registry  /  ethos-cli  /  0.7.22

ethos-cli@0.7.22

Commander-based CLI for Ethos table operations

Static Scan Results

scanned 11d ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
Supply chain
HighEntropyStringsUrlStrings
Manifest
NoLicense
scanned 37 file(s), 161 KB of source, external domains: 127.0.0.1, api.ethos.hello-cluster.com, ethos.hello-cluster.com

Source & flagged code

3 flagged · loading source
package.jsonView file
•scripts.postinstall = node ./postinstall.cjs
High
Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg
•scripts.postinstall = node ./postinstall.cjs
Medium
Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg
dist/commands/hooks.jsView file
133"```js", L134: `const { setupBrowserRuntime } = await import(${JSON.stringify(browserClientPath)});`, L135: `await setupBrowserRuntime({ globals: globalThis });`,
Medium
Dynamic Require

Package source references dynamic require/import behavior.

dist/commands/hooks.jsView on unpkg · L133

Findings

1 High5 Medium6 Low
HighInstall Time Lifecycle Scriptspackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requiredist/commands/hooks.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License