registry / devswitch-cli / 1.0.4

devswitch-cli@1.0.4

Standalone command-line tool for DevSwitch — manage multiple Git profiles and SSH keys. Shares its database with the DevSwitch desktop app.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 113 KB of source, external domains: api.github.com, github.com, registry.npmjs.org

Source & flagged code

5 flagged

package.jsonView file

Lines 1-38json

2 "name": "devswitch-cli",

3 "version": "1.0.4",

4 "description": "Standalone command-line tool for DevSwitch — manage multiple Git profiles and SSH keys. Shares its database with the DevSwitch desktop app.",

5 "type": "module",

6 "bin": {

7 "devswitch": "bin/devswitch.cjs"

8 },

9 "files": [

10 "bin/",

11 "scripts/",

12 "README.md"

13 ],

14 "scripts": {

15 "build": "node ./build.mjs",

16 "dev": "node --experimental-strip-types ./src/index.ts",

17 "prepublishOnly": "npm run build",

18 "postinstall": "node scripts/setup-completion.cjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L18

19 },

20 "engines": {

21 "node": ">=18"

22 },

23 "keywords": [

24 "git",

25 "ssh",

26 "ssh-keys",

27 "profile",

28 "cli",

29 "devswitch"

30 ],

31 "author": {

32 "name": "umesh-saini",

33 "email": "umeshsaini8085@gmail.com"

34 },

35 "license": "MIT",

36 "homepage": "https://github.com/umesh-saini/DevSwitch/tree/main/cli#readme",

37 "repository": {

38 "type": "git",

bin/devswitch.cjsView file

Lines 14-54javascript

14 for (let key of __getOwnPropNames(from))

15 if (!__hasOwnProp.call(to, key) && key !== except)

16 __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });

scripts/setup-completion.cjsView file

Lines 1-12javascript

1#!/usr/bin/env node

3try {

4 const omelette = require('omelette');

5 const completion = omelette('devswitch <action> <profile>');

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

scripts/setup-completion.cjs

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/setup-completion.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

bin/devswitch.cjsView file

540// ../core/services/sshKeyService.ts L541: var import_child_process = require("child_process"); L542: var import_util = require("util");

High

Child Process

Package source references child process execution.

bin/devswitch.cjsView on unpkg · L540

3315try { L3316: (0, import_child_process7.execSync)("npm install -g devswitch-cli", { stdio: "inherit" }); L3317: success("CLI updated successfully!");

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/devswitch.cjsView on unpkg · L3315

34function getDataDir() { L35: const override = process.env.DEVSWITCH_DATA_DIR; L36: if (override && override.trim()) { ... L39: const platform2 = os.platform(); L40: const home = os.homedir(); L41: if (platform2 === "win32") { ... L113: } L114: const parsed = JSON.parse(raw); L115: return { ...structuredClone(this.defaults), ...parsed }; ... L139: data[key] = value; L140: this.write(data); L141: }

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

bin/devswitch.cjsView on unpkg · L34

scripts/setup-completion.cjsView file

3package = devswitch-cli; repositoryIdentity = devswitch; dependency = omelette L3: try { L4: const omelette = require('omelette'); L5: const completion = omelette('devswitch <action> <profile>');

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

scripts/setup-completion.cjsView on unpkg · L3

Findings

4 High4 Medium5 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processbin/devswitch.cjs

HighCopied Package Dependency Bridgescripts/setup-completion.cjs

HighRuntime Package Installbin/devswitch.cjs

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencebin/devswitch.cjs

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

5 flagged

package.jsonView file

Lines 1-38json

2 "name": "devswitch-cli",

3 "version": "1.0.4",

4 "description": "Standalone command-line tool for DevSwitch — manage multiple Git profiles and SSH keys. Shares its database with the DevSwitch desktop app.",

5 "type": "module",

6 "bin": {

7 "devswitch": "bin/devswitch.cjs"

8 },

9 "files": [

10 "bin/",

11 "scripts/",

12 "README.md"

13 ],

14 "scripts": {

15 "build": "node ./build.mjs",

16 "dev": "node --experimental-strip-types ./src/index.ts",

17 "prepublishOnly": "npm run build",

18 "postinstall": "node scripts/setup-completion.cjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L18

19 },

20 "engines": {

21 "node": ">=18"

22 },

23 "keywords": [

24 "git",

25 "ssh",

26 "ssh-keys",

27 "profile",

28 "cli",

29 "devswitch"

30 ],

31 "author": {

32 "name": "umesh-saini",

33 "email": "umeshsaini8085@gmail.com"

34 },

35 "license": "MIT",

36 "homepage": "https://github.com/umesh-saini/DevSwitch/tree/main/cli#readme",

37 "repository": {

38 "type": "git",

bin/devswitch.cjsView file

Lines 14-54javascript

14 for (let key of __getOwnPropNames(from))

15 if (!__hasOwnProp.call(to, key) && key !== except)

16 __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });

scripts/setup-completion.cjsView file

Lines 1-12javascript

1#!/usr/bin/env node

3try {

4 const omelette = require('omelette');

5 const completion = omelette('devswitch <action> <profile>');

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

scripts/setup-completion.cjs

Lines 520-560javascript

520 return true;

521 }

522 return false;

523 } catch (e) {

524 console.error(`Failed to delete backup ${filename}:`, e);

525 throw e;

526 }

527 }

528 async triggerAutoBackup() {

529 if (this.isAutoBackupEnabled()) {

530 try {

531 await this.createBackup();

532 } catch (err) {

533 console.error("Auto backup failed:", err);

534 }

535 }

536 }

537};

538var backupService = new BackupService();

539

540// ../core/services/sshKeyService.ts

541var import_child_process = require("child_process");

542var import_util = require("util");

High

Child Process

Package source references child process execution.

bin/devswitch.cjsView on unpkg · L540

543var path4 = __toESM(require("path"), 1);

544var fs6 = __toESM(require("fs"), 1);

545var import_os3 = __toESM(require("os"), 1);

546var execAsync = (0, import_util.promisify)(import_child_process.exec);

547var SSHKeyService = class {

548 getSshDir() {

549 return path4.join(import_os3.default.homedir(), ".ssh");

550 }

551 async generateKey(params) {

552 try {

553 const sshDir = this.getSshDir();

554 if (!fs6.existsSync(sshDir)) {

555 fs6.mkdirSync(sshDir, { mode: 448 });

556 }

557 const keyPath = path4.join(sshDir, params.name);

558 if (fs6.existsSync(keyPath)) {

559 return {

560 success: false,

Lines 3295-3335javascript

3295 )})`

3296 );

3297 } else {

3298 info(`CLI Version: ${c.green(CLI_VERSION)} (Up to date)`);

3299 }

3300 if (latestApp) {

3301 info(`Latest Desktop App: ${c.green(latestApp)}`);

3302 info(

3303 `Download page: https://github.com/umesh-saini/DevSwitch/releases/tag/v${latestApp}`

3304 );

3305 }

3306 console.log("");

3307 if (latestCli !== CLI_VERSION) {

3308 if (process.stdin.isTTY) {

3309 const runUpdate = await confirm(

3310 "Would you like to update the CLI to the latest version now?",

3311 true

3312 );

3313 if (runUpdate) {

3314 info("Running: npm install -g devswitch-cli...");

3315 try {

3316 (0, import_child_process7.execSync)("npm install -g devswitch-cli", { stdio: "inherit" });

3317 success("CLI updated successfully!");

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/devswitch.cjsView on unpkg · L3315

3318 } catch (err) {

3319 error(

3320 "Failed to update CLI. Try running: sudo npm install -g devswitch-cli"

3321 );

3322 }

3323 }

3324 } else {

3325 info(

3326 `To update the CLI, run: ${c.cyan("npm install -g devswitch-cli")}`

3327 );

3328 }

3329 } else {

3330 success("Your DevSwitch CLI is already up to date!");

3331 }

3332 return 0;

3333}

3334

3335// src/commands/installApp.ts