registry / artor-cli / 0.17.0

artor-cli@0.17.0

⚠ Under review

Artor CLI — version, publish, and preview your web prototypes.

Static Scan Results

scanned 1h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 1 file(s), 230 KB of source, external domains: claude.com, dash.artor.app, github.com, nodejs.org, registry.npmjs.org

Source & flagged code

3 flagged

dist/index.jsView file

Lines 16-56javascript

16 if (Array.isArray(value)) return value.map((v) => redactForLog(v, depth + 1));

17 if (value && typeof value === "object") {

18 const out = {};

19 for (const [k, v] of Object.entries(value)) {

20 out[k] = SECRET_KEY.test(k) ? PLACEHOLDER : redactForLog(v, depth + 1);

21 }

22 return out;

23 }

24 return value;

25}

26function redactHeaders(headers) {

27 const entries = headers instanceof Headers ? [...headers.entries()] : Object.entries(headers);

28 const out = {};

29 for (const [k, v] of entries) {

30 out[k] = SECRET_KEY.test(k) ? PLACEHOLDER : redactString(v);

31 }

32 return out;

33}

34function redactBody(body) {

35 if (body === void 0 || body === "") return "";

36 try {

37 return JSON.stringify(redactForLog(JSON.parse(body)));

38 } catch {

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/index.jsView on unpkg · L36

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg · L36

39 const scrubbed = redactString(body);

40 return scrubbed.length > 2048 ? `${scrubbed.slice(0, 2048)}\u2026 (${scrubbed.length} bytes)` : scrubbed;

41 }

42}

44// ../shared/src/cli-version.ts

45var STRICT_SEMVER = /^\d+\.\d+\.\d+$/;

46function triplet(v) {

47 const [a, b, c2] = v.split(".").map(Number);

48 return [a, b, c2];

49}

50function compareSemver(a, b) {

51 if (!STRICT_SEMVER.test(a) || !STRICT_SEMVER.test(b)) {

52 throw new Error(`compareSemver: non-semver input ${a} / ${b}`);

53 }

54 const [aMaj, aMin, aPat] = triplet(a);

55 const [bMaj, bMin, bPat] = triplet(b);

56 if (aMaj !== bMaj) return aMaj > bMaj ? 1 : -1;

Lines 672-712javascript

672 }

673}

674function renderServerLauncher(spec) {

675 assertSafeSpecValue(spec.buildPath);

676 if (spec.kind === "serve-wrapper") assertSafeSpecValue(spec.servePackage);

677 switch (spec.kind) {

678 case "nitro-import":

679 return

Source & flagged code

3 flagged · loading source

dist/index.jsView file

36try { L37: return JSON.stringify(redactForLog(JSON.parse(body))); L38: } catch { ... L104: function registryUrl(pkg) { L105: return `https://registry.npmjs.org/${pkg.replace("/", "%2F")}/latest`; L106: } ... L123: try { L124: const raw = readFileSync(new URL("../package.json", import.meta.url), "utf8"); L125: return JSON.parse(raw); ... L150: const body = typeof init2.body === "string" ? redactBody(init2.body) : void 0; L151: process.stderr.write(`\x1B[2m\u2192 ${method} ${url}\x1B[0m L152: `);

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/index.jsView on unpkg · L36

36Trigger-reachable chain: manifest.bin -> dist/index.js L36: try { L37: return JSON.stringify(redactForLog(JSON.parse(body))); L38: } catch { ... L104: function registryUrl(pkg) { L105: return `https://registry.npmjs.org/${pkg.replace("/", "%2F")}/latest`; L106: } ... L123: try { L124: const raw = readFileSync(new URL("../package.json", import.meta.url), "utf8"); L125: return JSON.parse(raw); ... L150: const body = typeof init2.body === "string" ? redactBody(init2.body) : void 0; L151: process.stderr.write(`\x1B[2m\u2192 ${method} ${url}\x1B[0m L152: `);

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg · L36

692L693: await import(pathToFileURL(resolve(here, ${JSON.stringify(spec.buildPath)})).href); L694: `;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L692

Findings

2 Critical4 Medium5 Low

CriticalCredential Exfiltrationdist/index.js

CriticalTrigger Reachable Dangerous Capabilitydist/index.js

MediumDynamic Requiredist/index.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

3 flagged

dist/index.jsView file

Lines 16-56javascript

16 if (Array.isArray(value)) return value.map((v) => redactForLog(v, depth + 1));

17 if (value && typeof value === "object") {

18 const out = {};

19 for (const [k, v] of Object.entries(value)) {

20 out[k] = SECRET_KEY.test(k) ? PLACEHOLDER : redactForLog(v, depth + 1);

21 }

22 return out;

23 }

24 return value;

25}

26function redactHeaders(headers) {

27 const entries = headers instanceof Headers ? [...headers.entries()] : Object.entries(headers);

28 const out = {};

29 for (const [k, v] of entries) {

30 out[k] = SECRET_KEY.test(k) ? PLACEHOLDER : redactString(v);

31 }

32 return out;

33}

34function redactBody(body) {

35 if (body === void 0 || body === "") return "";

36 try {

37 return JSON.stringify(redactForLog(JSON.parse(body)));

38 } catch {

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/index.jsView on unpkg · L36

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg · L36

39 const scrubbed = redactString(body);

40 return scrubbed.length > 2048 ? `${scrubbed.slice(0, 2048)}\u2026 (${scrubbed.length} bytes)` : scrubbed;

41 }

42}

44// ../shared/src/cli-version.ts

45var STRICT_SEMVER = /^\d+\.\d+\.\d+$/;

46function triplet(v) {

47 const [a, b, c2] = v.split(".").map(Number);

48 return [a, b, c2];

49}

50function compareSemver(a, b) {

51 if (!STRICT_SEMVER.test(a) || !STRICT_SEMVER.test(b)) {

52 throw new Error(`compareSemver: non-semver input ${a} / ${b}`);

53 }

54 const [aMaj, aMin, aPat] = triplet(a);

55 const [bMaj, bMin, bPat] = triplet(b);

56 if (aMaj !== bMaj) return aMaj > bMaj ? 1 : -1;

Lines 672-712javascript

672 }

673}

674function renderServerLauncher(spec) {

675 assertSafeSpecValue(spec.buildPath);

676 if (spec.kind === "serve-wrapper") assertSafeSpecValue(spec.servePackage);

677 switch (spec.kind) {

678 case "nitro-import":

679 return