registry / hyve-system / 2026.7.0

hyve-system@2026.7.0

CLI do HYVE System — instala, autentica e mantém o framework atualizado

Static Scan Results

scanned 7d ago · by rust-scanner

Static analysis flagged 15 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 17 file(s), 70.1 KB of source, external domains: lab.hyve.company, vobsudkxawzktwgilbae.supabase.co

Source & flagged code

6 flagged

dist/lab-client.jsView file

Lines 3-36javascript

3 * Storage em memória pro flow PKCE: o supabase-js guarda o `code_verifier`

4 * entre `signInWithOAuth` e `exchangeCodeForSession`. Como a CLI é um processo

5 * único, manter em memória basta (não persiste em disco).

6 */

7const memory = new Map();

8const memoryStorage = {

9 getItem: (key) => memory.get(key) ?? null,

10 setItem: (key, value) => {

11 memory.set(key, value);

12 },

13 removeItem: (key) => {

14 memory.delete(key);

15 },

16};

17/**

18 * URL + anon key PÚBLICAS do HYVE-LAB, embutidas. A anon key é exposta no bundle

19 * do site por design — NÃO é segredo (o service role NUNCA entra aqui). Dá pra

20 * sobrescrever via env (HYVE_LAB_URL / HYVE_LAB_ANON_KEY) pra apontar outro ambiente.

21 */

22const LAB_URL = process.env.HYVE_LAB_URL ?? 'https://vobsudkxawzktwgilbae.supabase.co';

23const LAB_ANON_KEY = process.env.HYVE_LAB_ANON_KEY ?? 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6InZvYnN1ZGt4YXd6a3R3Z2lsYmFlIiwicm9sZSI6ImFub24iLCJpYXQiOjE3NzI5MjM4MjQsImV4cCI6MjA4ODQ5OTgyNH0.EUgINyUOORPX7TgUKiXhvS8AAO4pKbxc9bPEI97Fw6Y'; // gitleaks:allow (anon pública, role:anon + RLS — ver nota acima)

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/lab-client.jsView on unpkg · L23

Critical

Secret Pattern

Supabase service role key (JWT) in dist/lab-client.js

dist/lab-client.jsView on unpkg · L23

24/** Cliente Supabase apontando pro HYVE-LAB, configurado pra auth via CLI (PKCE). */

25export function getLabClient() {

26 return createClient(LAB_URL, LAB_ANON_KEY, {

27 auth: {

28 flowType: 'pkce',

29 persistSession: false,

30 autoRefreshToken: false,

31 detectSessionInUrl: false,

32 storage: memoryStorage,

33 },

34 });

35}

dist/framework-sync.jsView file

Lines 1-21javascript

1import { execFile } from 'node:child_process';

2import { promisify } from 'node:util';

High

Child Process

Package source references child process execution.

dist/framework-sync.jsView on unpkg · L1

3import { createHash } from 'node:crypto';

4import { mkdtempSync, readFileSync, existsSync, mkdirSync, copyFileSync, writeFileSync, statSync, readdirSync, } from 'node:fs';

dist/commands/login.jsView file

Lines 1-21javascript

1import { spawn } from 'node:child_process';

2import { getLabClient } from '../lab-client.js';

3import { saveSession } from '../auth-store.js';

4import { showLogo, header, step, hint, command, codeBox, blank, spinner, c, sym } from '../ui.js';

5/** Base do app Next do Lab (endpoints /api/device/*). Override pra testar local. */

6const

Source & flagged code

6 flagged · loading source

dist/lab-client.jsView file

23patternName = supabase_service_key severity = critical line = 23 matchedText = const LA...ima)

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/lab-client.jsView on unpkg · L23

23patternName = supabase_service_key severity = critical line = 23 matchedText = const LA...ima)

Critical

Secret Pattern

Supabase service role key (JWT) in dist/lab-client.js

dist/lab-client.jsView on unpkg · L23

dist/framework-sync.jsView file

1import { execFile } from 'node:child_process'; L2: import { promisify } from 'node:util';

High

Child Process

Package source references child process execution.

dist/framework-sync.jsView on unpkg · L1

1import { execFile } from 'node:child_process'; L2: import { promisify } from 'node:util'; ... L13: */ L14: export const API_BASE = process.env.HYVE_LAB_API_URL ?? 'https://lab.hyve.company'; L15: /**

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/framework-sync.jsView on unpkg · L1

•matchType = previous_version_dangerous_delta matchedPackage = hyve-system@2026.7.1 matchedIdentity = npm:aHl2ZS1zeXN0ZW0:2026.7.1 similarity = 0.824 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/framework-sync.jsView on unpkg

dist/commands/login.jsView file

1import { spawn } from 'node:child_process'; L2: import { getLabClient } from '../lab-client.js'; ... L5: /** Base do app Next do Lab (endpoints /api/device/*). Override pra testar local. */ L6: const API_BASE = process.env.HYVE_LAB_API_URL ?? 'https://lab.hyve.company'; L7: /** Único caminho de login: device authorization flow (autoriza pelo navegador). */ ... L11: function openBrowser(url) { L12: const platform = process.platform; L13: const cmd = platform === 'darwin' ? 'open' : platform === 'win32' ? 'cmd' : 'xdg-open'; ... L32: sp.error(`O Lab respondeu ${res.status}. Tente de novo em instantes.`); L33: process.exitCode = 1; L34: return; L35: }

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/commands/login.jsView on unpkg · L1

Findings

2 Critical5 High3 Medium5 Low

CriticalCritical Secretdist/lab-client.js

CriticalSecret Patterndist/lab-client.js

HighChild Processdist/framework-sync.js

HighShell

HighSame File Env Network Executiondist/framework-sync.js

HighSandbox Evasion Gated Capabilitydist/commands/login.js

HighPrevious Version Dangerous Deltadist/framework-sync.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

6 flagged

dist/lab-client.jsView file

Lines 3-36javascript

3 * Storage em memória pro flow PKCE: o supabase-js guarda o `code_verifier`

4 * entre `signInWithOAuth` e `exchangeCodeForSession`. Como a CLI é um processo

5 * único, manter em memória basta (não persiste em disco).

6 */

7const memory = new Map();

8const memoryStorage = {

9 getItem: (key) => memory.get(key) ?? null,

10 setItem: (key, value) => {

11 memory.set(key, value);

12 },

13 removeItem: (key) => {

14 memory.delete(key);

15 },

16};

17/**

18 * URL + anon key PÚBLICAS do HYVE-LAB, embutidas. A anon key é exposta no bundle

19 * do site por design — NÃO é segredo (o service role NUNCA entra aqui). Dá pra

20 * sobrescrever via env (HYVE_LAB_URL / HYVE_LAB_ANON_KEY) pra apontar outro ambiente.

21 */

22const LAB_URL = process.env.HYVE_LAB_URL ?? 'https://vobsudkxawzktwgilbae.supabase.co';

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/lab-client.jsView on unpkg · L23

Critical

Secret Pattern

Supabase service role key (JWT) in dist/lab-client.js

dist/lab-client.jsView on unpkg · L23

24/** Cliente Supabase apontando pro HYVE-LAB, configurado pra auth via CLI (PKCE). */

25export function getLabClient() {

26 return createClient(LAB_URL, LAB_ANON_KEY, {

27 auth: {

28 flowType: 'pkce',

29 persistSession: false,

30 autoRefreshToken: false,

31 detectSessionInUrl: false,

32 storage: memoryStorage,

33 },

34 });

35}

dist/framework-sync.jsView file

Lines 1-21javascript

1import { execFile } from 'node:child_process';

2import { promisify } from 'node:util';

High

Child Process

Package source references child process execution.

dist/framework-sync.jsView on unpkg · L1

3import { createHash } from 'node:crypto';

4import { mkdtempSync, readFileSync, existsSync, mkdirSync, copyFileSync, writeFileSync, statSync, readdirSync, } from 'node:fs';

dist/commands/login.jsView file

Lines 1-21javascript

1import { spawn } from 'node:child_process';

2import { getLabClient } from '../lab-client.js';

3import { saveSession } from '../auth-store.js';

4import { showLogo, header, step, hint, command, codeBox, blank, spinner, c, sym } from '../ui.js';

5/** Base do app Next do Lab (endpoints /api/device/*). Override pra testar local. */

6const