registry / camstack / 1.1.8

camstack@1.1.8

CLI tool for managing and running CamStack server

Static Scan Results

scanned 9d ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsTelemetryUrlStrings

Manifest

WildcardDependency

scanned 5 file(s), 1.20 MB of source, external domains: docs.npmjs.com, huggingface.co, json-schema.org, registry.npmjs.org

Source & flagged code

4 flagged

dist/cli.jsView file

Lines 8-48javascript

8import { createRequire } from "module";

9import { fileURLToPath } from "url";

10import { dirname, resolve as resolve3 } from "path";

11import * as os4 from "os";

12import { parseArgs as parseArgs7 } from "util";

14// src/commands/serve.ts

15import { parseArgs } from "util";

16function buildServeEnv(opts) {

17 const env = {

18 CAMSTACK_MODE: "hub"

19 };

20 if (opts.port) env.PORT = opts.port;

21 if (opts.data) env.CAMSTACK_DATA = opts.data;

22 return env;

23}

24async function runServe(args) {

25 const { values } = parseArgs({

26 args: [...args],

27 options: {

28 port: { type: "string", short: "p" },

29 data: { type: "string", short: "d" }

30 },

31 strict: true,

32 allowPositionals: false

33 });

34 const opts = {

35 ...typeof values.port === "string" ? { port: values.port } : {},

36 ...typeof values.data === "string" ? { data: values.data } : {}

37 };

38 Object.assign(process.env, buildServeEnv(opts));

39 await import("@camstack/server/main.js");

40}

42// src/commands/agent.ts

43import * as os from "os";

44import { parseArgs as parseArgs2 } from "util";

45function buildAgentEnv(opts) {

46 const hubPort = opts.port ?? "4443";

47 const agentName = opts.name ?? `${os.hostname()}-${os.arch()}`;

48 return {

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli.jsView on unpkg · L28

Lines 63-103javascript

63 },

64 strict: true,

65 allowPositionals: false

66 });

67 if (typeof values.hub !== "string" || values.hub.length === 0) {

68 throw new Error("--hub is required (e.g. --hub 192.168.1.10)"

Lines 942-992javascript

942 if (isStale) {

943 fetchLatestVersion(pkgName).then((latest) => {

944 if (!latest) return;

945 writeCache({

946 lastCheckAt: Date.now(),

947 latestVersion: latest,

948 lastNotifiedVersion: cache?.lastNotifiedVersion ?? null

949

Source & flagged code

4 flagged · loading source

dist/cli.jsView file

83// src/commands/setup.ts L84: import { execFileSync } from "child_process"; L85: import * as path from "path";

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L83

962]; L963: process.stderr.write(lines.join("\n")); L964: } ... L971: function runNpmInstall(spec) { L972: return new Promise((resolve4, reject) => { L973: const proc = spawn("npm", ["install", "-g", spec], { stdio: "inherit" }); L974: proc.on("exit", (code) => {

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/cli.jsView on unpkg · L962

28Cross-file remote execution chain: dist/cli.js spawns dist/chunk-OG7AMM2R.js; helper contains network access plus dynamic code execution. L28: port: { type: "string", short: "p" }, L29: data: { type: "string", short: "d" } L30: }, ... L37: }; L38: Object.assign(process.env, buildServeEnv(opts)); L39: await import("@camstack/server/main.js"); ... L46: const hubPort = opts.port ?? "4443"; L47: const agentName = opts.name ?? `${os.hostname()}-${os.arch()}`; L48: return { ... L83: // src/commands/setup.ts L84: import { execFileSync } from "child_process"; L85: import * as path from "path";

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli.jsView on unpkg · L28

972return new Promise((resolve4, reject) => { L973: const proc = spawn("npm", ["install", "-g", spec], { stdio: "inherit" }); L974: proc.on("exit", (code) => { L975: if (code === 0) resolve4(); L976: else reject(new Error(`npm install -g ${spec} exited with code ${code}`)); L977: });

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli.jsView on unpkg · L972

Findings

5 High4 Medium5 Low

HighChild Processdist/cli.js

HighShell

HighCommand Output Exfiltrationdist/cli.js

HighCross File Remote Execution Contextdist/cli.js

HighRuntime Package Installdist/cli.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumWildcard Dependency

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

Source & flagged code

4 flagged

dist/cli.jsView file

Lines 8-48javascript

8import { createRequire } from "module";

9import { fileURLToPath } from "url";

10import { dirname, resolve as resolve3 } from "path";

11import * as os4 from "os";

12import { parseArgs as parseArgs7 } from "util";

14// src/commands/serve.ts

15import { parseArgs } from "util";

16function buildServeEnv(opts) {

17 const env = {

18 CAMSTACK_MODE: "hub"

19 };

20 if (opts.port) env.PORT = opts.port;

21 if (opts.data) env.CAMSTACK_DATA = opts.data;

22 return env;

23}

24async function runServe(args) {

25 const { values } = parseArgs({

26 args: [...args],

27 options: {

28 port: { type: "string", short: "p" },

29 data: { type: "string", short: "d" }

30 },

31 strict: true,

32 allowPositionals: false

33 });

34 const opts = {

35 ...typeof values.port === "string" ? { port: values.port } : {},

36 ...typeof values.data === "string" ? { data: values.data } : {}

37 };

38 Object.assign(process.env, buildServeEnv(opts));

39 await import("@camstack/server/main.js");

40}

42// src/commands/agent.ts

43import * as os from "os";

44import { parseArgs as parseArgs2 } from "util";

45function buildAgentEnv(opts) {

46 const hubPort = opts.port ?? "4443";

47 const agentName = opts.name ?? `${os.hostname()}-${os.arch()}`;

48 return {

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli.jsView on unpkg · L28

Lines 63-103javascript

63 },

64 strict: true,

65 allowPositionals: false

66 });

67 if (typeof values.hub !== "string" || values.hub.length === 0) {

68 throw new Error("--hub is required (e.g. --hub 192.168.1.10)"

Lines 942-992javascript

942 if (isStale) {

943 fetchLatestVersion(pkgName).then((latest) => {

944 if (!latest) return;

945 writeCache({

946 lastCheckAt: Date.now(),

947 latestVersion: latest,

948 lastNotifiedVersion: cache?.lastNotifiedVersion ?? null

949