registry / figura-cli / 0.9.0

figura-cli@0.9.0

Command-line client for the Figura visualization SaaS

Static Scan Results

scanned 9d ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystem

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 881 KB of source, external domains: api.figura.so, figura.so, github.com, json-schema.org, raw.githubusercontent.com

Source & flagged code

4 flagged

dist/index.jsView file

Lines 1-38javascript

1#!/usr/bin/env node

2import{createRequire as Pm}from"node:module";var Lm=Object.create;var{getPrototypeOf:Fm,defineProperty:rn,getOwnPropertyNames:Sm}=Object;var Tm=Object.prototype.hasOwnProperty;function Hm(i){return this[i]}var Dm,km,Ln=(i,a,n)=>{var c=i!=null&&typeof i==="object";if(c){var p=a?Dm??=new WeakMap:km??=new WeakMap,o=p.get(i);if(o)return o}n=i!=null?Lm(Fm(i)):{};let s=a||!i||!i.__esModule?rn(n,"default",{value:i,enumerable:!0}):n;for(let e of Sm(i))if(!Tm.call(s,e))rn(s,e,{get:Hm.bind(i,e),enumerable:!0});if(c)p.set(i,s);return s};var G=(i,a)=>()=>(a||i((a={exports:{}}).exports,a),a.exports);var Om ...

3 * mime-types

6 * MIT Licensed

8`;q.DEFAULT_CONTENT_TYPE="application/octet-stream";q.prototype.append=function(i,a,n){if(n=n||{},typeof n==="string")n={filename:n};var c=xc.prototype.append.bind(this);if(typeof a==="number"||a==null)a=String(a);if(Array.isArray(a)){this._error(Error("Arrays are not supported."));return}var p=this._multiPartHeader(i,a,n),o=this._multiPartFooter();c(p),c(a),c(o),this._trackLength(p,a,n)};q.prototype._trackLength=function(i,a,n){var c=0;if(n.knownLength!=null)c+=Number(n.knownLength);else if(Buffer.isBuffer(a))c=a.length;else if(typeof a==="string")c=Buffer.byteLength(a);if(this._valueLength+= ...

9`).join(`

10`+o),i.push(p+"m+"+Gn.exports.humanize(this.diff)+"\x1B[0m")}else i[0]=Vv()+a+" "+i[0]}function Vv(){if(ae.inspectOpts.hideDate)return"";return new Date().toISOString()+

11`)}function _v(i){if(i)process.env.DEBUG=i;else delete process.env.DEBUG}function Iv(){return process.env.DEBUG}function qv(i){i.inspectOpts={};let a=Object.keys(ae.inspectOpts);for(let n=0;n<a.

12`).map((a)=>a.trim()).join(" ")};ie.O=function(i){return this.inspectOpts.colors=this.useColors,Zn.inspect(i,this.inspectOpts)}});var ra=G((R2,Jc)=>{if(typeof process>"u"||process.type==="renderer"

13`).some((a)=>a.indexOf("(https.js:")!==-1||a.indexOf("node:https:")!==-1)}function Xn(i,a){return new Xn.Agent(i,a)}(function(i){class a extends kv.EventEmitter{constructor(n,c){super();let p=c;if(typeof n==="function")this.callback=n;else if(n)p=n;if(this.timeout=null,p&&typeof p.timeout==="number")this.timeout=p.timeout;this.maxFreeSockets=1,this.maxSockets=1,this.maxTotalSockets=1/0,this.sockets={},this.freeSockets={},this.requests={},this.options={}}get defaultPort(){if(typeof this.explicitDefaultPort==="number")return this.explicitDefaultPort;return Mc()?443:80}set defaultPort(n){this.exp ...

14\r

15`)===-1){Fa("have not received end of HTTP headers yet..."),o();return}let f=t.toString("ascii",0,t.indexOf(`\r

16`)),Z=+f.split(" ")[1];Fa("got proxy server response: %o",f),a({statusCode:Z,buffered:t})}i.on("error",l),i.on("close",e),i.on("end",m),o()})}Sa.default=hv});var te=G((gi)=>{var Av=gi&&gi.__awaiter

17`;if(n.auth)o["Proxy-Authorization"]=`Basic ${Buffer.from(n.auth).toString("base64")}`;let{host:m,port:l,secureEndpoint:x}=a;if(!pt(l,x))m+=`:${l}`;o.Host=m,o.Connection="close";for(let Z of Object.keys(o))e+=`${Z}: ${o[Z]}\r

18`;let v=nt.default(p);p.write(`${e}\r

19`);let{statusCode:t,buffered:d}=yield v;if(t===200){if(i.once("socket",ct),a.secureEndpoint){Ta("Upgrading socket connection to TLS");let Z=a.servername||a.host;return le.default.connect(Object.assign(Object.assign({},ot(a,"host","hostname","path","port")),{socket:p,servername:Z}))}return p}p.destroy();let f=new

20`).forEach(function(s){if(p=s.indexOf(":"),n=s.substring(0,p).trim().toLowerCase(),c=s.substring(p+1).trim(),!n||a[n]&&Fu[n])return;if(n==="set-cookie")if(a[n])a[n].push(c);else a[n]=[c];else a[n]=a[n]?a[n]+", "+c:c}),a};function Su(i){let a=0,n=i.length;while(a<n){let c=i.charCodeAt(a);if(c!==9&&c!==32)break;a+=1}while(n>a){let c=i.charCodeAt(n-1);if(c!==9&&c!==32)break;n-=1}return a===0&&n===i.length?i:i.slice(a,n)}var Tu=new RegExp("[\\u0000-\\u0008\\u000a-\\u001f\\u007f]+","g"),Hu=new RegExp("[^\\u0009\\u0020-\\u007e\\u0080-\\u00ff]+","g");function Tn(i,a){if(u.isArray(i))return i.map((n)= ...

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L18

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L7

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

21`)}getSetCookie(){return this.get("set-cookie")||[]}get[Symbol.toStringTag](){return"AxiosHeaders"}static from(i){return i instanceof this?i:new this(i)}static concat(i,...a){let n=new this(i);return a.forEach((c)=>n.set(c)),n}static accessor(i){let n=(this[Gp]=this[Gp]={accessors:{}}).accessors,c=this.prototype;function

22`,Mt=Ra.encode(na),Nt=2;class Ke{constructor(i,a){let{escapeName:n}=this.constructor,c=u.isString(a),p=`Content-Disposition: form-data; name="${n(i)}"${!c&&a.name?`; filename="${n(a.name)}"`:""}${na}`;if(c)a=Ra.encode(String(a).replace(/\r?\n|\r\n?/g,na));else{let o=String(a.type||"application/octet-stream").replace(/[\r\n]/g,"");p+=`Content-Type: ${o}${na}`}this.headers=Ra.encode(p+na),this.contentLength=c?a.byteLength:a.size,this.size=this.headers.byteLength+this.contentLength+Nt,this.name=i,this.value=a}async*encode(){yield this.headers;let{value:i}=this;if(u.isTypedArray(i))yield i;else yi ...

23`+s.map(em).join(`

24`):" "+em(s[0]):"as no adapter specified";throw new z("There is no suitable adapter to dispatch the request "+e,"ERR_NOT_SUPPORT")}return p}var Vn={getAdapter:Nd,adapters:gc};function ip(i){if(i.cancelToken)i.cancelToken.throwIfRequested();if(i.signal&&i.signal.aborted)throw new bi(null,i)}function Bn(

25`);return o===-1?"":c.stack.slice(o+1)})();try{if(!n.stack)n.stack=p;else if(p){let o=p.indexOf(`

26`),s=o===-1?-1:p.indexOf(`

27`,o+1),e=s===-1?"":p.slice(s+1);if(!String(n.stack).endsWith(e))n.stack+=`

28`+p}}catch(o){}}throw n}}_request(i,a){if(typeof i==="string")a=a||{},a.url=i;else a=i||{};a=$i(this.defaults,a);let{transitional:n,paramsSerializer:c,headers:p}=a;if(n!==void 0)Ea.assertOptions(n,{silentJSONParsing:oi.transitional(oi.boolean),forcedJSONParsing:oi.transitional(oi.boolean),clarifyTimeoutError:oi.transitional(oi.boolean),legacyInterceptorReqResOrdering:oi.transitional(oi.boolean),advertiseZstdAcceptEncoding:oi.transitional(oi.boolean),validateStatusUndefinedResolves:oi.transitional(oi.boolean)},!1);if(c!=null)if(u.isFunction(c))a.paramsSerializer={serialize:c};else Ea.assertOpti ...

29`,{mode:384}),await ya.chmod(i,384).catch(()=>{})}async function wm(i){await zm(an,i)}async function fm(i,a=process.cwd()){let n=ga(a,qn);return await zm(n,i),n}async

30`),process.exit(1)}function _(i){if(i instanceof Ii)return i.status?`${i.message} (HTTP ${i.status})`:i.message;if(i instanceof Error)return i.message;return String(i)}function H(i){process.stdout.write(JSON.stringify(i,null,2)+`

31`)}var qd=`figura login — authenticate and save credentials

33Usage:

34 figura login [--token <fig_...>] [--no-browser] [--api-url <url>] [--project]

36By default this opens your browser to a short authorize page — approve there and

37the CLI picks up the credential automatically (no port, nothing to copy-paste;

38works over SSH too). Use --no-browser to print the URL instead of opening it, or

Long lines were clipped for display.

dist/mcp.jsView file

34`,b+1),G=J===-1?"":X.slice(J+1);if(!String(W.stack).endsWith(G))W.stack+=` L35: `+X}}catch(b){}}throw W}}_request(x,Q){if(typeof x==="string")Q=Q||{},Q.url=x;else Q=x||{};Q=p1(this.defaults,Q);let{transitional:W,paramsSerializer:Y,headers:X}=Q;if(W!==void 0)x6... L36: `).filter((b)=>b),Y=Math.min(...W.map((b)=>b.length-b.trimStart().length)),X=W.map((b)=>b.slice(Y)).map((b)=>" ".repeat(this.indent*2)+b);for(let b of X)this.content.push(b)}compil...

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/mcp.jsView on unpkg · L34

Source & flagged code

4 flagged · loading source

dist/index.jsView file

18`;let v=nt.default(p);p.write(`${e}\r L19: `);let{statusCode:t,buffered:d}=yield v;if(t===200){if(i.once("socket",ct),a.secureEndpoint){Ta("Upgrading socket connection to TLS");let Z=a.servername||a.host;return le.default.c... L20: `).forEach(function(s){if(p=s.indexOf(":"),n=s.substring(0,p).trim().toLowerCase(),c=s.substring(p+1).trim(),!n||a[n]&&Fu[n])return;if(n==="set-cookie")if(a[n])a[n].push(c);else a[...

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L18

7*/var mn=Bp(),ix=D("path").extname,_p=/^\s*([^;\s]*)(?:;|\s|$)/,ax=/^text\//i;ox.charset=Ip;ox.charsets={lookup:Ip};ox.contentType=nx;ox.extension=cx;ox.extensions=Object.create(nu... L8: `;q.DEFAULT_CONTENT_TYPE="application/octet-stream";q.prototype.append=function(i,a,n){if(n=n||{},typeof n==="string")n={filename:n};var c=xc.prototype.append.bind(this);if(typeof ... L9: `).join(` ... L18: `;let v=nt.default(p);p.write(`${e}\r L19: `);let{statusCode:t,buffered:d}=yield v;if(t===200){if(i.once("socket",ct),a.secureEndpoint){Ta("Upgrading socket connection to TLS");let Z=a.servername||a.host;return le.default.c... L20: `).forEach(function(s){if(p=s.indexOf(":"),n=s.substring(0,p).trim().toLowerCase(),c=s.substring(p+1).trim(),!n||a[n]&&Fu[n])return;if(n==="set-cookie")if(a[n])a[n].push(c);else a[...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L7

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L7

dist/mcp.jsView file

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/mcp.jsView on unpkg · L34

Findings

3 High2 Medium7 Low

HighChild Processdist/index.js

HighSame File Env Network Executiondist/index.js

HighCommand Output Exfiltrationdist/index.js

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvaldist/mcp.js

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

dist/index.jsView file

Lines 1-38javascript

1#!/usr/bin/env node

3 * mime-types

6 * MIT Licensed

9`).join(`

10`+o),i.push(p+"m+"+Gn.exports.humanize(this.diff)+"\x1B[0m")}else i[0]=Vv()+a+" "+i[0]}function Vv(){if(ae.inspectOpts.hideDate)return"";return new Date().toISOString()+

11`)}function _v(i){if(i)process.env.DEBUG=i;else delete process.env.DEBUG}function Iv(){return process.env.DEBUG}function qv(i){i.inspectOpts={};let a=Object.keys(ae.inspectOpts);for(let n=0;n<a.

12`).map((a)=>a.trim()).join(" ")};ie.O=function(i){return this.inspectOpts.colors=this.useColors,Zn.inspect(i,this.inspectOpts)}});var ra=G((R2,Jc)=>{if(typeof process>"u"||process.type==="renderer"

14\r

15`)===-1){Fa("have not received end of HTTP headers yet..."),o();return}let f=t.toString("ascii",0,t.indexOf(`\r

16`)),Z=+f.split(" ")[1];Fa("got proxy server response: %o",f),a({statusCode:Z,buffered:t})}i.on("error",l),i.on("close",e),i.on("end",m),o()})}Sa.default=hv});var te=G((gi)=>{var Av=gi&&gi.__awaiter

18`;let v=nt.default(p);p.write(`${e}\r

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L18

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L7

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

23`+s.map(em).join(`

25`);return o===-1?"":c.stack.slice(o+1)})();try{if(!n.stack)n.stack=p;else if(p){let o=p.indexOf(`

26`),s=o===-1?-1:p.indexOf(`

27`,o+1),e=s===-1?"":p.slice(s+1);if(!String(n.stack).endsWith(e))n.stack+=`

29`,{mode:384}),await ya.chmod(i,384).catch(()=>{})}async function wm(i){await zm(an,i)}async function fm(i,a=process.cwd()){let n=ga(a,qn);return await zm(n,i),n}async

31`)}var qd=`figura login — authenticate and save credentials

33Usage:

34 figura login [--token <fig_...>] [--no-browser] [--api-url <url>] [--project]

36By default this opens your browser to a short authorize page — approve there and

37the CLI picks up the credential automatically (no port, nothing to copy-paste;

38works over SSH too). Use --no-browser to print the URL instead of opening it, or

Long lines were clipped for display.

dist/mcp.jsView file

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/mcp.jsView on unpkg · L34