registry / @zoralabs/cli / 1.8.0

@zoralabs/cli@1.8.0

Zora CLI tool

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsTelemetryUrlStrings

Manifest

NoLicense

scanned 6 file(s), 279 KB of source, external domains: agents.zora.com, api.example.com, api.zora.co, auth.privy.io, docs.x402.org, ipfs-uploader.zora.co, privy.io, us.i.posthog.com, zora.co, zora.com

Oversized source lightweight scan

dist/index.js4.32 MB file, sampled 256 KB

FilesystemNetworkChildProcessEnvironmentVarsCryptoShellHighEntropyStringsTelemetryUrlStringsagents.zora.comapi.example.comapi.zora.coauth.privy.iodocs.x402.orgipfs-uploader.zora.coprivy.ious.i.posthog.comzora.cozora.com

Source & flagged code

5 flagged

package.jsonView file

Lines 38-78json

38 "@zoralabs/coins-sdk": "0.7.1"

39 },

40 "optionalDependencies": {

41 "@xmtp/node-sdk-lowglibc": "npm:@xmtp/node-sdk@6.1.0-nightly.20260617.1e1a195"

42 },

43 "devDependencies": {

44 "@types/node": "^22.13.0",

45 "@types/react": "^19.2.14",

46 "@vitest/coverage-v8": "^2.1.9",

47 "ink-testing-library": "^4.0.0",

48 "react-devtools-core": "^7.0.1",

49 "tsup": "^8.4.0",

50 "tsx": "^4.21.0",

51 "typescript": "^5.7.0",

52 "vitest": "^2.1.9"

53 },

54 "engines": {

55 "node": ">=20"

56 },

57 "scripts": {

58 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L58

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L58

59 "generate:skills": "node scripts/generate-skill-content.mjs",

60 "generate:skills:check": "node scripts/generate-skill-content.mjs --check",

61 "build": "pnpm run generate:skills && pnpm run patch:xmtp-binding && tsup",

62 "build:js": "pnpm run generate:skills && pnpm run patch:xmtp-binding && tsup",

63 "check": "tsc --noEmit",

64 "zora": "tsx src/index.tsx",

65 "test": "vitest run",

66 "test:js": "pnpm run test",

67 "test:coverage": "vitest run --coverage",

68 "patch:xmtp-binding": "node scripts/patch-xmtp-binding.mjs",

69 "gen:card-fonts": "python3 scripts/gen-card-fonts.py",

70 "gen:card-wasm": "node scripts/gen-card-wasm.mjs",

71 "gen:card-assets": "pnpm run gen:card-fonts && pnpm run gen:card-wasm",

72 "build:binary": "pnpm run generate:skills && pnpm run patch:xmtp-binding && V=$(node -p \"require('./package.json').version\") && bun build ./src/index.tsx --compile --define \"PKG_VERSION=\\\"$V\\\"\" --outfile ./bin/zora",

73 "build:binary:all": "pnpm run build:binary:mac-arm64 && pnpm run build:binary:mac-x64 && pnpm run build:binary:linux-x64 && pnpm run build:binary:linux-arm64 && pnpm run build:binary:windows-x64",

74 "build:binary:mac-arm64": "pnpm run generate:skills && pnpm run patch:xmtp-binding && V=$(node -p \"require('./package.json').version\") && bun build ./src/index.tsx --compile --target=bun-darwin-arm64 --define \"PKG_VERSION=\\\"$V\\\"\" --outfile ./bin/zora-darwin-arm64",

75 "build:binary:mac-x64": "pnpm run generate:skills && pnpm run patch:xmtp-binding && V=$(node -p \"require('./package.json').version\") && bun build ./src/index.tsx --compile --target=bun-darwin-x64 --define \"PKG_VERSION=\\\"$V\\\"\" --outfile ./bin/zora-darwin-x64",

76 "build:binary:linux-x64": "pnpm run generate:skills && V=$(node -p \"require('./package.json').version\") && bun build ./src/index.tsx --compile --target=bun-linux-x64 --define \"PKG_VERSION=\\\"$V\\\"\" --outfile ./bin/zora-linux-x64",

77 "build:binary:linux-arm64": "pnpm run generate:skills && V=$(node -p \"require('./package.json').version\") && bun build ./src/index.tsx --compile --target=bun-linux-arm64 --define \"PKG_VERSION=\\\"$V\\\"\" --outfile ./bin/zora-linux-arm64",

78 "build:binary:windows-x64": "pnpm run generate:skills && V=$(node -p \"require('./package.json').version\") && bun build ./src/index.tsx --compile --target=bun-windows-x64 --define \"PKG_VERSION=\\\"$V\\\"\" --outfile ./bin/zora-windows-x64.exe"

scripts/gen-card-fonts.pyView file

•path = scripts/gen-card-fonts.py kind = build_helper sizeBytes = 3034 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/gen-card-fonts.pyView on unpkg

dist/index.jsView file

•path = dist/index.js kind = oversized_source_file sizeBytes = 4533509 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/index.jsView on unpkg

•path = dist/index.js kind = oversized_cli_entrypoint sizeBytes = 4533509 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/index.jsView on unpkg

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/gen-card-fonts.pyView file

•path = scripts/gen-card-fonts.py kind = build_helper sizeBytes = 3034 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/gen-card-fonts.pyView on unpkg

dist/index.jsView file

•path = dist/index.js kind = oversized_source_file sizeBytes = 4533509 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/index.jsView on unpkg

•path = dist/index.js kind = oversized_cli_entrypoint sizeBytes = 4533509 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/index.jsView on unpkg

Findings

2 High6 Medium6 Low

HighInstall Time Lifecycle Scriptspackage.json

HighOversized Source Filedist/index.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperscripts/gen-card-fonts.py

MediumOversized Cli Entrypointdist/index.js

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

LowNo License

Source & flagged code

5 flagged

package.jsonView file

Lines 38-78json

38 "@zoralabs/coins-sdk": "0.7.1"

39 },

40 "optionalDependencies": {

41 "@xmtp/node-sdk-lowglibc": "npm:@xmtp/node-sdk@6.1.0-nightly.20260617.1e1a195"

42 },

43 "devDependencies": {

44 "@types/node": "^22.13.0",

45 "@types/react": "^19.2.14",

46 "@vitest/coverage-v8": "^2.1.9",

47 "ink-testing-library": "^4.0.0",

48 "react-devtools-core": "^7.0.1",

49 "tsup": "^8.4.0",

50 "tsx": "^4.21.0",

51 "typescript": "^5.7.0",

52 "vitest": "^2.1.9"

53 },

54 "engines": {

55 "node": ">=20"

56 },

57 "scripts": {

58 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L58

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L58

59 "generate:skills": "node scripts/generate-skill-content.mjs",

60 "generate:skills:check": "node scripts/generate-skill-content.mjs --check",

61 "build": "pnpm run generate:skills && pnpm run patch:xmtp-binding && tsup",

62 "build:js": "pnpm run generate:skills && pnpm run patch:xmtp-binding && tsup",

63 "check": "tsc --noEmit",

64 "zora": "tsx src/index.tsx",

65 "test": "vitest run",

66 "test:js": "pnpm run test",

67 "test:coverage": "vitest run --coverage",

68 "patch:xmtp-binding": "node scripts/patch-xmtp-binding.mjs",

69 "gen:card-fonts": "python3 scripts/gen-card-fonts.py",

70 "gen:card-wasm": "node scripts/gen-card-wasm.mjs",

71 "gen:card-assets": "pnpm run gen:card-fonts && pnpm run gen:card-wasm",

73 "build:binary:all": "pnpm run build:binary:mac-arm64 && pnpm run build:binary:mac-x64 && pnpm run build:binary:linux-x64 && pnpm run build:binary:linux-arm64 && pnpm run build:binary:windows-x64",

scripts/gen-card-fonts.pyView file

•path = scripts/gen-card-fonts.py kind = build_helper sizeBytes = 3034 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/gen-card-fonts.pyView on unpkg

dist/index.jsView file

•path = dist/index.js kind = oversized_source_file sizeBytes = 4533509 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/index.jsView on unpkg

•path = dist/index.js kind = oversized_cli_entrypoint sizeBytes = 4533509 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/index.jsView on unpkg