registry / impel-cli / 0.11.0

impel-cli@0.11.0

Configure Claude Code and Codex CLI to talk to Impel's gateway, authenticated by an Impel Personal Access Token

Static Scan Results

scanned 1d ago · by rust-scanner

Static analysis completed at 93.0% confidence. No malicious behavior was detected; 11 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 35 file(s), 335 KB of source, external domains: apps.microsoft.com, claude.com, downloads.claude.ai, gateway.useimpel.ai, gateway.useimpel.com, persistent.oaistatic.com, registry.npmjs.org, www.apple.com, www.useimpel.com

Source & flagged code

4 flagged

src/updates.jsView file

Lines 1-31javascript

1// Update discovery shared by `impel update`, launch-time notices, and the

2// app-triggered background refresh.

3//

4// impel-cli is distributed as a public npm package. The package contains only

5// the same dependency-free JavaScript users run locally; access to Impel is

6// still enforced by PAT verification and live product/tenant authorization at

7// the control plane and gateway. Update checks therefore use npm's public

8// registry metadata and never require access to the private source repository.

10import fs from "node:fs";

11import path from "node:path";

12import { spawn } from "node:child_process";

13import { fileURLToPath } from "node:url";

High

Child Process

Package source references child process execution.

src/updates.jsView on unpkg · L11

15import { CONFIG_DIR } from "./config.js";

17export const UPDATE_CACHE_PATH = path.join(CONFIG_DIR, "update-check.json");

18export const UPDATE_CHECK_TTL_MS = 6 * 60 * 60 * 1000;

20const CLI_ROOT = fileURLToPath(new URL("..", import.meta.url));

21const DEFAULT_UPDATE_PACKAGE = "impel-cli";

22const DEFAULT_UPDATE_REGISTRY = "https://registry.npmjs.org";

23const VERSION_RE = /^(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?(?:\+[0-9A-Za-z.-]+)?$/u;

25export function updatePackage() {

26 return process.env.IMPEL_UPDATE_PACKAGE || DEFAULT_UPDATE_PACKAGE;

27}

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

src/updates.jsView on unpkg · L11

29export function updateRegistry() {

30 return String(process.env.IMPEL_UPDATE_REGISTRY || DEFAULT_UPDATE_REGISTRY).replace(/\/+$/u, "");

31}

•matchType = previous_version_dangerous_delta matchedPackage = impel-cli@0.7.2 matchedIdentity = npm:aW1wZWwtY2xp:0.7.2 similarity = 0.656 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/updates.jsView on unpkg

src/commands/update.jsView file

Lines 170-210javascript

170 if (remote) io.writeCache({ remoteVersion: remote, checkedAt: Date.now() });

171

172 console.log(`impel-cli v${current ?? "?"}`);

173 console.log(`npm latest: ${remote ? `v${remote}` : "unknown — registry check failed"}`);

Source & flagged code

4 flagged · loading source

src/updates.jsView file

11import path from "node:path"; L12: import { spawn } from "node:child_process"; L13: import { fileURLToPath } from "node:url";

High

Child Process

Package source references child process execution.

src/updates.jsView on unpkg · L11

11import path from "node:path"; L12: import { spawn } from "node:child_process"; L13: import { fileURLToPath } from "node:url"; ... L21: const DEFAULT_UPDATE_PACKAGE = "impel-cli"; L22: const DEFAULT_UPDATE_REGISTRY = "https://registry.npmjs.org"; L23: const VERSION_RE = /^(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?(?:\+[0-9A-Za-z.-]+)?$/u; ... L25: export function updatePackage() { L26: return process.env.IMPEL_UPDATE_PACKAGE || DEFAULT_UPDATE_PACKAGE; L27: }

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

src/updates.jsView on unpkg · L11

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/updates.jsView on unpkg

src/commands/update.jsView file

190if (io.platform === "win32") { L191: console.error(" Verify `npm --version` in PowerShell, then retry `impel update`."); L192: console.error(" Manual recovery: `npm install --global impel-cli@latest`.");

High

Shell

Package source references shell execution.

src/commands/update.jsView on unpkg · L190

Findings

4 High2 Medium5 Low

HighChild Processsrc/updates.js

HighShellsrc/commands/update.js

HighSame File Env Network Executionsrc/updates.js

HighPrevious Version Dangerous Deltasrc/updates.js

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

4 flagged

src/updates.jsView file

Lines 1-31javascript

1// Update discovery shared by `impel update`, launch-time notices, and the

2// app-triggered background refresh.

3//

4// impel-cli is distributed as a public npm package. The package contains only

5// the same dependency-free JavaScript users run locally; access to Impel is

6// still enforced by PAT verification and live product/tenant authorization at

7// the control plane and gateway. Update checks therefore use npm's public

8// registry metadata and never require access to the private source repository.

10import fs from "node:fs";

11import path from "node:path";

12import { spawn } from "node:child_process";

13import { fileURLToPath } from "node:url";

High

Child Process

Package source references child process execution.

src/updates.jsView on unpkg · L11

15import { CONFIG_DIR } from "./config.js";

17export const UPDATE_CACHE_PATH = path.join(CONFIG_DIR, "update-check.json");

18export const UPDATE_CHECK_TTL_MS = 6 * 60 * 60 * 1000;

20const CLI_ROOT = fileURLToPath(new URL("..", import.meta.url));

21const DEFAULT_UPDATE_PACKAGE = "impel-cli";

22const DEFAULT_UPDATE_REGISTRY = "https://registry.npmjs.org";

23const VERSION_RE = /^(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?(?:\+[0-9A-Za-z.-]+)?$/u;

25export function updatePackage() {

26 return process.env.IMPEL_UPDATE_PACKAGE || DEFAULT_UPDATE_PACKAGE;

27}

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

src/updates.jsView on unpkg · L11

29export function updateRegistry() {

30 return String(process.env.IMPEL_UPDATE_REGISTRY || DEFAULT_UPDATE_REGISTRY).replace(/\/+$/u, "");

31}

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/updates.jsView on unpkg

src/commands/update.jsView file

Lines 170-210javascript

170 if (remote) io.writeCache({ remoteVersion: remote, checkedAt: Date.now() });

171

172 console.log(`impel-cli v${current ?? "?"}`);

173 console.log(`npm latest: ${remote ? `v${remote}` : "unknown — registry check failed"}`);