registry / impel-cli / 0.13.2

impel-cli@0.13.2

Configure Claude Code and Codex CLI to talk to Impel's gateway, authenticated by an Impel Personal Access Token

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis completed at 93.0% confidence. No malicious behavior was detected; 12 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 37 file(s), 382 KB of source, external domains: apps.microsoft.com, claude.com, downloads.claude.ai, gateway.useimpel.ai, gateway.useimpel.com, persistent.oaistatic.com, registry.npmjs.org, www.apple.com, www.useimpel.com

Source & flagged code

5 flagged

src/codesign.jsView file

Lines 6-46javascript

6// stable identity: its requirement degenerates to the binary's own cdhash,

7// which changes on every rebuild. So each time `impel app update` re-signed a

8// rebuilt bundle, macOS saw a brand-new app and re-prompted for every

9// permission the user had already granted.

10//

11// Signing rebuilds with a stable per-machine self-signed certificate instead

12// gives the bundle a constant designated requirement, so TCC grants survive

13// updates the way they do for a normal app. The certificate lives in a

14// dedicated keychain under the Impel config dir; no Apple Developer account is

15// involved (these bundles are patched and built on the user's own machine, so

16// Developer ID signing is impossible anyway).

17//

18// Everything here is best-effort: if any step fails — no `security`/`openssl`,

19// a locked keychain, an unusual environment — we fall back to ad-hoc signing,

20// which is exactly today's behavior. Updates never fail because signing could

21// not be upgraded.

23import fs from "node:fs";

24import os from "node:os";

25import path from "node:path";

26import crypto from "node:crypto";

27import { spawnSync } from "node:child_process";

High

Child Process

Package source references child process execution.

src/codesign.jsView on unpkg · L26

29import { CONFIG_DIR } from "./config.js";

31export const SIGNING_IDENTITY_NAME = "Impel Local Codesigning";

33// Ad-hoc: what every managed bundle was signed with before stable identities.

34export const ADHOC_IDENTITY = Object.freeze({

35 mode: "adhoc",

36 signArg: "-",

37 keychainArgs: Object.freeze([]),

38 descriptor: "adhoc",

39});

41/** `codesign` arguments that select the given identity (and its keychain). */

42export function codesignIdentityArgs(identity = ADHOC_IDENTITY) {

43 return [...identity.keychainArgs, "--sign", identity.signArg];

44}

46/**

src/commands/update.jsView file

Lines 190-230javascript

190 if (remote) io.writeCache({ remoteVersion: remote, checkedAt: Date.now() });

191

192 console.log(`impel-cli v${current ?? "?"}`);

193 console.log(`npm latest: ${remote ? `v${remote}` : "unknown — registry check failed"}`);

src/apps.jsView file

Lines 1627-1667javascript

1627printf 'at-%s\\n' "$TOKEN" | "$CODEX_BIN" login --with-access-token >/dev/null 2>&1

1628unset TOKEN

1629secure_codex_home

1630BROWSER_DATA=${shellQuote(paths.chatgpt.browserData)}

1631

src/updates.jsView file

Lines 1-31javascript

1// Update discovery shared by `impel update`, launch-time notices, and the

2// app-triggered background refresh.

3//

4// impel-cli is distributed as a public npm package. The package contains only

5// the same dependency-free JavaScript users run locally; access to Impel is

6// still enforced by PAT verification and live product/tenant authorization at

7// the control plane and gateway. Update checks therefore use npm's public

8// registry metadata and never require access to the private source repository.

10import fs from "node:fs";

Source & flagged code

5 flagged · loading source

src/codesign.jsView file

26import crypto from "node:crypto"; L27: import { spawnSync } from "node:child_process"; L28:

High

Child Process

Package source references child process execution.

src/codesign.jsView on unpkg · L26

src/commands/update.jsView file

210if (io.platform === "win32") { L211: console.error(" Verify `npm --version` in PowerShell, then retry `impel update`."); L212: console.error(" Manual recovery: `npm install --global impel-cli@latest`.");

High

Shell

Package source references shell execution.

src/commands/update.jsView on unpkg · L210

src/apps.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = impel-cli@0.11.1 matchedIdentity = npm:aW1wZWwtY2xp:0.11.1 similarity = 0.771 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/apps.jsView on unpkg

1647if (process.type === "browser" && displayName) { L1648: const Module = require("node:module"); L1649: const path = require("node:path");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/apps.jsView on unpkg · L1647

src/updates.jsView file

11import path from "node:path"; L12: import { spawn } from "node:child_process"; L13: import { fileURLToPath } from "node:url"; ... L21: const DEFAULT_UPDATE_PACKAGE = "impel-cli"; L22: const DEFAULT_UPDATE_REGISTRY = "https://registry.npmjs.org"; L23: const VERSION_RE = /^(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?(?:\+[0-9A-Za-z.-]+)?$/u; ... L25: export function updatePackage() { L26: return process.env.IMPEL_UPDATE_PACKAGE || DEFAULT_UPDATE_PACKAGE; L27: }

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

src/updates.jsView on unpkg · L11

Findings

4 High3 Medium5 Low

HighChild Processsrc/codesign.js

HighShellsrc/commands/update.js

HighSame File Env Network Executionsrc/updates.js

HighPrevious Version Dangerous Deltasrc/apps.js

MediumDynamic Requiresrc/apps.js

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

5 flagged

src/codesign.jsView file

Lines 6-46javascript

6// stable identity: its requirement degenerates to the binary's own cdhash,

7// which changes on every rebuild. So each time `impel app update` re-signed a

8// rebuilt bundle, macOS saw a brand-new app and re-prompted for every

9// permission the user had already granted.

10//

11// Signing rebuilds with a stable per-machine self-signed certificate instead

12// gives the bundle a constant designated requirement, so TCC grants survive

13// updates the way they do for a normal app. The certificate lives in a

14// dedicated keychain under the Impel config dir; no Apple Developer account is

15// involved (these bundles are patched and built on the user's own machine, so

16// Developer ID signing is impossible anyway).

17//

18// Everything here is best-effort: if any step fails — no `security`/`openssl`,

19// a locked keychain, an unusual environment — we fall back to ad-hoc signing,

20// which is exactly today's behavior. Updates never fail because signing could

21// not be upgraded.

23import fs from "node:fs";

24import os from "node:os";

25import path from "node:path";

26import crypto from "node:crypto";

27import { spawnSync } from "node:child_process";

High

Child Process

Package source references child process execution.

src/codesign.jsView on unpkg · L26

29import { CONFIG_DIR } from "./config.js";

31export const SIGNING_IDENTITY_NAME = "Impel Local Codesigning";

33// Ad-hoc: what every managed bundle was signed with before stable identities.

34export const ADHOC_IDENTITY = Object.freeze({

35 mode: "adhoc",

36 signArg: "-",

37 keychainArgs: Object.freeze([]),

38 descriptor: "adhoc",

39});

41/** `codesign` arguments that select the given identity (and its keychain). */

42export function codesignIdentityArgs(identity = ADHOC_IDENTITY) {

43 return [...identity.keychainArgs, "--sign", identity.signArg];

44}

46/**

src/commands/update.jsView file

Lines 190-230javascript

190 if (remote) io.writeCache({ remoteVersion: remote, checkedAt: Date.now() });

191

192 console.log(`impel-cli v${current ?? "?"}`);

193 console.log(`npm latest: ${remote ? `v${remote}` : "unknown — registry check failed"}`);

src/apps.jsView file

Lines 1627-1667javascript

1627printf 'at-%s\\n' "$TOKEN" | "$CODEX_BIN" login --with-access-token >/dev/null 2>&1

1628unset TOKEN

1629secure_codex_home

1630BROWSER_DATA=${shellQuote(paths.chatgpt.browserData)}

1631

src/updates.jsView file

Lines 1-31javascript

1// Update discovery shared by `impel update`, launch-time notices, and the

2// app-triggered background refresh.

3//

4// impel-cli is distributed as a public npm package. The package contains only

5// the same dependency-free JavaScript users run locally; access to Impel is

6// still enforced by PAT verification and live product/tenant authorization at

7// the control plane and gateway. Update checks therefore use npm's public

8// registry metadata and never require access to the private source repository.

10import fs from "node:fs";