registry / ai-project-manage-cli / 6.0.111

ai-project-manage-cli@6.0.111

命令行工具：后续用于调用平台后端 API 完成运维与自动化操作

Static Scan Results

scanned 14d ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 11 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 1 file(s), 287 KB of source, external domains: 127.0.0.1

Source & flagged code

3 flagged

dist/index.jsView file

Lines 500-540javascript

500 }

501 ),

502 attachTaskDeploymentArtifact: defineEndpoint({

503 method: "PUT",

504 path: "/cli/task-deployments/artifact"

505 })

506 }

507};

508

509// src/api/client.ts

510function createApmApiClient(cfg) {

511 const baseURL = `${cfg.baseUrl.trim().replace(/\/+$/, "")}/api/v1`;

512 return createApiClient(requestConfig, {

513 baseURL,

514 getToken: () => resolveApiKey(cfg) || void 0,

515 successCodes: [0],

516 unauthorizedCodes: [401]

517 });

518}

519

520// src/git-remote.ts

521import { execFile } from "child_process";

522import { promisify } from "util";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L520

523var execFileAsync = promisify(execFile);

524async function tryReadGitOriginUrl(cwd) {

525 try {

526 const { stdout } = await execFileAsync(

527 "git",

528 ["config", "--get", "remote.origin.url"],

529 { cwd, encoding: "utf8", maxBuffer: 1024 * 1024 }

530 );

531 const url = stdout.trim();

532 return url || null;

533 } catch {

534 return null;

535 }

536}

537

538// src/git-utils.ts

539import { execFile as execFile2 } from "child_process";

540import { promisify as promisify2 } from "util";

Lines 1915-1955javascript

1915import { spawnSync } from "child_process";

1916

1917// src/version.ts

1918import { readFileSync as readFileSync7 } from "fs";

1919import { dirname as dirname3, join as join10 } from "path";

1920import { fileURLToPath as fileURLToPath2 } from "url";

Lines 4198-4238javascript

4198 if (/^APM_/i.test(key) && !SENSITIVE_ENV_KEY.test(key)) {

4199 keys.add(key);

4200 }

4201 }

4202 const picked = {};

4203 for (const key

Source & flagged code

3 flagged · loading source

dist/index.jsView file

520// src/git-remote.ts L521: import { execFile } from "child_process"; L522: import { promisify } from "util";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L520

4218cwd, L4219: shell: true, L4220: env,

High

Shell

Package source references shell execution.

dist/index.jsView on unpkg · L4218

1935function runNpm(args, options = {}) { L1936: return spawnSync(useNpmShell ? "npm.cmd" : "npm", args, { L1937: ...options, ... L1941: function registryBaseUrl() { L1942: const fromEnv = process.env.npm[redacted]?.trim() || process.env.NPM_CONFIG_REGISTRY?.trim(); L1943: return (fromEnv || "https://registry.npmjs.org").replace(/\/+$/, ""); L1944: }

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L1935

Findings

3 High2 Medium6 Low

HighChild Processdist/index.js

HighShelldist/index.js

HighSame File Env Network Executiondist/index.js

MediumNetwork

MediumEnvironment Vars

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

3 flagged

dist/index.jsView file

Lines 500-540javascript

500 }

501 ),

502 attachTaskDeploymentArtifact: defineEndpoint({

503 method: "PUT",

504 path: "/cli/task-deployments/artifact"

505 })

506 }

507};

508

509// src/api/client.ts

510function createApmApiClient(cfg) {

511 const baseURL = `${cfg.baseUrl.trim().replace(/\/+$/, "")}/api/v1`;

512 return createApiClient(requestConfig, {

513 baseURL,

514 getToken: () => resolveApiKey(cfg) || void 0,

515 successCodes: [0],

516 unauthorizedCodes: [401]

517 });

518}

519

520// src/git-remote.ts

521import { execFile } from "child_process";

522import { promisify } from "util";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L520

523var execFileAsync = promisify(execFile);

524async function tryReadGitOriginUrl(cwd) {

525 try {

526 const { stdout } = await execFileAsync(

527 "git",

528 ["config", "--get", "remote.origin.url"],

529 { cwd, encoding: "utf8", maxBuffer: 1024 * 1024 }

530 );

531 const url = stdout.trim();

532 return url || null;

533 } catch {

534 return null;

535 }

536}

537

538// src/git-utils.ts

539import { execFile as execFile2 } from "child_process";

540import { promisify as promisify2 } from "util";

Lines 1915-1955javascript

1915import { spawnSync } from "child_process";

1916

1917// src/version.ts

1918import { readFileSync as readFileSync7 } from "fs";

1919import { dirname as dirname3, join as join10 } from "path";

1920import { fileURLToPath as fileURLToPath2 } from "url";

Lines 4198-4238javascript

4198 if (/^APM_/i.test(key) && !SENSITIVE_ENV_KEY.test(key)) {

4199 keys.add(key);

4200 }

4201 }

4202 const picked = {};

4203 for (const key