registry / handoff-ship / 0.2.0

handoff-ship@0.2.0

Deliver a static site to your client in one command — Handoff.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 13.1 KB of source, external domains: handoff.yourdomain.com

Source & flagged code

2 flagged

index.jsView file

Lines 1-47javascript

1#!/usr/bin/env node

2// packages/cli/index.js — the `handoff` CLI.

3//

4// Deliver a static site to your client in one command:

5// npx handoff deploy ./dist --to "Maria"

6// -> uploads the build dir to your Handoff account and prints a client link

7// the client opens, picks a domain, and presses Launch.

8//

9// Auth: a deploy-scoped API token (Bearer), NOT your login. Create one in the

10// Handoff dashboard → API tokens. The token can upload sites + create handoff

Source & flagged code

2 flagged · loading source

index.jsView file

18// L19: // Exit codes: 0 ok · 1 app error · 2 auth error · 3 network error · 4 bad input. L20: ... L29: L30: const RC = path.join(os.homedir(), '.handoffrc'); L31: const VERSION = require('./package.json').version; L32: L33: function die(msg, code) { console.error(msg); process.exit(code == null ? 1 : code); } L34: function readRc() { try { return JSON.parse(fs.readFileSync(RC, 'utf8')); } catch (_) { return {}; } } L35: function writeRc(o) { fs.writeFileSync(RC, JSON.stringify(o), { mode: 0o600 }); } ... L38: if (opts.token) return opts.token.trim(); L39: if (process.env.HANDOFF_TOKEN) return process.env.HANDOFF_TOKEN.trim();

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

index.jsView on unpkg · L18

27package = handoff-ship; repositoryIdentity = handoff; dependency = archiver L27: const readline = require('readline'); L28: const archiver = require('archiver'); L29:

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

index.jsView on unpkg · L27

Findings

2 High3 Medium4 Low

HighSandbox Evasion Gated Capabilityindex.js

HighCopied Package Dependency Bridgeindex.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings