registry / camstack / 1.1.22

camstack@1.1.22

⚠ Under review

CLI tool for managing and running CamStack server

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 15 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsTelemetryUrlStrings

Manifest

WildcardDependency

scanned 5 file(s), 1.26 MB of source, external domains: docs.npmjs.com, huggingface.co, json-schema.org, registry.npmjs.org

Source & flagged code

5 flagged

dist/cli.jsView file

Lines 8-48javascript

8import { createRequire } from "module";

9import { fileURLToPath } from "url";

10import { dirname, resolve as resolve3 } from "path";

11import * as os4 from "os";

12import { parseArgs as parseArgs7 } from "util";

14// src/commands/serve.ts

15import { parseArgs } from "util";

16function buildServeEnv(opts) {

17 const env = {

18 CAMSTACK_MODE: "hub"

19 };

20 if (opts.port) env.PORT = opts.port;

21 if (opts.data) env.CAMSTACK_DATA = opts.data;

22 return env;

23}

24async function runServe(args) {

25 const { values } = parseArgs({

26 args: [...args],

27 options: {

28 port: { type: "string", short: "p" },

29 data: { type: "string", short: "d" }

30 },

31 strict: true,

32 allowPositionals: false

33 });

34 const opts = {

35 ...typeof values.port === "string" ? { port: values.port } : {},

36 ...typeof values.data === "string" ? { data: values.data } : {}

37 };

38 Object.assign(process.env, buildServeEnv(opts));

39 await import("@camstack/server/main.js");

40}

42// src/commands/agent.ts

43import * as os from "os";

44import { parseArgs as parseArgs2 } from "util";

45function buildAgentEnv(opts) {

46 const hubPort = opts.port ?? "4443";

47 const agentName = opts.name ?? `${os.hostname()}-${os.arch()}`;

48 return {

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli.jsView on unpkg · L28

Lines 63-103javascript

63 },

64 strict: true,

65 allowPositionals: false

66 });

67 if (typeof values.hub !== "string" || values.hub.length === 0) {

68 throw new Error("--hub is required (e.g. --hub 192.168.1.10)"

Lines 1006-1056javascript

1006 if (isStale) {

1007 fetchLatestVersion(pkgName).then((latest) => {

1008 if (!latest) return;

1009 writeCache({

1010 lastCheckAt: Date.now(),

1011 latestVersion: latest,

1012 lastNotifiedVersion: cache?.lastNotifiedVersion ?? null

•matchType = previous_version_dangerous_delta matchedPackage = camstack@1.1.19 matchedIdentity = npm:Y2Ftc3RhY2s:1.1.19 similarity = 0.600 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.jsView on unpkg

Source & flagged code

5 flagged · loading source

dist/cli.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.jsView on unpkg

83// src/commands/setup.ts L84: import { execFileSync } from "child_process"; L85: import * as path from "path";

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L83

1026]; L1027: process.stderr.write(lines.join("\n")); L1028: } ... L1035: function runNpmInstall(spec) { L1036: return new Promise((resolve4, reject) => { L1037: const proc = spawn("npm", ["install", "-g", spec], { stdio: "inherit" }); L1038: proc.on("exit", (code) => {

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/cli.jsView on unpkg · L1026

28Cross-file remote execution chain: dist/cli.js spawns dist/chunk-CFJI2NBD.js; helper contains network access plus dynamic code execution. L28: port: { type: "string", short: "p" }, L29: data: { type: "string", short: "d" } L30: }, ... L37: }; L38: Object.assign(process.env, buildServeEnv(opts)); L39: await import("@camstack/server/main.js"); ... L46: const hubPort = opts.port ?? "4443"; L47: const agentName = opts.name ?? `${os.hostname()}-${os.arch()}`; L48: return { ... L83: // src/commands/setup.ts L84: import { execFileSync } from "child_process"; L85: import * as path from "path";

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli.jsView on unpkg · L28

1036return new Promise((resolve4, reject) => { L1037: const proc = spawn("npm", ["install", "-g", spec], { stdio: "inherit" }); L1038: proc.on("exit", (code) => { L1039: if (code === 0) resolve4(); L1040: else reject(new Error(`npm install -g ${spec} exited with code ${code}`)); L1041: });

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli.jsView on unpkg · L1036

Findings

1 Critical5 High4 Medium5 Low

CriticalPrevious Version Dangerous Deltadist/cli.js

HighChild Processdist/cli.js

HighShell

HighCommand Output Exfiltrationdist/cli.js

HighCross File Remote Execution Contextdist/cli.js

HighRuntime Package Installdist/cli.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumWildcard Dependency

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

Source & flagged code

5 flagged

dist/cli.jsView file

Lines 8-48javascript

8import { createRequire } from "module";

9import { fileURLToPath } from "url";

10import { dirname, resolve as resolve3 } from "path";

11import * as os4 from "os";

12import { parseArgs as parseArgs7 } from "util";

14// src/commands/serve.ts

15import { parseArgs } from "util";

16function buildServeEnv(opts) {

17 const env = {

18 CAMSTACK_MODE: "hub"

19 };

20 if (opts.port) env.PORT = opts.port;

21 if (opts.data) env.CAMSTACK_DATA = opts.data;

22 return env;

23}

24async function runServe(args) {

25 const { values } = parseArgs({

26 args: [...args],

27 options: {

28 port: { type: "string", short: "p" },

29 data: { type: "string", short: "d" }

30 },

31 strict: true,

32 allowPositionals: false

33 });

34 const opts = {

35 ...typeof values.port === "string" ? { port: values.port } : {},

36 ...typeof values.data === "string" ? { data: values.data } : {}

37 };

38 Object.assign(process.env, buildServeEnv(opts));

39 await import("@camstack/server/main.js");

40}

42// src/commands/agent.ts

43import * as os from "os";

44import { parseArgs as parseArgs2 } from "util";

45function buildAgentEnv(opts) {

46 const hubPort = opts.port ?? "4443";

47 const agentName = opts.name ?? `${os.hostname()}-${os.arch()}`;

48 return {

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli.jsView on unpkg · L28

Lines 63-103javascript

63 },

64 strict: true,

65 allowPositionals: false

66 });

67 if (typeof values.hub !== "string" || values.hub.length === 0) {

68 throw new Error("--hub is required (e.g. --hub 192.168.1.10)"

Lines 1006-1056javascript

1006 if (isStale) {

1007 fetchLatestVersion(pkgName).then((latest) => {

1008 if (!latest) return;

1009 writeCache({

1010 lastCheckAt: Date.now(),

1011 latestVersion: latest,

1012 lastNotifiedVersion: cache?.lastNotifiedVersion ?? null

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.jsView on unpkg