registry / devswitch-cli / 1.0.4

devswitch-cli@1.0.4

Standalone command-line tool for DevSwitch — manage multiple Git profiles and SSH keys. Shares its database with the DevSwitch desktop app.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 113 KB of source, external domains: api.github.com, github.com, registry.npmjs.org

Source & flagged code

5 flagged

package.jsonView file

Lines 1-38json

2 "name": "devswitch-cli",

3 "version": "1.0.4",

4 "description": "Standalone command-line tool for DevSwitch — manage multiple Git profiles and SSH keys. Shares its database with the DevSwitch desktop app.",

5 "type": "module",

6 "bin": {

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/setup-completion.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

bin/devswitch.cjsView file

540// ../core/services/sshKeyService.ts L541: var import_child_process = require("child_process"); L542: var import_util = require("util");

High

Child Process

Package source references child process execution.

bin/devswitch.cjsView on unpkg · L540

3315try { L3316: (0, import_child_process7.execSync)("npm install -g devswitch-cli", { stdio: "inherit" }); L3317: success("CLI updated successfully!");

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/devswitch.cjsView on unpkg · L3315

34function getDataDir() { L35: const override = process.env.DEVSWITCH_DATA_DIR; L36: if (override && override.trim()) { ... L39: const platform2 = os.platform(); L40: const home = os.homedir(); L41: if (platform2 === "win32") { ... L113: } L114: const parsed = JSON.parse(raw); L115: return { ...structuredClone(this.defaults), ...parsed }; ... L139: data[key] = value; L140: this.write(data); L141: }

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

bin/devswitch.cjsView on unpkg · L34

scripts/setup-completion.cjsView file

3package = devswitch-cli; repositoryIdentity = devswitch; dependency = omelette L3: try { L4: const omelette = require('omelette'); L5: const completion = omelette('devswitch <action> <profile>');

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

scripts/setup-completion.cjsView on unpkg · L3

Findings

4 High4 Medium5 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processbin/devswitch.cjs

HighCopied Package Dependency Bridgescripts/setup-completion.cjs

HighRuntime Package Installbin/devswitch.cjs

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencebin/devswitch.cjs

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

bin/devswitch.cjsView file

Lines 14-54javascript

14 for (let key of __getOwnPropNames(from))

15 if (!__hasOwnProp.call(to, key) && key !== except)

16 __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });

17 }

18 return to;

19};

20var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(

21 // If the importer is in node compatibility mode or this is not an ESM

22 // file that has been converted to a CommonJS file using a Babel-

23 // compatible transform (i.e. "__esModule" has not been set), then set

24 // "default" to the CommonJS "module.exports" for node compatibility.

25 isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,

26 mod

27));

29// ../core/paths.ts

30var os = __toESM(require("os"), 1);

31var path = __toESM(require("path"), 1);

32var fs = __toESM(require("fs"), 1);

33var APP_DIR_NAME = "devswitch";

34function getDataDir() {

35 const override = process.env.DEVSWITCH_DATA_DIR;

36 if (override && override.trim()) {

37 return override.trim();

38 }

39 const platform2 = os.platform();

40 const home = os.homedir();

41 if (platform2 === "win32") {

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

bin/devswitch.cjsView on unpkg · L34

42 const appData = process.env.APPDATA || path.join(home, "AppData", "Roaming");

43 return path.join(appData, APP_DIR_NAME);

44 }

45 if (platform2 === "darwin") {

46 return path.join(home, "Library", "Application Support", APP_DIR_NAME);

47 }

48 const xdg = process.env.XDG_CONFIG_HOME;

49 const base = xdg && xdg.trim() ? xdg.trim() : path.join(home, ".config");

50 return path.join(base, APP_DIR_NAME);

51}

52function ensureDataDir() {

53 const dir = getDataDir();

54 if (!fs.existsSync(dir)) {

Lines 520-560javascript

520 return true;

521 }

522 return false;

523 } catch (e) {

524 console.error(`Failed to delete backup ${filename}:`, e);

525 throw e;

526 }

527 }

528 async triggerAutoBackup() {

Lines 3295-3335javascript

3295 )})`

3296 );

3297 } else {

3298 info(`CLI Version: ${c.green(CLI_VERSION)} (Up to date)`);

3299 }

3300 if (latestApp) {

3301 info(`Latest Desktop App: ${c.green(latestApp)}`);

3302 info(

3303 `Download page