registry / blokctl / 1.4.1

blokctl@1.4.1

cli for blok

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

No confirmed malicious attack surface found. The package is a CLI that creates Blok projects, stores its own login token, performs update checks, and includes bundled scaffold/runtime fixtures.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User invokes blokctl commands such as login, create project, dev, deploy, install, or runtime setup.

Impact

Expected project creation, local config/token writes, dependency/runtime setup commands, and Blok service interactions.

Mechanism

User-invoked CLI filesystem scaffolding, package/runtime command execution, API calls, and telemetry

Rationale

Static inspection found risky primitives, but they are aligned with an interactive project-scaffolding/deployment CLI and activate through user commands rather than install/import. The bundled private key is a localhost scaffold fixture, not evidence of exfiltration or persistence.

Evidence

package.jsondist/index.jsdist/commands/create/project.jsdist/services/posthog.jsdist/services/local-token-manager.jsdist/commands/login/index.jsdist/services/constants.jsdist/services/registry-manager.jsdist/scaffold-repo/triggers/websocket/src/Backplane.tsdist/scaffold-repo/triggers/grpc/localhost+2-key.pem~/.blok/blokctl.json~/.blok/token/token.enc~/.blok/blok<project>/.blok/README.md<project>/.env.local<project>/package.json<project>/src<project>/workflows

Decision evidence

public snapshot

AI called this Clean at 86.0% confidence as Benign with medium false-positive risk.

Evidence for block

dist/scaffold-repo/triggers/grpc/localhost+2-key.pem contains a bundled private key, but appears paired with localhost dev TLS fixture.

Evidence against

package.json has no install/preinstall/postinstall lifecycle hooks.
dist/index.js child_process use is an invoked CLI update check: npm view blokctl version.
dist/commands/create/project.js writes/copies scaffold files only when user runs create project.
dist/services/posthog.js sends CLI telemetry to PostHog and honors NO_NANOCTL_TELEMETRY; no credential harvesting seen.
dist/services/local-token-manager.js stores user login token locally under ~/.blok/token/token.enc; login sends token only to BLOK_URL /login.
dist/scaffold-repo/triggers/websocket/src/Backplane.ts dynamic import is optional @blokjs/trigger-pubsub adapter loading.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Source & flagged code

10 flagged

dist/scaffold-repo/triggers/grpc/localhost+2-key.pemView file

Lines 1-21text

1-----BEGIN PRIVATE KEY-----

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/scaffold-repo/triggers/grpc/localhost+2-key.pemView on unpkg · L1

Critical

Secret Pattern

RSA private key in dist/scaffold-repo/triggers/grpc/localhost+2-key.pem

dist/scaffold-repo/triggers/grpc/localhost+2-key.pemView on unpkg · L1

2MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDNjfXRKBwXU0IH

3ftJJGiR5w6Ccf2JfPZJgDdarhVgJjL2cy9d4AwIq4ydiuU+H8MnguzdGrFaCgYOB

4GfgEI4dOAGr1AInRVVHRWKvwGdLYm59dBRi5PQuU2EKVonQNsZy/qcOJSBzBSSAx

5PFCpTwrxj0j/Dug6LxIa1wB7UenYn5NjkFSF8F5HufE7l4goIVh0/fVgRripCsnk

6iMQFVhMr+2glX+19zTVkBl9EtAPbkXsegUUdnkOH2sd1TBN4HUibnktX+P1aIlhd

7p741Eni42jU92u33iZasvvnkA94Q2MhBhzx3lgqAAcHcePzBI9yOEQbTqik4Nkpv

8moqqDFBbAgMBAAECggEACDu0aeFCZsjF70jsIVNzvJDSYRJVHV14/HHxdENOCGvj

9uGENy1fLgW5ByJmFjvtdCqxVBXanrGiFnOkuXvQRWlV380JHQuQ497qmgGJ4aIar

10Nm2a1OiWCysyV43/OgEwNxkUpO4HgNJuAKrazD1HQe+sS9MMCDCUeBC+izH3vN5s

119LWOrhde+ZwCkHJgRxp6V5HBJXU/27T02ZjgvPXupzXQ2ozRgx2gn5lLvJJfqG/h

12jEMi9qyuwoRUL4QXDg3TNHHSllnENdRrVJr7VsvYpRpQogVsr4V7zIZiFkAcbuC4

13kMuHeahkjqmlSYVuz9DxPHcmFRW/B5MI5MLQwCvI6QKBgQD61emfMrA323QIWF5l

14hbNQBS3hje9pwN27EU3QmCq0z/2Ja0TTaSeNSdlQAfMEGHsO5tL0ldqS267uqs5r

15clrukrOFmcARZiHne5U1uMcWgYvRmPTTdwng1lQSBuLo7XR9f6sW3u1csOJ8PY4w

16oKtsAIKm0r53iVRCPpd7D9Lr3QKBgQDRyWIccS93kI2rmRxkg4nhniCP8uAacYHy

17ZEZUFpm0p23rLKF7zlGd1xZmwKV5lnd1278qBt9YMvDGw6Mlt3WTQUh9XQ3b5q1V

18xOHfyn2QvWfFbX/tWousq2RP3CJakGiKMefSx8aZB/Vwat3kSdgz825Vcr9oN2j1

19lZZemRlllwKBgD+K1QXpN07PHxPGHxOkzQnmZfsPk6i8nO74sTe4dIkdb2LSc7sC

20lmxqWsyz0bYl5Xae7q3bEGXHlQcM6gG6FGL/cs7TZh6COvCDFAdp6bU/2AWes9al

21/zCf2ug+KllLXgk0wEio7IRgot9KUKzs5sATWQWduXZaqaemZ4VbOtlZAoGAK457

dist/index.jsView file

Lines 1-21javascript

1#! /usr/bin/env bun

2import child_process from "node:child_process";

3import os from "node:os";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L1

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/index.jsView on unpkg · L1

dist/commands/create/project.jsView file

Lines 408-448javascript

408 }

409 else if (entry.isDirectory()) {

410 if (entry.name === "__tests__")

411 continue;

412 if (entry.name

dist/scaffold-repo/triggers/websocket/src/Backplane.tsView file

Lines 138-168typescript

138 const topicEnv = process.env.BLOK_WS_BACKPLANE_TOPIC;

139 const groupEnv = process.env.BLOK_WS_BACKPLANE_GROUP;

140 return {

141 provider: envProvider

dist/services/observability-stack.real-prometheus.test.jsView file

Lines 1-21javascript

1import { spawnSync } from "node:child_process";

2import { randomBytes } from "node:crypto";

3import { describe, expect, it } from "vitest";

4const RUN =

dist/scaffold-repo/sdks/python3/bin/worker.pyView file

•path = dist/scaffold-repo/sdks/python3/bin/worker.py kind = build_helper sizeBytes = 2018 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/scaffold-repo/sdks/python3/bin/worker.pyView on unpkg

dist/scaffold-repo/sdks/python3/tests/test_grpc_server.pyView file

•path = dist/scaffold-repo/sdks/python3/tests/test_grpc_server.py kind = payload_in_excluded_dir sizeBytes = 15496 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

dist/scaffold-repo/sdks/python3/tests/test_grpc_server.pyView on unpkg

Source & flagged code

10 flagged · loading source

dist/scaffold-repo/triggers/grpc/localhost+2-key.pemView file

1patternName = private_key_rsa severity = critical line = 1 matchedText = -----BEG...----

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/scaffold-repo/triggers/grpc/localhost+2-key.pemView on unpkg · L1

1patternName = private_key_rsa severity = critical line = 1 matchedText = -----BEG...----

Critical

Secret Pattern

RSA private key in dist/scaffold-repo/triggers/grpc/localhost+2-key.pem

dist/scaffold-repo/triggers/grpc/localhost+2-key.pemView on unpkg · L1

dist/index.jsView file

1#! /usr/bin/env bun L2: import child_process from "node:child_process"; L3: import os from "node:os";

High

Child Process

Package source references child process execution.

Findings

3 Critical5 High6 Medium6 Low

CriticalCritical Secretdist/scaffold-repo/triggers/grpc/localhost+2-key.pem

CriticalPrevious Version Dangerous Deltadist/commands/create/project.js

CriticalSecret Patterndist/scaffold-repo/triggers/grpc/localhost+2-key.pem

HighChild Processdist/index.js

HighShell

HighSame File Env Network Executiondist/services/observability-stack.real-prometheus.test.js

HighCross File Remote Execution Contextdist/index.js

HighPayload In Excluded Dirdist/scaffold-repo/sdks/python3/tests/test_grpc_server.py

MediumDynamic Requiredist/scaffold-repo/triggers/websocket/src/Backplane.ts

MediumNetwork

MediumEnvironment Vars