apiblaze@0.6.1
APIblaze CLI + sidecar — manage API proxies, run dev tunnels, and route a Next.js app's egress through APIblaze with one command
Static Scan Results
scanned 4mo ago · by rust-scannerStatic analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
One or more suspicious static signals were detected.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
3 flaggeddist/index.jsView file
228function openBrowser(url) {
L229: const { exec } = require("child_process");
L230: const cmd = process.platform === "darwin" ? `open "${url}"` : process.platform === "win32" ? `start "" "${url}"` : `xdg-open "${url}"`;
High
1458console.log(`
L1459: Manage it at ${import_chalk7.default.cyan("https://dashboard.apiblaze.com/dashboard")}`);
L1460: }
...
L1469: var crypto = __toESM(require("crypto"));
L1470: var import_child_process = require("child_process");
L1471: var AUTH_BASE = process.env.APIBLAZE_AUTH_BASE || "https://auth.apiblaze.com";
L1472: var APIBLAZE_DIR2 = path2.join(os2.homedir(), ".apiblaze");
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/index.jsView on unpkg · L145829L30: // package.json
L31: var version = "0.6.1";
...
L50: var path = __toESM(require("path"));
L51: var APIBLAZE_DIR = path.join(os.homedir(), ".apiblaze");
L52: var CREDENTIALS_PATH = path.join(APIBLAZE_DIR, "credentials.json");
...
L68: const raw = fs.readFileSync(CREDENTIALS_PATH, "utf-8");
L69: return JSON.parse(raw);
L70: } catch {
...
L88: // src/lib/api.ts
L89: var DASHBOARD_BASE = "https://dashboard.apiblaze.com";
L90: var PUBLIC_API_BASE = "https://api.apiblaze.com";
Findings
3 High3 Medium5 Low
HighChild Processdist/index.js
HighSame File Env Network Executiondist/index.js
HighSandbox Evasion Gated Capabilitydist/index.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to apiblaze@0.6.1.
See all versions of apiblaze for other recorded verdicts.
- Review the evidence and your use of apiblaze@0.6.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.