registry / addashboard-cli / 0.2.4

addashboard-cli@0.2.4

webgram CLI — ad-dashboard (https://macchiato.site) を Claude Code / Codex CLI から操作するための CLI

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 9 file(s), 65.6 KB of source, external domains: 127.0.0.1, accounts.google.com, macchiato.site

Source & flagged code

3 flagged

dist/commands/freee.jsView file

Lines 3-43javascript

3 return (mod && mod.__esModule) ? mod : { "default": mod };

4};

5Object.defineProperty(exports, "__esModule", { value: true });

6exports.buildApiClient = void 0;

7exports.runFreeeLogin = runFreeeLogin;

8exports.runFreeeTemplates = runFreeeTemplates;

9exports.runFreeeIssue = runFreeeIssue;

10/**

11 * webgram freee — freee 請求書発行コマンド群。

12 *

13 * - login: ローカル :8080 で認可コードを受け取り backend で token 交換

14 * - templates: 使用可能な帳票テンプレート一覧

15 * - issue: 請求書を発行し report_url(帳票詳細ページURL) を返す

16 * (submission.ts と同じく dry-run 既定 + --yes 安全弁)

17 *

18 * clientSecret は CLI に持たせない。token 交換は必ず backend で行う。

19 */

20const crypto_1 = __importDefault(require("crypto"));

21const fs_1 = __importDefault(require("fs"));

22const http_1 = __importDefault(require("http"));

23const url_1 = require("url");

24const child_process_1 = require("child_process");

25const apiClient_1 = require("../lib/apiClient");

High

Child Process

Package source references child process execution.

dist/commands/freee.jsView on unpkg · L23

26Object.defineProperty(exports, "buildApiClient", { enumerable: true, get: function () { return apiClient_1.buildApiClient; } });

27const CALLBACK_PORT = 8080;

28const CALLBACK_PATH = '/callback';

29function sha256Hex(s) {

30 return crypto_1.default.createHash('sha256').update(s).digest('hex').slice(0, 16);

31}

32/** JWT (検証なし) から email を取り出す。失敗時は undefined。 */

33function decodeJwtEmail(token) {

34 if (!token)

35 return undefined;

36 try {

37 const payload = token.split('.')[1];

38 if (!payload)

39 return undefined;

40 const v = JSON.parse(Buffer.from(payload, 'base64url').toString('utf8'));

41 return typeof v?.email === 'string' ? v.email : undefined;

42 }

43 catch {

dist/commands/authGoogle.jsView file

Lines 1-26javascript

1"use strict";

2var __importDefault = (this && this.__importDefault) || function (mod) {

3 return (mod && mod.__esModule) ? mod : { "default": mod };

4};

5Object.defineProperty

Source & flagged code

3 flagged · loading source

dist/commands/freee.jsView file

23const url_1 = require("url"); L24: const child_process_1 = require("child_process"); L25: const apiClient_1 = require("../lib/apiClient");

High

Child Process

Package source references child process execution.

dist/commands/freee.jsView on unpkg · L23

dist/commands/authGoogle.jsView file

6exports.runGoogleLogin = runGoogleLogin; L7: const http_1 = __importDefault(require("http")); L8: const crypto_1 = __importDefault(require("crypto")); L9: const child_process_1 = require("child_process"); L10: const axios_1 = __importDefault(require("axios")); L11: const AUTH_ENDPOINT = 'https://accounts.google.com/o/oauth2/v2/auth'; L12: const ALLOWED_HD = process.env.WEBGRAM_GOOGLE_HD || 'webgram.jp'; L13: const CALLBACK_TIMEOUT_MS = 5 * 60 * 1000; // 5 分

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/commands/authGoogle.jsView on unpkg · L6

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/commands/authGoogle.jsView on unpkg · L6

Findings

3 High3 Medium6 Low

HighChild Processdist/commands/freee.js

HighSame File Env Network Executiondist/commands/authGoogle.js

HighSandbox Evasion Gated Capabilitydist/commands/authGoogle.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

3 flagged

dist/commands/freee.jsView file

Lines 3-43javascript

3 return (mod && mod.__esModule) ? mod : { "default": mod };

4};

5Object.defineProperty(exports, "__esModule", { value: true });

6exports.buildApiClient = void 0;

7exports.runFreeeLogin = runFreeeLogin;

8exports.runFreeeTemplates = runFreeeTemplates;

9exports.runFreeeIssue = runFreeeIssue;

10/**

11 * webgram freee — freee 請求書発行コマンド群。

12 *

13 * - login: ローカル :8080 で認可コードを受け取り backend で token 交換

14 * - templates: 使用可能な帳票テンプレート一覧

15 * - issue: 請求書を発行し report_url(帳票詳細ページURL) を返す

16 * (submission.ts と同じく dry-run 既定 + --yes 安全弁)

17 *

18 * clientSecret は CLI に持たせない。token 交換は必ず backend で行う。

19 */

20const crypto_1 = __importDefault(require("crypto"));

21const fs_1 = __importDefault(require("fs"));

22const http_1 = __importDefault(require("http"));

23const url_1 = require("url");

24const child_process_1 = require("child_process");

25const apiClient_1 = require("../lib/apiClient");

High

Child Process

Package source references child process execution.

dist/commands/freee.jsView on unpkg · L23

26Object.defineProperty(exports, "buildApiClient", { enumerable: true, get: function () { return apiClient_1.buildApiClient; } });

27const CALLBACK_PORT = 8080;

28const CALLBACK_PATH = '/callback';

29function sha256Hex(s) {

30 return crypto_1.default.createHash('sha256').update(s).digest('hex').slice(0, 16);

31}

32/** JWT (検証なし) から email を取り出す。失敗時は undefined。 */

33function decodeJwtEmail(token) {

34 if (!token)

35 return undefined;

36 try {

37 const payload = token.split('.')[1];

38 if (!payload)

39 return undefined;

40 const v = JSON.parse(Buffer.from(payload, 'base64url').toString('utf8'));

41 return typeof v?.email === 'string' ? v.email : undefined;

42 }

43 catch {

dist/commands/authGoogle.jsView file

Lines 1-26javascript

1"use strict";

2var __importDefault = (this && this.__importDefault) || function (mod) {

3 return (mod && mod.__esModule) ? mod : { "default": mod };

4};

5Object.defineProperty