registry / fluncle / 0.90.0

fluncle@0.90.0

drum & bass bangers from another dimension — the Fluncle CLI

Static Scan Results

scanned 14h ago · by rust-scanner

Static analysis flagged 7 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 315 KB of source, external domains: api.deezer.com, api.github.com, api.mixcloud.com, chromewebstore.google.com, dig.fluncle.com, found.fluncle.com, galaxy.fluncle.com, github.com, itunes.apple.com, open.spotify.com, p53pc2uzfu2tnih4cd6wd42ok6zup2uttj6xdmjdccy5kqo33fyppkqd.onion, radio.fluncle.com, registry.npmjs.org, status.fluncle.com, t.me, www.fluncle.com, www.instagram.com, www.mixcloud.com, www.tiktok.com, www.youtube.com, youtu.be

Source & flagged code

1 flagged

bin/fluncle.mjsView file

Lines 56-96javascript

56 var crypto = __require("crypto");

57 var TIPS = [

58 "◈ encrypted .env [www.dotenvx.com]",

59 "◈ secrets for agents [www.dotenvx.com]",

60 "⌁ auth for agents [www.vestauth.com]",

61 "⌘ custom filepath { path: '/custom/path/.env' }",

62 "⌘ enable debugging { debug: true }",

63 "⌘ override existing { override: true }",

64 "⌘ suppress logs { quiet: true }",

65 "⌘ multiple files { path: ['.env.local', '.env'] }"

66 ];

67 function _getRandomTip() {

68 return TIPS[Math.floor(Math.random() * TIPS.length)];

69 }

70 function parseBoolean(value) {

71 if (typeof value === "string") {

72 return !["false", "0", "no", "off", ""].includes(value.toLowerCase());

73 }

74 return Boolean(value);

75 }

76 function supportsAnsi() {

77 return process.stdout.isTTY;

78 }

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/fluncle.mjsView on unpkg · L76

79 function dim(text) {

80 return supportsAnsi() ? `\x1B[2m${text}\x1B[0m` : text;

81 }

82 var LINE = /(?:^|^)\s*(?:export\s+)?([\w.-]+)(?:\s*=\s*?|:\s+?)(\s*'(?:\\'|[^'])*'|\s*"(?:\\"|[^"]

83 function parse(src) {

84 const obj = {};

85 let lines = src.toString();

86 lines = lines.replace(/\r\n?/mg, `

87`);

88 let match;

89 while ((match = LINE.exec(lines)) != null) {

90 const key = match[1];

91 let value = match[2] || "";

92 value = value.trim();

93 const maybeQuote = value[0];

94 value = value.replace(/^(['"`])([\s\S]*)\1$/mg, "$2");

95 if (maybeQuote === '"') {

96 value = value.replace(/\\n/g, `

Source & flagged code

1 flagged · loading source

bin/fluncle.mjsView file

76function supportsAnsi() { L77: return process.stdout.isTTY; L78: } ... L109: if (!result.parsed) { L110: const err = new Error(`MISSING_DATA: Cannot parse ${vaultPath} for an unknown reason`); L111: err.code = "MISSING_DATA"; ... L143: } L144: if (process.env.DOTENV_KEY && process.env.DOTENV_KEY.length > 0) { L145: return process.env.DOTENV_KEY; ... L194: } else { L195: possibleVaultPath = path2.resolve(process.cwd(), ".env.vault"); L196: }

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/fluncle.mjsView on unpkg · L76

Findings

1 High3 Medium3 Low

HighSandbox Evasion Gated Capabilitybin/fluncle.mjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

1 flagged

bin/fluncle.mjsView file

Lines 56-96javascript

56 var crypto = __require("crypto");

57 var TIPS = [

58 "◈ encrypted .env [www.dotenvx.com]",

59 "◈ secrets for agents [www.dotenvx.com]",

60 "⌁ auth for agents [www.vestauth.com]",

61 "⌘ custom filepath { path: '/custom/path/.env' }",

62 "⌘ enable debugging { debug: true }",

63 "⌘ override existing { override: true }",

64 "⌘ suppress logs { quiet: true }",

65 "⌘ multiple files { path: ['.env.local', '.env'] }"

66 ];

67 function _getRandomTip() {

68 return TIPS[Math.floor(Math.random() * TIPS.length)];

69 }

70 function parseBoolean(value) {

71 if (typeof value === "string") {

72 return !["false", "0", "no", "off", ""].includes(value.toLowerCase());

73 }

74 return Boolean(value);

75 }

76 function supportsAnsi() {

77 return process.stdout.isTTY;

78 }

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/fluncle.mjsView on unpkg · L76

79 function dim(text) {

80 return supportsAnsi() ? `\x1B[2m${text}\x1B[0m` : text;

81 }

82 var LINE = /(?:^|^)\s*(?:export\s+)?([\w.-]+)(?:\s*=\s*?|:\s+?)(\s*'(?:\\'|[^'])*'|\s*"(?:\\"|[^"]

83 function parse(src) {

84 const obj = {};

85 let lines = src.toString();

86 lines = lines.replace(/\r\n?/mg, `

87`);

88 let match;

89 while ((match = LINE.exec(lines)) != null) {

90 const key = match[1];

91 let value = match[2] || "";

92 value = value.trim();

93 const maybeQuote = value[0];

94 value = value.replace(/^(['"`])([\s\S]*)\1$/mg, "$2");

95 if (maybeQuote === '"') {

96 value = value.replace(/\\n/g, `