registry / asyar-sdk / 4.3.0

asyar-sdk@4.3.0

SDK for Asyar extensions

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

Manifest

CopyleftLicense

scanned 173 file(s), 633 KB of source, external domains: api.github.com, asyar-thumb.localhost, asyar.org, example.com, github.com, www.w3.org

Source & flagged code

4 flagged

dist/cli/lib/auth.jsView file

Lines 25-66javascript

25var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {

26 function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }

27 return new (P || (P = Promise))(function (resolve, reject) {

28 function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }

29 function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }

30 function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }

31 step((generator = generator.apply(thisArg, _arguments || [])).next());

32 });

33};

34var __importDefault = (this && this.__importDefault) || function (mod) {

35 return (mod && mod.__esModule) ? mod : { "default": mod };

36};

37var _a;

38Object.defineProperty(exports, "__esModule", { value: true });

39exports.STORE_URL = void 0;

40exports.openBrowser = openBrowser;

41exports.getStoredAuth = getStoredAuth;

42exports.login = login;

43exports.logout = logout;

44exports.requireAuth = requireAuth;

45exports.getOrAuthorizeGitHub = getOrAuthorizeGitHub;

46const http = __importStar(require("http"));

47const child_process_1 = require("child_process");

48const chalk_1 = __importDefault(require("chalk"));

High

Child Process

Package source references child process execution.

dist/cli/lib/auth.jsView on unpkg · L46

49const ora_1 = __importDefault(require("ora"));

50const KEYCHAIN_SERVICE = 'asyar-cli';

51const KEY_STORE_TOKEN = 'store-session-token';

52const KEY_GITHUB_TOKEN = 'github-token';

53const KEY_GITHUB_USERNAME = 'github-username';

54const CLI_PORT = 7123;

55exports.STORE_URL = (_a = process.env.ASYAR_STORE_URL) !== null && _a !== void 0 ? _a : 'https://asyar.org';

56function openBrowser(rawUrl) {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli/lib/auth.jsView on unpkg · L45

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli/lib/auth.jsView on unpkg · L45

57 // Untrusted input (env var / GitHub response): allow only normalized

58 // http(s) URLs, spawn the opener without a shell. Callers print the URL

59 // as a manual fallback, so refusing is safe.

60 let parsed;

61 try {

62 parsed = new URL(rawUrl);

63 }

64 catch (_a) {

65 return;

66 }

dist/cli/index.jsView file

Lines 1-23javascript

1#!/usr/bin/env node

2"use strict";

3Object.defineProperty(exports, "__esModule", { value: true });

4const commander_1 = require("commander");

5const fs_1 = require("fs");

Source & flagged code

4 flagged · loading source

dist/cli/lib/auth.jsView file

46const http = __importStar(require("http")); L47: const child_process_1 = require("child_process"); L48: const chalk_1 = __importDefault(require("chalk"));

High

Child Process

Package source references child process execution.

dist/cli/lib/auth.jsView on unpkg · L46

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli/lib/auth.jsView on unpkg · L45

45exports.getOrAuthorizeGitHub = getOrAuthorizeGitHub; L46: const http = __importStar(require("http")); L47: const child_process_1 = require("child_process"); L48: const chalk_1 = __importDefault(require("chalk")); ... L54: const CLI_PORT = 7123; L55: exports.STORE_URL = (_a = process.env.ASYAR_STORE_URL) !== null && _a !== void 0 ? _a : 'https://asyar.org'; L56: function openBrowser(rawUrl) { ... L69: const url = parsed.href; L70: if (process.platform === 'darwin') { L71: (0, child_process_1.execFile)('open', [url]); ... L100: res.writeHead(400); L101: res.end('Missing token or username');

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli/lib/auth.jsView on unpkg · L45

dist/cli/index.jsView file

3Object.defineProperty(exports, "__esModule", { value: true }); L4: const commander_1 = require("commander"); L5: const fs_1 = require("fs");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/cli/index.jsView on unpkg · L3

Findings

3 High4 Medium6 Low

HighChild Processdist/cli/lib/auth.js

HighSame File Env Network Executiondist/cli/lib/auth.js

HighSandbox Evasion Gated Capabilitydist/cli/lib/auth.js

MediumDynamic Requiredist/cli/index.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowCopyleft License

Source & flagged code

4 flagged

dist/cli/lib/auth.jsView file

Lines 25-66javascript

25var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {

26 function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }

27 return new (P || (P = Promise))(function (resolve, reject) {

28 function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }

29 function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }

30 function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }

31 step((generator = generator.apply(thisArg, _arguments || [])).next());

32 });

33};

34var __importDefault = (this && this.__importDefault) || function (mod) {

35 return (mod && mod.__esModule) ? mod : { "default": mod };

36};

37var _a;

38Object.defineProperty(exports, "__esModule", { value: true });

39exports.STORE_URL = void 0;

40exports.openBrowser = openBrowser;

41exports.getStoredAuth = getStoredAuth;

42exports.login = login;

43exports.logout = logout;

44exports.requireAuth = requireAuth;

45exports.getOrAuthorizeGitHub = getOrAuthorizeGitHub;

46const http = __importStar(require("http"));

47const child_process_1 = require("child_process");

48const chalk_1 = __importDefault(require("chalk"));

High

Child Process

Package source references child process execution.

dist/cli/lib/auth.jsView on unpkg · L46

49const ora_1 = __importDefault(require("ora"));

50const KEYCHAIN_SERVICE = 'asyar-cli';

51const KEY_STORE_TOKEN = 'store-session-token';

52const KEY_GITHUB_TOKEN = 'github-token';

53const KEY_GITHUB_USERNAME = 'github-username';

54const CLI_PORT = 7123;

55exports.STORE_URL = (_a = process.env.ASYAR_STORE_URL) !== null && _a !== void 0 ? _a : 'https://asyar.org';

56function openBrowser(rawUrl) {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli/lib/auth.jsView on unpkg · L45

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli/lib/auth.jsView on unpkg · L45

57 // Untrusted input (env var / GitHub response): allow only normalized

58 // http(s) URLs, spawn the opener without a shell. Callers print the URL

59 // as a manual fallback, so refusing is safe.

60 let parsed;

61 try {

62 parsed = new URL(rawUrl);

63 }

64 catch (_a) {

65 return;

66 }

dist/cli/index.jsView file

Lines 1-23javascript

1#!/usr/bin/env node

2"use strict";

3Object.defineProperty(exports, "__esModule", { value: true });

4const commander_1 = require("commander");

5const fs_1 = require("fs");