registry / burnboard-cli / 0.2.2

burnboard-cli@0.2.2

Connect local AI coding token usage to BurnBoard

Static Scan Results

scanned 8h ago · by rust-scanner

Static analysis flagged 9 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 1 file(s), 5.12 KB of source, external domains: burnboard-public.vercel.app

Source & flagged code

3 flagged

cli.mjsView file

Lines 1-24javascript

1#!/usr/bin/env node

2import fs from "node:fs";

3import os from "node:os";

4import path from "node:path";

5import { spawnSync } from "node:child_process";

6import { fileURLToPath } from "node:url";

8const packageRoot = path.dirname(fileURLToPath(import.meta.url));

9const installRoot = path.join(packageRoot, "install");

10const burnboardRoot = path.join(os.homedir(), ".burnboard");

11const cliVersion = JSON.parse(fs.readFileSync(path.join(packageRoot, "package.json"), "utf8")).version;

12const installedVersionPath = path.join(burnboardRoot, "cli-version");

13const lastUpdateCheckPath = path.join(burnboardRoot, "last-update-check");

14const command = process.argv[2] || "help";

15const args = process.argv.slice(3);

17function option(name, fallback) {

18 const index = args.indexOf(name);

19 return index >= 0 ? args[index + 1] : fallback;

20}

22function run(executable, runArgs) {

23 const result = spawnSync(executable, runArgs, { stdio: "inherit" });

24 if (result.error) throw result.error;

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

cli.mjsView on unpkg · L4

•matchType = previous_version_dangerous_delta matchedPackage = burnboard-cli@0.2.0 matchedIdentity = npm:YnVybmJvYXJkLWNsaQ:0.2.0 similarity = 0.667 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

cli.mjsView on unpkg

install/burnboard-setup.shView file

•path = install/burnboard-setup.sh kind = build_helper sizeBytes = 3359 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install/burnboard-setup.shView on unpkg

Source & flagged code

3 flagged · loading source

cli.mjsView file

4import path from "node:path"; L5: import { spawnSync } from "node:child_process"; L6: import { fileURLToPath } from "node:url"; ... L9: const installRoot = path.join(packageRoot, "install"); L10: const burnboardRoot = path.join(os.homedir(), ".burnboard"); L11: const cliVersion = JSON.parse(fs.readFileSync(path.join(packageRoot, "package.json"), "utf8")).version; L12: const installedVersionPath = path.join(burnboardRoot, "cli-version"); ... L24: if (result.error) throw result.error; L25: process.exitCode = result.status ?? 1; L26: return result.status ?? 1; ... L30: const name = nameOverride || option("--name", args.find((value) => !value.startsWith("-"))); L31: const server = option("--server", "https://burnboard-public.vercel.app");

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code