registry / handoff-ship / 0.2.0

handoff-ship@0.2.0

Deliver a static site to your client in one command — Handoff.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 13.1 KB of source, external domains: handoff.yourdomain.com

Source & flagged code

2 flagged

index.jsView file

Lines 1-47javascript

1#!/usr/bin/env node

2// packages/cli/index.js — the `handoff` CLI.

3//

4// Deliver a static site to your client in one command:

5// npx handoff deploy ./dist --to "Maria"

6// -> uploads the build dir to your Handoff account and prints a client link

7// the client opens, picks a domain, and presses Launch.

8//

9// Auth: a deploy-scoped API token (Bearer), NOT your login. Create one in the

10// Handoff dashboard → API tokens. The token can upload sites + create handoff

11// links + list them; it CANNOT touch billing, your Cloudflare token, or domains.

12// Resolve order for the token: --token flag > HANDOFF_TOKEN env > ~/.handoffrc

13// (written by `handoff login`). The token is never logged.

14//

15// Base URL: --base flag > HANDOFF_BASE env > ~/.handoffrc.base > error. We refuse

16// non-HTTPS bases so a token never crosses plaintext wire (localhost is allowed

17// for local dev).

18//

19// Exit codes: 0 ok · 1 app error · 2 auth error · 3 network error · 4 bad input.

21'use strict';

23const fs = require('fs');

24const path = require('path');

25const os = require('os');

26const crypto = require('crypto');

27const readline = require('readline');

28const archiver = require('archiver');

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

index.jsView on unpkg · L27

30const RC = path.join(os.homedir(), '.handoffrc');

31const VERSION = require('./package.json').version;

33function die(msg, code) { console.error(msg); process.exit(code == null ? 1 : code); }

34function readRc() { try { return JSON.parse(fs.readFileSync(RC, 'utf8')); } catch (_) { return {}; } }

35function writeRc(o) { fs.writeFileSync(RC, JSON.stringify(o), { mode: 0o600 }); }

37function resolveToken(opts) {

38 if (opts.token) return opts.token.trim();

39 if (process.env.HANDOFF_TOKEN) return process.env.HANDOFF_TOKEN.trim();

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

index.jsView on unpkg · L18

40 const rc = readRc();

41 if (rc.token) return rc.token.trim();

42 return null;

43}

44function resolveBase(opts) {

45 if (opts.base) return opts.base.replace(/\/+$/, '');

46 if (process.env.HANDOFF_BASE) return process.env.HANDOFF_BASE.replace(/\/+$/, '');

47 const rc = readRc();

Source & flagged code

2 flagged · loading source

index.jsView file

18// L19: // Exit codes: 0 ok · 1 app error · 2 auth error · 3 network error · 4 bad input. L20: ... L29: L30: const RC = path.join(os.homedir(), '.handoffrc'); L31: const VERSION = require('./package.json').version; L32: L33: function die(msg, code) { console.error(msg); process.exit(code == null ? 1 : code); } L34: function readRc() { try { return JSON.parse(fs.readFileSync(RC, 'utf8')); } catch (_) { return {}; } } L35: function writeRc(o) { fs.writeFileSync(RC, JSON.stringify(o), { mode: 0o600 }); } ... L38: if (opts.token) return opts.token.trim(); L39: if (process.env.HANDOFF_TOKEN) return process.env.HANDOFF_TOKEN.trim();

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

index.jsView on unpkg · L18

27package = handoff-ship; repositoryIdentity = handoff; dependency = archiver L27: const readline = require('readline'); L28: const archiver = require('archiver'); L29:

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

index.jsView on unpkg · L27

Findings

2 High3 Medium4 Low

HighSandbox Evasion Gated Capabilityindex.js

HighCopied Package Dependency Bridgeindex.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

index.jsView file

Lines 1-47javascript

1#!/usr/bin/env node

2// packages/cli/index.js — the `handoff` CLI.

3//

4// Deliver a static site to your client in one command:

5// npx handoff deploy ./dist --to "Maria"

6// -> uploads the build dir to your Handoff account and prints a client link

7// the client opens, picks a domain, and presses Launch.

8//

9// Auth: a deploy-scoped API token (Bearer), NOT your login. Create one in the

10// Handoff dashboard → API tokens. The token can upload sites + create handoff

11// links + list them; it CANNOT touch billing, your Cloudflare token, or domains.

12// Resolve order for the token: --token flag > HANDOFF_TOKEN env > ~/.handoffrc

13// (written by `handoff login`). The token is never logged.

14//

15// Base URL: --base flag > HANDOFF_BASE env > ~/.handoffrc.base > error. We refuse

16// non-HTTPS bases so a token never crosses plaintext wire (localhost is allowed

17// for local dev).

18//

19// Exit codes: 0 ok · 1 app error · 2 auth error · 3 network error · 4 bad input.

21'use strict';

23const fs = require('fs');

24const path = require('path');

25const os = require('os');

26const crypto = require('crypto');

27const readline = require('readline');

28const archiver = require('archiver');

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

index.jsView on unpkg · L27

30const RC = path.join(os.homedir(), '.handoffrc');

31const VERSION = require('./package.json').version;

33function die(msg, code) { console.error(msg); process.exit(code == null ? 1 : code); }

34function readRc() { try { return JSON.parse(fs.readFileSync(RC, 'utf8')); } catch (_) { return {}; } }

35function writeRc(o) { fs.writeFileSync(RC, JSON.stringify(o), { mode: 0o600 }); }

37function resolveToken(opts) {

38 if (opts.token) return opts.token.trim();

39 if (process.env.HANDOFF_TOKEN) return process.env.HANDOFF_TOKEN.trim();

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

index.jsView on unpkg · L18

40 const rc = readRc();

41 if (rc.token) return rc.token.trim();

42 return null;

43}

44function resolveBase(opts) {

45 if (opts.base) return opts.base.replace(/\/+$/, '');

46 if (process.env.HANDOFF_BASE) return process.env.HANDOFF_BASE.replace(/\/+$/, '');

47 const rc = readRc();