registry / balena-cli / 25.1.10
balena-cli@25.1.10
The official balena Command Line Interface
Static Scan Results
scanned 4mo ago · by rust-scannerStatic analysis flagged 16 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
One or more suspicious static signals were detected.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
8 flaggedpackage.jsonView file
•scripts.postinstall = node patches/apply-patches.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgoclif.manifest.jsonView file
221patternName = generic_password
severity = medium
line = 221
matchedText = "descrip...\n",
Medium
772patternName = generic_password
severity = medium
line = 772
matchedText = "descrip...\n",
Medium
Findings
2 High9 Medium5 Low
HighInstall Time Lifecycle Scriptspackage.json
HighSandbox Evasion Gated Capabilitybuild/utils/sudo.js
MediumSecret Patternoclif.manifest.json
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperbin/dev.cmd
MediumStructural Risk Force Deep Review
MediumSecret Patternoclif.manifest.json
MediumSecret Patternoclif.manifest.json
MediumSecret Patternbuild/utils/messages.js
MediumSecret Patternsrc/utils/messages.ts
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
Low
Affected versions and remediation
This report applies to balena-cli@25.1.10.
See all versions of balena-cli for other recorded verdicts.
- Review the evidence and your use of balena-cli@25.1.10 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.