registry / i-repo / 2.24.0

i-repo@2.24.0

Modern CLI for ConMas i-Reporter - Built for humans and AI

Static Scan Results

scanned 4h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 141 file(s), 823 KB of source, external domains: your-server.example.com

Source & flagged code

6 flagged

dist/i18n/locales/en.jsView file

Lines 21-61javascript

21 yes: "Yes",

22 no: "No",

23 pressAnyKeyToGoBack: "Press any key to go back",

24 today: "Today",

25 customInput: "(custom input)",

26 allLevels: "All levels",

27 warning: "Warning:",

28 cli: "CLI:",

29 confirmDelete: "This will delete data. Are you sure?",

30 operationCancelled: "Operation cancelled.",

31 typeToFilter: "Type to filter",

32 noMatches: "No matching commands",

33 actionBarKeys: "Enter/n: new command Esc: back to home",

34 },

35 banner: {

36 tagline: "i-Reporter CLI Client",

37 },

38 auth: {

39 endpoint: "Endpoint:",

40 username: "Username:",

41 password: "Password:",

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/i18n/locales/en.jsView on unpkg · L41

42 authenticating: "Authenticating...",

43 authenticatedAs: "Authenticated successfully as {user}",

44 whereToSave: "Where to save config?",

45 dontSave: "Don't save",

46 savePassword: "Also save password?",

47 savedTo: "Saved to {path}",

48 authFailed: "Authentication failed",

49 configNotSaved: "Config not saved.",

50 passwordNotStored: "Password is NOT stored. Set IREPO_PASSWORD env var,\n pass -p each time, or run: i-repo config set password <password>",

51 loggedInAs: "Logged in as {user}",

52 validUrl: "Please enter a valid URL",

53 usernameRequired: "Username is required",

54 passwordRequired: "Password is required",

55 authenticatedSuccessfully: "Authenticated successfully",

56 authenticationFailed: "Authentication failed",

57 logoutSuccess: "Logged out successfully. Stored user and password cleared.",

58 userOnlyRedirected: "Note: endpoint and password were saved to your user config ({path}).\n" +

59 " For security they only take effect from the user scope (a checked-out\n" +

60 " repository must not redirect credentials), so they are not written to project/local.",

61 statusTitle: "Connection Info",

dist/ink/screens/UpdateCheckScreen.jsView file

Lines 1-23javascript

1import { jsxs as _jsxs, jsx as _jsx } from "react/jsx-runtime";

2import { useState, useEffect } from "react";

3import { Box, Text, useInput } from "ink";

4import { exec } from "node:child_process";

5import { colors, icons } from

dist/plugins/dispatch.jsView file

Lines 342-382javascript

342 // タイムアウト・壊れた応答では絶対にブロックしない (fail-open — 既存

343 // プラグインに退行経路を作らない)。メタデータ照会 (--plugin-schema /

344 // --plugin-healthcheck) はバイパス: GUI が platforms を知る手段そのもの

345 // であり、ここを塞ぐと非対応 OS から自己記述が読めなくなる。

346 const isMetadataProbe = args[0] === "--plugin-schema" || args[0] === "--plugin-healthcheck";

scripts/check-adc.mjsView file

Lines 474-514javascript

474} else console.log(` - skip（${FAST ? "--fast" : "mongod なし"}）`);

475

476// ── elastic（ES が居れば・使い捨て index）──

477console.log("\n[elastic] C3〜C9 + C10");

478let esUp = false;

479

plugins/install.shView file

•path = plugins/install.sh kind = build_helper sizeBytes = 4000 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

plugins/install.shView on unpkg

Source & flagged code

6 flagged · loading source

dist/i18n/locales/en.jsView file

41patternName = generic_password severity = medium line = 41 matchedText = password...d:",

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/i18n/locales/en.jsView on unpkg · L41

dist/ink/screens/UpdateCheckScreen.jsView file

3import { Box, Text, useInput } from "ink"; L4: import { exec } from "node:child_process"; L5: import { colors, icons } from "../theme.js";

High

Child Process

Package source references child process execution.

dist/ink/screens/UpdateCheckScreen.jsView on unpkg · L3

dist/plugins/dispatch.jsView file

362// Windows .cmd/.bat shims (e.g. npm-installed plugins) cannot be executed L363: // directly by spawn() — Node requires cmd.exe for batch files. We invoke L364: // cmd.exe explicitly with an argv list (NOT shell:true) so Node performs the

High

Shell

Package source references shell execution.

dist/plugins/dispatch.jsView on unpkg · L362

scripts/check-adc.mjsView file

494conformTenant("elastic", "elastic", ["--url", url, "--index", tIndex], ["--url", url, "--index", tIndex]); L495: } finally { await fetch(`${url}/${tIndex}`, { method: "DELETE" }).catch(() => {}); } L496: } catch (e) { ng("elastic ハーネス例外", String(e?.message || e)); } ... L503: console.log("\n[bigquery] C3〜C9（opt-in）"); L504: const bqProject = process.env.GEMBA_ADC_BQ_PROJECT; L505: const bqDataset = process.env.GEMBA_ADC_BQ_DATASET; ... L507: const bqUp = !FAST && bqProject && bqDataset && L508: spawnSync("bq", ["version"], { encoding: "utf8" }).status === 0; L509: if (bqUp) {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

scripts/check-adc.mjsView on unpkg · L494

•matchType = previous_version_dangerous_delta matchedPackage = i-repo@2.22.0 matchedIdentity = npm:aS1yZXBv:2.22.0 similarity = 0.950 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

scripts/check-adc.mjsView on unpkg

plugins/install.shView file

•path = plugins/install.sh kind = build_helper sizeBytes = 4000 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

plugins/install.shView on unpkg

Findings

4 High5 Medium5 Low

HighChild Processdist/ink/screens/UpdateCheckScreen.js

HighShelldist/plugins/dispatch.js

HighSame File Env Network Executionscripts/check-adc.mjs

HighPrevious Version Dangerous Deltascripts/check-adc.mjs

MediumSecret Patterndist/i18n/locales/en.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperplugins/install.sh

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

6 flagged

dist/i18n/locales/en.jsView file

Lines 21-61javascript

21 yes: "Yes",

22 no: "No",

23 pressAnyKeyToGoBack: "Press any key to go back",

24 today: "Today",

25 customInput: "(custom input)",

26 allLevels: "All levels",

27 warning: "Warning:",

28 cli: "CLI:",

29 confirmDelete: "This will delete data. Are you sure?",

30 operationCancelled: "Operation cancelled.",

31 typeToFilter: "Type to filter",

32 noMatches: "No matching commands",

33 actionBarKeys: "Enter/n: new command Esc: back to home",

34 },

35 banner: {

36 tagline: "i-Reporter CLI Client",

37 },

38 auth: {

39 endpoint: "Endpoint:",

40 username: "Username:",

41 password: "Password:",

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/i18n/locales/en.jsView on unpkg · L41

42 authenticating: "Authenticating...",

43 authenticatedAs: "Authenticated successfully as {user}",

44 whereToSave: "Where to save config?",

45 dontSave: "Don't save",

46 savePassword: "Also save password?",

47 savedTo: "Saved to {path}",

48 authFailed: "Authentication failed",

49 configNotSaved: "Config not saved.",

50 passwordNotStored: "Password is NOT stored. Set IREPO_PASSWORD env var,\n pass -p each time, or run: i-repo config set password <password>",

51 loggedInAs: "Logged in as {user}",

52 validUrl: "Please enter a valid URL",

53 usernameRequired: "Username is required",

54 passwordRequired: "Password is required",

55 authenticatedSuccessfully: "Authenticated successfully",

56 authenticationFailed: "Authentication failed",

57 logoutSuccess: "Logged out successfully. Stored user and password cleared.",

58 userOnlyRedirected: "Note: endpoint and password were saved to your user config ({path}).\n" +

59 " For security they only take effect from the user scope (a checked-out\n" +

60 " repository must not redirect credentials), so they are not written to project/local.",

61 statusTitle: "Connection Info",

dist/ink/screens/UpdateCheckScreen.jsView file

Lines 1-23javascript

1import { jsxs as _jsxs, jsx as _jsx } from "react/jsx-runtime";

2import { useState, useEffect } from "react";

3import { Box, Text, useInput } from "ink";

4import { exec } from "node:child_process";

5import { colors, icons } from

dist/plugins/dispatch.jsView file

Lines 342-382javascript

342 // タイムアウト・壊れた応答では絶対にブロックしない (fail-open — 既存

343 // プラグインに退行経路を作らない)。メタデータ照会 (--plugin-schema /

344 // --plugin-healthcheck) はバイパス: GUI が platforms を知る手段そのもの

345 // であり、ここを塞ぐと非対応 OS から自己記述が読めなくなる。

346 const isMetadataProbe = args[0] === "--plugin-schema" || args[0] === "--plugin-healthcheck";

scripts/check-adc.mjsView file

Lines 474-514javascript

474} else console.log(` - skip（${FAST ? "--fast" : "mongod なし"}）`);

475

476// ── elastic（ES が居れば・使い捨て index）──

477console.log("\n[elastic] C3〜C9 + C10");

478let esUp = false;

479

plugins/install.shView file

•path = plugins/install.sh kind = build_helper sizeBytes = 4000 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

plugins/install.shView on unpkg