registry / ask-marcel-office-cli / 2.2.0

ask-marcel-office-cli@2.2.0

Microsoft Graph CLI + library — typed Bun/TypeScript wrapper around 150+ Graph operations (read + on-the-fly PDF/markdown conversion + federated Microsoft Search) reachable from a Teams browser-OAuth token.

Static Scan Results

scanned 16h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 2.93 MB of source, external domains: 1drv.ms, chatsvcagg.teams.microsoft.com, contoso-my.sharepoint.com, contoso.sharepoint.com, github.com, graph.microsoft.com, ic3.teams.office.com, json-schema.org, learn.microsoft.com, login.microsoftonline.com, m365.cloud.microsoft, modelcontextprotocol.io, outlook.office.com, raw.githubusercontent.com, teams.microsoft.com

Source & flagged code

4 flagged

dist/index.jsView file

1900// src/infra/process-runner-node.ts L1901: import { spawn } from "node:child_process"; L1902: var createNodeProcessRunner = () => ({

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L1900

dist/cli.jsView file

27762} L27763: const execArgv = process3.execArgv ?? []; L27764: if (execArgv.includes("-e") || execArgv.includes("--eval") || execArgv.includes("-p") || execArgv.includes("--print")) {

High

Shell

Package source references shell execution.

dist/cli.jsView on unpkg · L27762

135Cross-file remote execution chain: dist/cli.js spawns dist/index.js; helper contains network access plus dynamic code execution. L135: uint8ArrayToHex: () => uint8ArrayToHex, L136: uint8ArrayToBase64url: () => uint8ArrayToBase64url, L137: uint8ArrayToBase64: () => uint8ArrayToBase64, ... L980: error: new (_Err ?? $ZodError)(result.issues.map((iss) => finalizeIssue(iss, ctx, config()))) L981: } : { success: true, data: result.value }; L982: }, safeParse, _safeParseAsync = (_Err) => async (schema, value, _ctx) => { ... L2416: try { L2417: new URL(`http://[${payload.value}]`); L2418: } catch { ... L16172: cur.webUrl = drive.webUrl; L16173: }, isPrivateOrShared = (ch) => { L16174: if (ch === null || typeof ch !== "object")

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli.jsView on unpkg · L135

39722sourceCode = this.opts.code.process(sourceCode, sch); L39723: const makeValidate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode); L39724: const validate = makeValidate(this, this.scope.get());

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/cli.jsView on unpkg · L39722

Source & flagged code

4 flagged · loading source

dist/index.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code