.zenovay.com, app.zenovay.com, cli.zenovay.com, docs.zenovay.com, example.com, github.com, hook.example.com, registry.npmjs.org, www.apple.com, zenovay-cli-distribution.zenovay.workers.dev

Source & flagged code

8 flagged

dist/self-test-RTam3wnZ.jsView file

Lines 1-16javascript

1import{mocha as e}from"./theme-DSRmbn9T.js";import{spawn as t}from"node:child_process";import n from"chalk";const r=3e4,i=4,a=1e3;function o(e,t){let n=e.requires;if(!n)return null;if(n.auth!==!1&&!t.authenticated)return`not authenticated`;if(n.tier&&t.currentTier){let e={free:0,pro:1,scale:2,enterprise:3},r=e[t.currentTier]??0,i=e[n.tier]??99}return n.multipleTeams&&!t.hasMultipleTeams?`requires 2+ teams`:n.freeTeam&&!t.hasFreeTeam?`requires a Free-tier team`:null}function s(e,n,r,i){return new Promise(a=>{let o=/\.[mc]?js$/.test(e),s=o?`node`:e,c=o?[e,...n]:n,l=t(s,c,{env:{...process.env,ZEN ...

2`).filter(e=>e.trim().startsWith(`{`)||e.trim().startsWith(`[`)).pop();if(e)try{return{ok:!0,value:JSON.parse(e)}}catch{}return{ok:!1,reason:`stdout not JSON (got ${t.length} bytes)`}}}function f(e,t,n){if(n!==0)return{ok:!1,reason:`exit ${n}`};let r=d(e);return r.ok?{ok:!0}:{ok:!1,reason:r.reason}}function p(e,t,n){if(n!==0){let r=[e,t];for(let e of r)if(e.includes(`tier_insufficient`))return{ok:!0,detail:{gated:!0}};return{ok:!1,reason:`exit ${n} — ${(t||e).slice(0,80)}`}}let r=d(e);return r.ok?{ok:!0}:{ok:!1,reason:r.reason}}function m(e){if(typeof e!=`object`||!e)return!1;let t=e;if(Array. ...

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/self-test-RTam3wnZ.jsView on unpkg · L2

Critical

Secret Pattern

AWS access key ID in dist/self-test-RTam3wnZ.js

dist/self-test-RTam3wnZ.jsView on unpkg · L2

Critical

Secret Pattern

RSA private key in dist/self-test-RTam3wnZ.js

dist/self-test-RTam3wnZ.jsView on unpkg · L2

3`),i=t(r),a=n.filter(e=>i.includes(`[REDACTED:${e.name}]`)).length,o=e.length,s=Math.max(18,o-4);return a>=s?{ok:!0,detail:{matched:a,total:o}}:{ok:!1,reason:`${a}/${o} patterns redacted (need >= ${s})`}},quick:!0},{name:`help-line-count`,category:`DISCOVERABILITY`,command:[`--help`],assert:(e,t,n)=>{let r=e.split(`

4`).length;return r<90?{ok:!0,detail:{lines:r}}:{ok:!1,reason:`${r} lines (target < 90)`}},dev:!0},{name:`help-no-wave-markers`,category:`DISCOVERABILITY`,command:[`--help`],assert:(e,t,n)=>{let r=/\b(?:Wave\s*\d|

5`),process.stdout.write(_.accent(c)+`

6`),process.stdout.write(_.accent(l)+`

8`)}function T(e,t){let r=e.padEnd(16,` `),i=`· ${t} test${t===1?``:`s`}`;process.stdout.write(n.bold(r)+n.dim(i)+`

9`)}function E(e,t){let r=t.status===`pass`?_.success(`✓`):t.status===`skip`?_.muted(`○`):_.error(`✗`),i=O(e.name,b),a=t.status===`pass`||t.status===`fail`?`${(t.durationMs/1e3).toFixed(2)}s`:`—`,o=a.padEnd

10`)}}function D(e){let t=Math.min(120,C()),r=t-2,i=`${(e.durationMs/1e3).toFixed(1)}s`,a=e.fail===0,o=a?`all checks passed`:`${e.fail

11`+l+`

12`);let u=n.bold(`${e.pass} / ${e.total}`)+n.dim(` pass · `)+(e.fail>0?_.error(`${e.fail} fail`):n.dim(`${e.fail} fail`))+n.dim(

13`),process.stdout.write(n.dim(`│`+` `.repeat(r)+`│`)+`

14`);let f=`Run with --json for machine-readable output, --verbose for full traces.`;process.stdout.write(n.dim(`│ `+f+` `.repeat(Math.max(0,r-f.length-4))+` │`)+`

15`),process.stdout.write(n.dim(`╰`+`─`.repeat(r)+`╯`)+`

16`)}function O(e,t){return e.length>t?e.slice(0,t-1)+`…`:e.padEnd(t,` `)}function k(e){return e.replace(/\x1b\[[0-9;]*m/g,``

Long lines were clipped for display.

dist/init-C6wegGPC.jsView file

Lines 1-21javascript

1import{readConfig as e,updateConfig as t}from"./config-JVhBplSX.js";import{ApiClient as n,completionUrlForVerifiedSetup as r,dashboardUrlForSite as i}from"./api-CBukwv2I.js";import{readToken as a}from"./token-store-CuZEiQNg.js";import{diagnoseInstall as o}from"./detect-installed-DpSaAeH-.js";import{emit$1 as s,isHeadless as

dist/status-agent-Daz4qPSV.jsView file

Lines 1-10javascript

dist/secrets-zGZxXoM0.jsView file

Lines 1-1javascript

1const e=[{name:`connection-string`,regex:/(?<=\b(?:postgres(?:ql)?|mysql|mongodb(?:\+srv)?|redis(?:s)?|amqps?):\/\/[^:@\s/]*:)[^@\s/]+(?=@)/gi},{name:`openai-proj`,regex:/\bsk-proj-

Source & flagged code

8 flagged · loading source

dist/self-test-RTam3wnZ.jsView file

2patternName = aws_access_key severity = critical line = 2 matchedText = `).filte...in(`

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/self-test-RTam3wnZ.jsView on unpkg · L2

2patternName = aws_access_key severity = critical line = 2 matchedText = `).filte...in(`

Critical

Secret Pattern

AWS access key ID in dist/self-test-RTam3wnZ.js

dist/self-test-RTam3wnZ.jsView on unpkg · L2

2patternName = private_key_rsa severity = critical line = 2 matchedText = `).filte...in(`

Critical

Secret Pattern

RSA private key in dist/self-test-RTam3wnZ.js

dist/self-test-RTam3wnZ.jsView on unpkg · L2

dist/init-C6wegGPC.jsView file

1import{readConfig as e,updateConfig as t}from"./config-JVhBplSX.js";import{ApiClient as n,completionUrlForVerifiedSetup as r,dashboardUrlForSite as i}from"./api-CBukwv2I.js";import... L2: `,{mode:384}),this.journaledPaths.set(e,o),o}static wrapForModel(e,t){let n=D.createHash(`sha256`).update(t).digest(`hex`).slice(0,16),r=t.replaceAll(`&`,`&`).replaceAll(`<`,`&...

High

Child Process

Package source references child process execution.

dist/init-C6wegGPC.jsView on unpkg · L1

340]; L341: },`,p=`${u}${f}${d}`;return await t.beforeWrite?.(r),await j.writeFile(r,p,`utf8`),{file:r,action:`updated`}}const jn=`https://api.zenovay.com`;async function Mn(e,t={}){let n=t.ap... L342: `),f.endsWith(` ... L345: `)?` L346: `:``;f=`${a}${e}${l}\n${i}\n`}return await t.beforeWrite?.(r),await j.writeFile(r,f,`utf8`),{file:r,action:`updated`}}const In="Your tracker is already live and working — it counts... L347: `)[0]:`unknown git error`;return{committed:!0,pushed:!1,shortSha:p,branch:d,reason:`push-failed`,pushError:t,message:`Commit ${p} was created locally, but it was not pushed. Run: g... L348: `),0;let r;for(let t of n)if(await ge(t,e.cwd).catch(()=>!1)){r=t;break}if(!r){let t=`Nothing to undo — no init session belongs to this project.`;return c(e)?(s({type:`info`,messag...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/init-C6wegGPC.jsView on unpkg · L340

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/init-C6wegGPC.jsView on unpkg · L340

dist/status-agent-Daz4qPSV.jsView file

1import{configPath as e,readConfig as t,writeConfig as n}from"./config-JVhBplSX.js";import"./api-CBukwv2I.js";import{readToken as r}from"./token-store-CuZEiQNg.js";import{emit as i}... L2: `),2;let s=new a({config:n,cliVersion:e.cliVersion,token:o}),c=e.siteId??n.defaultSiteId??``;if(!c)return process.stderr.write("status-agent: no site selected — pass --site-id or r... L3: `)}function M(){let e=process.argv[0]??`zenovay`;return[`[Unit]`,`Description=Zenovay status agent`,`After=network.target`,``,`[Service]`,`Type=simple`,`ExecStart=${e} status-agent... L4: `)}function N(){let e=process.argv[0]??`zenovay`;return[`<?xml version="1.0" encoding="UTF-8"?>`,`<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/Pr... L5: `)}async function P(r){if(r.installTmux)return process.stdout.write(j()+`

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/status-agent-Daz4qPSV.jsView on unpkg · L1

dist/secrets-zGZxXoM0.jsView file

1patternName = private_key_rsa severity = critical line = 1 matchedText = const e=...ts};

Critical

Secret Pattern

RSA private key in dist/secrets-zGZxXoM0.js

dist/secrets-zGZxXoM0.jsView on unpkg · L1

Findings

4 Critical3 High3 Medium5 Low

CriticalCritical Secretdist/self-test-RTam3wnZ.js

CriticalSecret Patterndist/self-test-RTam3wnZ.js

CriticalSecret Patterndist/secrets-zGZxXoM0.js

HighChild Processdist/init-C6wegGPC.js

HighSame File Env Network Executiondist/init-C6wegGPC.js

HighCommand Output Exfiltrationdist/init-C6wegGPC.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/status-agent-Daz4qPSV.js

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

8 flagged

dist/self-test-RTam3wnZ.jsView file

Lines 1-16javascript

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/self-test-RTam3wnZ.jsView on unpkg · L2

Critical

Secret Pattern

AWS access key ID in dist/self-test-RTam3wnZ.js

dist/self-test-RTam3wnZ.jsView on unpkg · L2

Critical

Secret Pattern

RSA private key in dist/self-test-RTam3wnZ.js

dist/self-test-RTam3wnZ.jsView on unpkg · L2

5`),process.stdout.write(_.accent(c)+`

6`),process.stdout.write(_.accent(l)+`

8`)}function T(e,t){let r=e.padEnd(16,` `),i=`· ${t} test${t===1?``:`s`}`;process.stdout.write(n.bold(r)+n.dim(i)+`

10`)}}function D(e){let t=Math.min(120,C()),r=t-2,i=`${(e.durationMs/1e3).toFixed(1)}s`,a=e.fail===0,o=a?`all checks passed`:`${e.fail

11`+l+`

12`);let u=n.bold(`${e.pass} / ${e.total}`)+n.dim(` pass · `)+(e.fail>0?_.error(`${e.fail} fail`):n.dim(`${e.fail} fail`))+n.dim(

13`),process.stdout.write(n.dim(`│`+` `.repeat(r)+`│`)+`

14`);let f=`Run with --json for machine-readable output, --verbose for full traces.`;process.stdout.write(n.dim(`│ `+f+` `.repeat(Math.max(0,r-f.length-4))+` │`)+`

15`),process.stdout.write(n.dim(`╰`+`─`.repeat(r)+`╯`)+`

16`)}function O(e,t){return e.length>t?e.slice(0,t-1)+`…`:e.padEnd(t,` `)}function k(e){return e.replace(/\x1b\[[0-9;]*m/g,``

Long lines were clipped for display.

dist/init-C6wegGPC.jsView file

Lines 1-21javascript

dist/status-agent-Daz4qPSV.jsView file

Lines 1-10javascript

dist/secrets-zGZxXoM0.jsView file

Lines 1-1javascript

1const e=[{name:`connection-string`,regex:/(?<=\b(?:postgres(?:ql)?|mysql|mongodb(?:\+srv)?|redis(?:s)?|amqps?):\/\/[^:@\s/]*:)[^@\s/]+(?=@)/gi},{name:`openai-proj`,regex:/\bsk-proj-

Lines 320-357javascript

320 })

321}

322`}function wn(e,t){if(!e.startsWith(`${xn}\n`))return!1;let n=[`export async function onRequest(context: EventContext): Promise<Response>`,"const targetUrl = `${apiBase}/fp/${path}${new URL(request.url).search}`",`const apiBase = env.NEXT_PUBLIC_API_URL || '${t}'`,`responseHeaders.set('X-Zenovay-Proxied', 'true')`,`export async function onRequestOptions`];return n.every(t=>e.includes(t))}async function Tn(e,t){let n=(t.apiBase||bn).replace(/\/+$/,``),r=C.join(e,`functions`,`api`,`_z`),i=C.join(r,`[[path]].ts`),a=Cn(n);try{let e=await w.readFile(i,`utf8`);return e===a?{file:i,action:`exists`}:w ...

323 {

324 source: '/api/_z/:path*',

325 destination: '${e}/fp/:path*',

326 },`}function kn(e){return`/** @type {import('next').NextConfig} */

327const nextConfig = {

328 async rewrites() {

329 return [

330${On(e)}

331 ];

332 },

333};

334

335export default nextConfig;

336`}async function An(e,t={}){let n=t.apiBase??En,r=null;for(let t of Dn){let n=C.join(e,t);try{await j.access(n),r=n;break}catch{}}if(!r){let r=C.join(e,`next.config.mjs`);return await t.beforeWrite?.(r),await j.writeFile(r,kn(n),`utf8`),{file:r,action:`created`}}let i=await j.readFile(r,`utf8`),a=i.includes(`source: '/api/_z/:path*'`)||i.includes(`source: "/api/_z/:path*"`),o=i.includes(`destination: '${n}/fp/:path*'`)||i.includes(`destination: "${n}/fp/:path*"`);if(a&&o)return{file:r,action:`exists`};if(i.includes(`/api/_z/:path*`)||i.includes(`/_z/:path*`)||/\brewrites\s*(?::|=|\()/.test(i)| ...

337 async rewrites() {

338 return [

339${On(n)}

340 ];

341 },`,p=`${u}${f}${d}`;return await t.beforeWrite?.(r),await j.writeFile(r,p,`utf8`),{file:r,action:`updated`}}const jn=`https://api.zenovay.com`;async function Mn(e,t={}){let n=t.apiBase??jn,r=

342`),f.endsWith(`

343`)||(f+=`

344`);else{let e=a.length>0&&!a.endsWith(`

345`)?`

346`:``;f=`${a}${e}${l}\n${i}\n`}return await t.beforeWrite?.(r),await j.writeFile(r,f,`utf8`),{file:r,action:`updated`}}const In="Your tracker is already live and working — it counts visitors in Chrome, Firefox and most browsers, no further setup required. First-party tracking is OPTIONAL and adds the rest: Safari, Brave, and browsers with strict tracking prevention block analytics loaded from another company's domain, so to capture those visitors too you serve Zenovay from your OWN domain. That last step is wired at your hosting provider — enable it any time with `zenovay init --host cloudflare ...

347`)[0]:`unknown git error`;return{committed:!0,pushed:!1,shortSha:p,branch:d,reason:`push-failed`,pushError:t,message:`Commit ${p} was created locally, but it was not pushed. Run: git push origin ${d}`,unstagedPaths:o}}return e.onPhase?.(`done`),{committed:!0,pushed:!0,shortSha:p,branch:d,message:`Pushed ${p} to origin/${d}.`,unstagedPaths:o}}const ur=/<script\b[^>]*\bsrc\s*=\s*["'][^"']*(?:(?:api|cdn)\.zenovay\.com\/|\/(?:api\/)?_z\/script\.js)[^"']*["'][^>]*>/gi,dr=/\bsrc\s*=\s*["']([^"']+)["']/i,fr=/data-id

348`),0;let r;for(let t of n)if(await ge(t,e.cwd).catch(()=>!1)){r=t;break}if(!r){let t=`Nothing to undo — no init session belongs to this project.`;return c(e)?(s({type:`info`,message:t}),s({type:`done`

349`)+`

3503. Insert the tracker using the snippet below.

3514. Confirm the change with a diff before writing.

352

353Snippet reference (anchored by anchorKind — adapt to the actual file):

354`+_.map(e=>` ${e.anchorKind} @ ${e.targetPath}:\n ${e.code.replace(/\n/g,`

355 `)}`).join(`

356

357`);c.setTasks([{id:`detect`,label:`Detect framework`,status:`active`},{id:`read`,label:`Read project entry files`,status:`pending`},{id:`write`,label:`Insert tracker snippet`,status:`pending`},{id:`env`,label:`Write env vars (.env.local)`,status:`pending`},{id:`mcp`,label:`Install MCP clients (Claude Code/Cursor/VS Code)`,status:`pending`},{id:`verify`,label:`

Long lines were clipped for display.