registry / apiblaze / 0.4.4

apiblaze@0.4.4

Dev tunnel CLI for APIblaze — route localhost projects through your APIblaze endpoints

Static Scan Results

scanned 4d ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 133 KB of source, external domains: 127.0.0.1, api.apiblaze.com, api.example.com, auth.apiblaze.com, dashboard.apiblaze.com, httpbin.org

Source & flagged code

3 flagged

dist/index.jsView file

Lines 9-49javascript

9var __copyProps = (to, from, except, desc) => {

10 if (from && typeof from === "object" || typeof from === "function") {

11 for (let key of __getOwnPropNames(from))

12 if (!__hasOwnProp.call(to, key) && key !== except)

13 __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });

14 }

15 return to;

16};

17var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(

18 // If the importer is in node compatibility mode or this is not an ESM

19 // file that has been converted to a CommonJS file using a Babel-

20 // compatible transform (i.e. "__esModule" has not been set), then set

21 // "default" to the CommonJS "module.exports" for node compatibility.

22 isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,

23 mod

24));

26// src/index.ts

27var import_commander = require("commander");

28var import_chalk26 = __toESM(require("chalk"));

30// package.json

31var version = "0.4.4";

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L29

33// src/types.ts

34var ApiError = class extends Error {

35 constructor(status, message, body) {

36 super(message);

37 this.status = status;

38 this.body = body;

39 this.name = "ApiError";

40 }

41};

43// src/commands/login.ts

44var import_chalk2 = __toESM(require("chalk"));

45var import_ora = __toESM(require("ora"));

47// src/lib/auth.ts

48var fs = __toESM(require("fs"));

49var os = __toESM(require("os"));

Lines 208-248javascript

208 console.log(`${import_chalk.default.cyan("\u2192")} Linking to your team ${import_chalk.default.bold(teams[0].name)}.`);

209 return { teamId: teams[0].teamId, teamName: teams[0].name };

210 }

211 if

Lines 1438-1478javascript

1438 message: "Claim into which team?",

1439 choices: teams.map((t) => ({ name: t.name, value: t.teamId }))

1440 }]);

1441 teamId = picked;

1442 } else {

1443 fail2(`Specify a team: \`apiblaze claim ${claimCode} --team <name|id>\`. Available: ${teams.map

Source & flagged code

3 flagged · loading source

dist/index.jsView file

228function openBrowser(url) { L229: const { exec } = require("child_process"); L230: const cmd = process.platform === "darwin" ? `open "${url}"` : process.platform === "win32" ? `start "" "${url}"` : `xdg-open "${url}"`;

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L228

1458console.log(` L1459: Manage it at ${import_chalk7.default.cyan("https://dashboard.apiblaze.com/dashboard")}`); L1460: } ... L1469: var crypto = __toESM(require("crypto")); L1470: var import_child_process = require("child_process"); L1471: var AUTH_BASE = process.env.APIBLAZE_AUTH_BASE || "https://auth.apiblaze.com"; L1472: var APIBLAZE_DIR2 = path2.join(os2.homedir(), ".apiblaze");

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L1458

29L30: // package.json L31: var version = "0.4.4"; ... L50: var path = __toESM(require("path")); L51: var APIBLAZE_DIR = path.join(os.homedir(), ".apiblaze"); L52: var CREDENTIALS_PATH = path.join(APIBLAZE_DIR, "credentials.json"); ... L68: const raw = fs.readFileSync(CREDENTIALS_PATH, "utf-8"); L69: return JSON.parse(raw); L70: } catch { ... L88: // src/lib/api.ts L89: var DASHBOARD_BASE = "https://dashboard.apiblaze.com"; L90: var PUBLIC_API_BASE = "https://api.apiblaze.com";

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L29

Findings

3 High3 Medium5 Low

HighChild Processdist/index.js

HighSame File Env Network Executiondist/index.js

HighSandbox Evasion Gated Capabilitydist/index.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

dist/index.jsView file

Lines 9-49javascript

9var __copyProps = (to, from, except, desc) => {

10 if (from && typeof from === "object" || typeof from === "function") {

11 for (let key of __getOwnPropNames(from))

12 if (!__hasOwnProp.call(to, key) && key !== except)

13 __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });

14 }

15 return to;

16};

17var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(

18 // If the importer is in node compatibility mode or this is not an ESM

19 // file that has been converted to a CommonJS file using a Babel-

20 // compatible transform (i.e. "__esModule" has not been set), then set

21 // "default" to the CommonJS "module.exports" for node compatibility.

22 isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,

23 mod

24));

26// src/index.ts

27var import_commander = require("commander");

28var import_chalk26 = __toESM(require("chalk"));

30// package.json

31var version = "0.4.4";

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L29

33// src/types.ts

34var ApiError = class extends Error {

35 constructor(status, message, body) {

36 super(message);

37 this.status = status;

38 this.body = body;

39 this.name = "ApiError";

40 }

41};

43// src/commands/login.ts

44var import_chalk2 = __toESM(require("chalk"));

45var import_ora = __toESM(require("ora"));

47// src/lib/auth.ts

48var fs = __toESM(require("fs"));

49var os = __toESM(require("os"));

Lines 208-248javascript

208 console.log(`${import_chalk.default.cyan("\u2192")} Linking to your team ${import_chalk.default.bold(teams[0].name)}.`);

209 return { teamId: teams[0].teamId, teamName: teams[0].name };

210 }

211 if

Lines 1438-1478javascript

1438 message: "Claim into which team?",

1439 choices: teams.map((t) => ({ name: t.name, value: t.teamId }))

1440 }]);

1441 teamId = picked;

1442 } else {

1443 fail2(`Specify a team: \`apiblaze claim ${claimCode} --team <name|id>\`. Available: ${teams.map