registry / busa-cli / 0.9.3

busa-cli@0.9.3

Command-line client for the Busabase OpenAPI REST API. Talks to a local or remote `busabase server`. Short-name alias for busabase-cli.

Static Scan Results

scanned 1h ago · by rust-scanner

Static analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 4 file(s), 56.6 KB of source, external domains: 127.0.0.1, busabase.com, busabase.example.com

Source & flagged code

3 flagged

dist/chunk-C5BGRNMU.jsView file

Lines 186-226javascript

186 }

187 return out;

188}

189function writeDotEnvFile(updates) {

190 const merged = { ...loadDotEnvFile() };

191 for (const [key, value] of Object.entries(updates)) {

192 if (value === null) delete merged[key];

193 else merged[key] = value;

194 }

195 const path = dotEnvPath();

196 mkdirSync(join(homedir(), ".busabase"), { recursive: true });

197 const body = Object.entries(merged).map(([key, value]) => `${key}=${value}`).join("\n");

198 writeFileSync(path, body ? `${body}

199` : "", "utf8");

200 try {

201 chmodSync(path, 384);

202 } catch {

203 }

204}

205

206// src/login.ts

207import { spawn } from "child_process";

208import { createHash, randomBytes } from "crypto";

High

Child Process

Package source references child process execution.

dist/chunk-C5BGRNMU.jsView on unpkg · L206

209import { createServer } from "http";

210import { createInterface } from "readline/promises";

211import { DEFAULT_BASE_URL, normalizeBaseUrl } from "busabase-sdk";

212var CLI_CLIENT_ID = "busabase-cli";

213var CLI_CLIENT_PLATFORM = "cli";

214var OAUTH_TIMEOUT_MS = 5 * 60 * 1e3;

215var EXPIRES_AT_KEY = "BUSABASE_TOKEN_EXPIRES_AT";

216var SESSION_TOKEN_PREFIX = "bss_";

217var AUTO_REFRESH_THRESHOLD_MS = 2 * 24 * 60 * 60 * 1e3;

218var DEFAULT_LOCAL_URL = "http://localhost:15419";

219var base64url = (buffer) => buffer.toString("base64url");

220var isInteractive = () => Boolean(process.stdin.isTTY && process.stdout.isTTY);

221var say = (message) => {

222 process.stderr.write(`${message}

223`);

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/chunk-C5BGRNMU.jsView on unpkg · L206

224};

225var isLocalHost = (baseUrl) => {

226 try {

bin/busabase-cli.mjsView file

Lines 4-44javascript

4import { fileURLToPath } from "node:url";

6const here = dirname(fileURLToPath(import.meta.url));

7const pkgRoot = resolve(here, "..");

8const builtCli

Source & flagged code

3 flagged · loading source

dist/chunk-C5BGRNMU.jsView file

206// src/login.ts L207: import { spawn } from "child_process"; L208: import { createHash, randomBytes } from "crypto";

High

Child Process

Package source references child process execution.

dist/chunk-C5BGRNMU.jsView on unpkg · L206

206// src/login.ts L207: import { spawn } from "child_process"; L208: import { createHash, randomBytes } from "crypto"; L209: import { createServer } from "http"; L210: import { createInterface } from "readline/promises"; ... L219: var base64url = (buffer) => buffer.toString("base64url"); L220: var isInteractive = () => Boolean(process.stdin.isTTY && process.stdout.isTTY); L221: var say = (message) => { L222: process.stderr.write(`${message} L223: `);

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/chunk-C5BGRNMU.jsView on unpkg · L206

bin/busabase-cli.mjsView file

24delete process.env.BUSABASE_CLI_DELEGATED_ARGV; L25: const { runCli } = await import(resolve(pkgRoot, "dist/index.js")); L26: const delegatedArgv = JSON.parse(delegatedArgvJson);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/busabase-cli.mjsView on unpkg · L24

Findings

3 High3 Medium3 Low

HighChild Processdist/chunk-C5BGRNMU.js

HighShell

HighCommand Output Exfiltrationdist/chunk-C5BGRNMU.js

MediumDynamic Requirebin/busabase-cli.mjs

MediumNetwork

MediumEnvironment Vars

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

dist/chunk-C5BGRNMU.jsView file

Lines 186-226javascript

186 }

187 return out;

188}

189function writeDotEnvFile(updates) {

190 const merged = { ...loadDotEnvFile() };

191 for (const [key, value] of Object.entries(updates)) {

192 if (value === null) delete merged[key];

193 else merged[key] = value;

194 }

195 const path = dotEnvPath();

196 mkdirSync(join(homedir(), ".busabase"), { recursive: true });

197 const body = Object.entries(merged).map(([key, value]) => `${key}=${value}`).join("\n");

198 writeFileSync(path, body ? `${body}

199` : "", "utf8");

200 try {

201 chmodSync(path, 384);

202 } catch {

203 }

204}

205

206// src/login.ts

207import { spawn } from "child_process";

208import { createHash, randomBytes } from "crypto";

High

Child Process

Package source references child process execution.

dist/chunk-C5BGRNMU.jsView on unpkg · L206

209import { createServer } from "http";

210import { createInterface } from "readline/promises";

211import { DEFAULT_BASE_URL, normalizeBaseUrl } from "busabase-sdk";

212var CLI_CLIENT_ID = "busabase-cli";

213var CLI_CLIENT_PLATFORM = "cli";

214var OAUTH_TIMEOUT_MS = 5 * 60 * 1e3;

215var EXPIRES_AT_KEY = "BUSABASE_TOKEN_EXPIRES_AT";

216var SESSION_TOKEN_PREFIX = "bss_";

217var AUTO_REFRESH_THRESHOLD_MS = 2 * 24 * 60 * 60 * 1e3;

218var DEFAULT_LOCAL_URL = "http://localhost:15419";

219var base64url = (buffer) => buffer.toString("base64url");

220var isInteractive = () => Boolean(process.stdin.isTTY && process.stdout.isTTY);

221var say = (message) => {

222 process.stderr.write(`${message}

223`);

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/chunk-C5BGRNMU.jsView on unpkg · L206

224};

225var isLocalHost = (baseUrl) => {

226 try {

bin/busabase-cli.mjsView file

Lines 4-44javascript

4import { fileURLToPath } from "node:url";

6const here = dirname(fileURLToPath(import.meta.url));

7const pkgRoot = resolve(here, "..");

8const builtCli