registry / beacon-bip / 0.3.1

beacon-bip@0.3.1

Beacon — a local CLI that watches your git workspace and auto-drafts build-in-public content for Twitter/X, LinkedIn, and dev.to.

Static Scan Results

scanned 36m ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 71.8 KB of source, external domains: api.openai.com

Source & flagged code

3 flagged

dist/index.jsView file

Lines 14-54javascript

14 unlinkSync

15} from "fs";

16import { dirname, join as join2 } from "path";

18// src/lib/colors.ts

19import pc from "picocolors";

20var c = {

21 success: (s) => pc.green(s),

22 error: (s) => pc.red(s),

23 warn: (s) => pc.yellow(s),

24 info: (s) => pc.cyan(s),

25 accent: (s) => pc.magenta(s),

26 bold: (s) => pc.bold(s),

27 dim: (s) => pc.dim(s),

28 underline: (s) => pc.underline(s),

29 /** A subtle label, e.g. a key in a key: value pair. */

30 label: (s) => pc.dim(s),

31 /** Inline code / command, rendered bold-cyan. */

32 code: (s) => pc.cyan(pc.bold(s))

33};

34function isInteractive() {

35 return Boolean(process.stderr.isTTY) && process.env.NO_COLOR === void 0;

36}

38// src/lib/paths.ts

39import { homedir } from "os";

40import { join } from "path";

41function beaconHome() {

42 return process.env.BEACON_HOME ?? join(homedir(), ".beacon");

43}

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L34

44function configPath() {

45 return join(beaconHome(), "config.json");

46}

47function queuePath() {

48 return join(beaconHome(), "queue.json");

49}

50function queueTmpPath() {

51 return join(beaconHome(), "queue.json.tmp");

52}

53function beaconLogPath() {

54 return join(beaconHome(), "beacon.log");

Lines 1243-1283javascript

1243 return queue.entries.filter((e) => e.status === "pending");

1244}

1245function statusCounts(queue) {

1246 const counts = {

1247 pending: 0,

1248 approved: 0,

1249

Source & flagged code

3 flagged · loading source

dist/index.jsView file

1263patternName = private_key_rsa severity = critical line = 1263 matchedText = redact: ...ED]"

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/index.jsView on unpkg · L1263

1263patternName = private_key_rsa severity = critical line = 1263 matchedText = redact: ...ED]"

Critical

Secret Pattern

RSA private key in dist/index.js

dist/index.jsView on unpkg · L1263

34function isInteractive() { L35: return Boolean(process.stderr.isTTY) && process.env.NO_COLOR === void 0; L36: } ... L41: function beaconHome() { L42: return process.env.BEACON_HOME ?? join(homedir(), ".beacon"); L43: } ... L122: success(message) { L123: process.stdout.write(`${symbols.success} ${message} L124: `); ... L290: try { L291: raw = JSON.parse(readFileSync(path, "utf8")); L292: } catch (err) {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L34

Findings

2 Critical1 High2 Medium5 Low

CriticalCritical Secretdist/index.js

CriticalSecret Patterndist/index.js

HighSandbox Evasion Gated Capabilitydist/index.js

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

dist/index.jsView file

Lines 14-54javascript

14 unlinkSync

15} from "fs";

16import { dirname, join as join2 } from "path";

18// src/lib/colors.ts

19import pc from "picocolors";

20var c = {

21 success: (s) => pc.green(s),

22 error: (s) => pc.red(s),

23 warn: (s) => pc.yellow(s),

24 info: (s) => pc.cyan(s),

25 accent: (s) => pc.magenta(s),

26 bold: (s) => pc.bold(s),

27 dim: (s) => pc.dim(s),

28 underline: (s) => pc.underline(s),

29 /** A subtle label, e.g. a key in a key: value pair. */

30 label: (s) => pc.dim(s),

31 /** Inline code / command, rendered bold-cyan. */

32 code: (s) => pc.cyan(pc.bold(s))

33};

34function isInteractive() {

35 return Boolean(process.stderr.isTTY) && process.env.NO_COLOR === void 0;

36}

38// src/lib/paths.ts

39import { homedir } from "os";

40import { join } from "path";

41function beaconHome() {

42 return process.env.BEACON_HOME ?? join(homedir(), ".beacon");

43}

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L34

44function configPath() {

45 return join(beaconHome(), "config.json");

46}

47function queuePath() {

48 return join(beaconHome(), "queue.json");

49}

50function queueTmpPath() {

51 return join(beaconHome(), "queue.json.tmp");

52}

53function beaconLogPath() {

54 return join(beaconHome(), "beacon.log");

Lines 1243-1283javascript

1243 return queue.entries.filter((e) => e.status === "pending");

1244}

1245function statusCounts(queue) {

1246 const counts = {

1247 pending: 0,

1248 approved: 0,

1249