Loading npm security reports…

byob-cli@0.2.50: Suspicious npm security report (Warn) | LPM Firewall

registry / byob-cli / 0.2.50

byob-cli@0.2.50

BYOB CLI for Codex, Claude Code, Antigravity, and BYOB project workflows.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 163 KB of source, external domains: air.api.byob.studio, byob.studio, prim.api.byob.studio

Source & flagged code

6 flagged

bin/byob.jsView file

Lines 1-23javascript

1#!/usr/bin/env node

3import { createInterface } from "node:readline";

4import { spawn, spawnSync } from "node:child_process";

5import { chmodSync, copyFileSync, existsSync, mkdirSync, readdirSync, readFileSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";

High

Child Process

Package source references child process execution.

bin/byob.jsView on unpkg · L3

6import { createHash, randomBytes } from "node:crypto";

7import net from "node:net";

8import tls from "node:tls";

9import dns from "node:dns/promises";

10import { dirname, join } from "node:path";

11import { fileURLToPath } from "node:url";

12import { homedir } from "node:os";

14const PROD_AIR_URL = "https://air.api.byob.studio";

15const PROD_PRIM_URL = "https://prim.api.byob.studio";

16const PROD_FRONTEND_URL = "https://byob.studio";

17const DEFAULT_AIR_URL = process.env.BYOB_AIR_URL || PROD_AIR_URL;

18const DEFAULT_PRIM_URL = process.env.BYOB_PRIM_URL || PROD_PRIM_URL;

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

bin/byob.jsView on unpkg · L3

19const PACKAGE_ROOT = dirname(dirname(fileURLToPath(import.meta.url)));

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/byob.jsView on unpkg · L3

Low

Weak Crypto

Package source references weak cryptographic algorithms.

bin/byob.jsView on unpkg · L3

20const PACKAGE_VERSION = JSON.parse(readFileSync(join(PACKAGE_ROOT, "package.json"), "utf8")).version;

21const BYOB_REAUTH_HINT =

22 'Reauthenticate BYOB by running the install command for your agent platform ' +

23 '(e.g. `byob codex install`, `byob claude install`, or `byob gemini install`), ' +

Lines 2172-2212javascript

2172 scope: project.target_scope === "byob_account_project_creation" || !project.project_id ? "account" : "project",

2173 byob_project: project,

2174 };

2175}

2176

2177

Lines 4034-4074javascript

4034 .map((match) => [match[1], match[2]]),

4035 );

4036 if (!details.codex_path) {

4037 throw new Error("codex is not available on the remote SSH PATH.");

4038

Source & flagged code

6 flagged · loading source

bin/byob.jsView file

High

Child Process

Package source references child process execution.

bin/byob.jsView on unpkg · L3

3import { createInterface } from "node:readline"; L4: import { spawn, spawnSync } from "node:child_process"; L5: import { chmodSync, copyFileSync, existsSync, mkdirSync, readdirSync, readFileSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs"; L6: import { createHash, randomBytes } from "node:crypto"; L7: import net from "node:net"; L8: import tls from "node:tls"; ... L16: const PROD_FRONTEND_URL = "https://byob.studio"; L17: const DEFAULT_AIR_URL = process.env.BYOB_AIR_URL || PROD_AIR_URL; L18: const DEFAULT_PRIM_URL = process.env.BYOB_PRIM_URL || PROD_PRIM_URL;

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

bin/byob.jsView on unpkg · L3

2192} L2193: return `${logo}\n\nBuild Your Own Buzz\nhttps://byob.studio\n`; L2194: } ... L2196: function printWizardStep(message) { L2197: process.stdout.write(`\n> ${message}\n`); L2198: } ... L2200: function commandExists(command) { L2201: const result = spawnSync( L2202: process.platform === "win32" ? "where" : "command",

Findings

5 High4 Medium5 Low

HighChild Processbin/byob.js

HighShell

HighSame File Env Network Executionbin/byob.js

HighCommand Output Exfiltrationbin/byob.js

HighSandbox Evasion Gated Capabilitybin/byob.js

MediumDynamic Requirebin/byob.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowWeak Cryptobin/byob.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

6 flagged

bin/byob.jsView file

Lines 1-23javascript

1#!/usr/bin/env node

3import { createInterface } from "node:readline";

4import { spawn, spawnSync } from "node:child_process";

5import { chmodSync, copyFileSync, existsSync, mkdirSync, readdirSync, readFileSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";

High

Child Process

Package source references child process execution.

bin/byob.jsView on unpkg · L3

6import { createHash, randomBytes } from "node:crypto";

7import net from "node:net";

8import tls from "node:tls";

9import dns from "node:dns/promises";

10import { dirname, join } from "node:path";

11import { fileURLToPath } from "node:url";

12import { homedir } from "node:os";

14const PROD_AIR_URL = "https://air.api.byob.studio";

15const PROD_PRIM_URL = "https://prim.api.byob.studio";

16const PROD_FRONTEND_URL = "https://byob.studio";

17const DEFAULT_AIR_URL = process.env.BYOB_AIR_URL || PROD_AIR_URL;

18const DEFAULT_PRIM_URL = process.env.BYOB_PRIM_URL || PROD_PRIM_URL;

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

bin/byob.jsView on unpkg · L3

19const PACKAGE_ROOT = dirname(dirname(fileURLToPath(import.meta.url)));

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/byob.jsView on unpkg · L3

Low

Weak Crypto

Package source references weak cryptographic algorithms.

bin/byob.jsView on unpkg · L3

20const PACKAGE_VERSION = JSON.parse(readFileSync(join(PACKAGE_ROOT, "package.json"), "utf8")).version;

21const BYOB_REAUTH_HINT =

22 'Reauthenticate BYOB by running the install command for your agent platform ' +

23 '(e.g. `byob codex install`, `byob claude install`, or `byob gemini install`), ' +

Lines 2172-2212javascript

2172 scope: project.target_scope === "byob_account_project_creation" || !project.project_id ? "account" : "project",

2173 byob_project: project,

2174 };

2175}

2176

2177

Lines 4034-4074javascript

4034 .map((match) => [match[1], match[2]]),

4035 );

4036 if (!details.codex_path) {

4037 throw new Error("codex is not available on the remote SSH PATH.");

4038