registry / fullstackgtm / 0.52.3

fullstackgtm@0.52.3

Open-source agentic GTM ops framework: canonical GTM data model, pluggable deterministic audits, reviewable dry-run patch plans, approval-gated write-back with conflict detection, and cross-system entity resolution. HubSpot, Salesforce, and Stripe connect

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 206 file(s), 3.03 MB of source, external domains: api.anthropic.com, api.apollo.io, api.ashbyhq.com, api.clay.com, api.explorium.ai, api.heyreach.io, api.hubapi.com, api.lever.co, api.openai.com, api.pipe0.com, api.stripe.com, api.theirstack.com, app.fullstackgtm.com, app.hubspot.com, boards-api.greenhouse.io, example.com, github.com, gtm.example.com, gtm.yourco.com, login.salesforce.com, openrouter.ai, schemas.xmlsoap.org, serpapi.com, www.apple.com, www.google.com, yourco.my.salesforce.com, yourorg.my.salesforce.com

Source & flagged code

4 flagged

dist/config.jsView file

Lines 60-100javascript

60 if (value !== undefined) {

61 merged[key] = value;

62 }

63 }

64 return merged;

65}

66/**

67 * Build the effective rule set: built-ins plus rule-package exports, then

68 * `enabled` (allow-list) and `disabled` filters.

69 */

70export async function resolveConfiguredRules(loaded, baseRules = builtinAuditRules, trust = {}) {

71 let rules = [...baseRules];

72 const packages = loaded?.config.rulePackages ?? [];

73 if (packages.length && !trust.allowRulePackages && !trust.disableRulePackages) {

74 throw new Error(`Config ${loaded.path} declares executable rulePackages. Refusing to load plugin code without explicit trust. ` +

75 "For the CLI, pass --config <path> --allow-plugins after reviewing the modules, or pass --no-plugins to use only declarative policy and built-in rules.");

76 }

77 for (const specifier of trust.disableRulePackages ? [] : packages) {

78 const resolvedSpecifier = specifier.startsWith(".") || isAbsolute(specifier)

79 ? pathToFileURL(resolve(dirname(loaded.path), specifier)).href

80 : specifier;

81 const rulePackage = await import(__rewriteRelativeImportExtension(resolvedSpecifier));

82 const imported = rulePackage.rules ?? rulePackage.default?.rules;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/config.jsView on unpkg · L80

83 if (!Array.isArray(imported)) {

84 throw new Error(`Rule package ${specifier} must export \`rules: GtmAuditRule[]\`.`);

85 }

86 for (const rule of imported) {

87 if (!rule?.id || typeof rule.evaluate !== "function") {

88 throw new Error(`Rule package ${specifier} exported an invalid rule.`);

89 }

90 rules.push(rule);

91 }

92 }

93 const enabled = loaded?.config.rules?.enabled;

94 if (enabled?.length) {

95 const known = new Map(rules.map((rule) => [rule.id, rule]));

96 rules = enabled.map((id) => {

97 const rule = known.get(id);

98 if (!rule) {

99 throw new Error(`Config enables unknown rule: ${id}. Known rules: ${Array.from(known.keys()).join(", ")}`);

100 }

dist/cli/schedule.jsView file

Lines 1-26javascript

1// Extracted verbatim from src/cli.ts (mechanical split, no behavior change).

2import { existsSync, mkdirSync } from "node:fs";

3import { join, resolve } from "node:path";

4import { activeProfile, credentialsDir } from "../credentials.js";

5import { createFilePlanStore } from "../planStore.js";

6import { createFileEnrichRunStore } from

dist/cli/auth.jsView file

Lines 11-51javascript

11import { isOptionValue, numericOption, option, readPackageInfo, readSecret } from "./shared.js";

12import { box, colorEnabled, paint, scoreColor, sparkline } from "./ui.js";

13/**

14 * Provider error bodies can echo request parameters (including secrets) and

15 * land in logs. Surface only the status and, when present, a known-safe error

16 * description field — never the raw body.

17 */

18function safeStatus(response

Source & flagged code

4 flagged · loading source

dist/config.jsView file

80: specifier; L81: const rulePackage = await import(__rewriteRelativeImportExtension(resolvedSpecifier)); L82: const imported = rulePackage.rules ?? rulePackage.default?.rules;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/config.jsView on unpkg · L80

dist/cli/schedule.jsView file

6import { createFileEnrichRunStore } from "../enrich.js"; L7: import { computeMissedFirings, createFileScheduleRunStore, createFileScheduleStore, installLaunchdAgents, isDuplicateCronFiring, nextCronFiring, parseCron, renderManagedBlock, repl... L8: import { runCli } from "../cli.js"; ... L59: L60: run executes the command in-process and records the outcome (exit code, L61: output tail, artifacts: plan ids / enrich run labels) under the profile's ... L183: const { installed } = installLaunchdAgents(profile, enabled, scheduleCliArgv(), io, { L184: environment: process.env.FSGTM_HOME ? { FSGTM_HOME: process.env.FSGTM_HOME } : undefined, L185: logDir, ... L194: if (subcommand === "uninstall") { L195: io.write(replaceManagedBlock(existing, profile, null)); L196: console.log(`Removed the fullstackgtm managed crontab block for profile "${profile}" (lines outside the sentinels untouched).`);

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/cli/schedule.jsView on unpkg · L6

dist/cli/auth.jsView file

31* minted live-CRM tokens, so it must be TLS unless it's an explicit localhost L32: * dev target. Refuse http:// (and non-http schemes) otherwise — single-quote L33: * shell escaping does nothing for a token sent in cleartext. ... L57: // and refuse one they didn't initiate. L58: const requesterLabel = `${os.hostname()} (${process.platform}, ${os.userInfo().username})`; L59: let startResponse; ... L63: headers: { "Content-Type": "application/json" }, L64: body: JSON.stringify({ requesterLabel }), L65: }); ... L73: } L74: const start = await startResponse.json(); L75: // Only auto-open a verification URL that belongs to the --via origin the user

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

dist/cli/auth.jsView on unpkg · L31

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli/auth.jsView on unpkg · L31

Findings

2 High5 Medium5 Low

HighHost Fingerprint Exfiltrationdist/cli/auth.js

HighSandbox Evasion Gated Capabilitydist/cli/auth.js

MediumDynamic Requiredist/config.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/cli/schedule.js

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

dist/config.jsView file

Lines 60-100javascript

60 if (value !== undefined) {

61 merged[key] = value;

62 }

63 }

64 return merged;

65}

66/**

67 * Build the effective rule set: built-ins plus rule-package exports, then

68 * `enabled` (allow-list) and `disabled` filters.

69 */

70export async function resolveConfiguredRules(loaded, baseRules = builtinAuditRules, trust = {}) {

71 let rules = [...baseRules];

72 const packages = loaded?.config.rulePackages ?? [];

73 if (packages.length && !trust.allowRulePackages && !trust.disableRulePackages) {

74 throw new Error(`Config ${loaded.path} declares executable rulePackages. Refusing to load plugin code without explicit trust. ` +

75 "For the CLI, pass --config <path> --allow-plugins after reviewing the modules, or pass --no-plugins to use only declarative policy and built-in rules.");

76 }

77 for (const specifier of trust.disableRulePackages ? [] : packages) {

78 const resolvedSpecifier = specifier.startsWith(".") || isAbsolute(specifier)

79 ? pathToFileURL(resolve(dirname(loaded.path), specifier)).href

80 : specifier;

81 const rulePackage = await import(__rewriteRelativeImportExtension(resolvedSpecifier));

82 const imported = rulePackage.rules ?? rulePackage.default?.rules;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/config.jsView on unpkg · L80

83 if (!Array.isArray(imported)) {

84 throw new Error(`Rule package ${specifier} must export \`rules: GtmAuditRule[]\`.`);

85 }

86 for (const rule of imported) {

87 if (!rule?.id || typeof rule.evaluate !== "function") {

88 throw new Error(`Rule package ${specifier} exported an invalid rule.`);

89 }

90 rules.push(rule);

91 }

92 }

93 const enabled = loaded?.config.rules?.enabled;

94 if (enabled?.length) {

95 const known = new Map(rules.map((rule) => [rule.id, rule]));

96 rules = enabled.map((id) => {

97 const rule = known.get(id);

98 if (!rule) {

99 throw new Error(`Config enables unknown rule: ${id}. Known rules: ${Array.from(known.keys()).join(", ")}`);

100 }

dist/cli/schedule.jsView file

Lines 1-26javascript

1// Extracted verbatim from src/cli.ts (mechanical split, no behavior change).

2import { existsSync, mkdirSync } from "node:fs";

3import { join, resolve } from "node:path";

4import { activeProfile, credentialsDir } from "../credentials.js";

5import { createFilePlanStore } from "../planStore.js";

6import { createFileEnrichRunStore } from

dist/cli/auth.jsView file

Lines 11-51javascript

11import { isOptionValue, numericOption, option, readPackageInfo, readSecret } from "./shared.js";

12import { box, colorEnabled, paint, scoreColor, sparkline } from "./ui.js";

13/**

14 * Provider error bodies can echo request parameters (including secrets) and

15 * land in logs. Surface only the status and, when present, a known-safe error

16 * description field — never the raw body.

17 */

18function safeStatus(response