registry / insta / 0.0.5

insta@0.0.5

InstaCloud CLI — a thin client of the platform control-plane API.

Static Scan Results

scanned 4d ago · by rust-scanner

Static analysis flagged 10 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 23 file(s), 79.2 KB of source, external domains: 127.0.0.1, beta-api.insta.insforge.dev, fly.io

Source & flagged code

2 flagged

dist/flyctl-build.jsView file

Lines 1-23javascript

1// Build a source directory into an image and push it to Fly's registry, using a short-lived,

2// app-scoped deploy token minted by the platform (the CLI never holds a standing Fly credential).

3// Shells out to `flyctl deploy --build-only --push` (remote builder). Ported from firth.

4import { spawn } from 'node:child_process';

5import { existsSync, writeFileSync, unlinkSync } from 'node:fs';

6import { join } from 'node:path';

7import { info } from './util.js';

8// Spawn flyctl, tee its output to the user (so they see buildkit progress) AND capture it for digest

9// parsing.

10export const defaultBuildRunner = (cmd, args, opts) => new Promise((resolve) => {

11 const child = spawn(cmd, args, { cwd: opts.cwd, env: opts.env, stdio: ['inherit', 'pipe', 'pipe'] });

12 let output = '';

13 child.stdout?.on('data', (b) => { const s = b.toString(); output += s; process.stdout.write(s); });

14 child.stderr?.on('data', (b) => { const s = b.toString(); output += s; process.stderr.write(s); });

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/flyctl-build.jsView on unpkg · L3

15 child.on('error', (err) => resolve({ code: -1, output: `${output}\n${err.message}` }));

16 child.on('close', (code) => resolve({ code: code ?? -1, output }));

17});

18// buildkit prints "pushing manifest for registry.fly.io/<app>:<label>@sha256:<digest>" on push.

19// Pin to the digest — the bare tag races on Fly's registry (MANIFEST_UNKNOWN); the digest always resolves.

20export function parseImageDigest(output, flyApp) {

21 const m = output.match(/pushing manifest for registry\.fly\.io\/[^\s]+@(sha256:[0-9a-f]+)/);

22 return m ? `registry.fly.io/${flyApp}@${m[1]}` : null;

23}

dist/ensure-skills.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = insta@0.0.4 matchedIdentity = npm:aW5zdGE:0.0.4 similarity = 0.957 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/ensure-skills.jsView on unpkg

Source & flagged code

2 flagged · loading source

dist/flyctl-build.jsView file

3// Shells out to `flyctl deploy --build-only --push` (remote builder). Ported from firth. L4: import { spawn } from 'node:child_process'; L5: import { existsSync, writeFileSync, unlinkSync } from 'node:fs'; ... L12: let output = ''; L13: child.stdout?.on('data', (b) => { const s = b.toString(); output += s; process.stdout.write(s); }); L14: child.stderr?.on('data', (b) => { const s = b.toString(); output += s; process.stderr.write(s); }); ... L46: try { L47: const { code, output } = await run('flyctl', ['deploy', '--remote-only', '--build-only', '--push', '--app', opts.flyApp, '--image-label', opts.imageLabel, '--no-cache'], { cwd: opt... L48: if (code !== 0) ... L69: return; L70: if (process.platform === 'darwin' && (await ok('brew', ['--version']))) { L71: info('flyctl not found — installing with `brew install flyctl` (one-time)…');

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/flyctl-build.jsView on unpkg · L3

dist/ensure-skills.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/ensure-skills.jsView on unpkg

Findings

2 High3 Medium5 Low

HighSandbox Evasion Gated Capabilitydist/flyctl-build.js

HighPrevious Version Dangerous Deltadist/ensure-skills.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

dist/flyctl-build.jsView file

Lines 1-23javascript

1// Build a source directory into an image and push it to Fly's registry, using a short-lived,

2// app-scoped deploy token minted by the platform (the CLI never holds a standing Fly credential).

3// Shells out to `flyctl deploy --build-only --push` (remote builder). Ported from firth.

4import { spawn } from 'node:child_process';

5import { existsSync, writeFileSync, unlinkSync } from 'node:fs';

6import { join } from 'node:path';

7import { info } from './util.js';

8// Spawn flyctl, tee its output to the user (so they see buildkit progress) AND capture it for digest

9// parsing.

10export const defaultBuildRunner = (cmd, args, opts) => new Promise((resolve) => {

11 const child = spawn(cmd, args, { cwd: opts.cwd, env: opts.env, stdio: ['inherit', 'pipe', 'pipe'] });

12 let output = '';

13 child.stdout?.on('data', (b) => { const s = b.toString(); output += s; process.stdout.write(s); });

14 child.stderr?.on('data', (b) => { const s = b.toString(); output += s; process.stderr.write(s); });

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/flyctl-build.jsView on unpkg · L3

15 child.on('error', (err) => resolve({ code: -1, output: `${output}\n${err.message}` }));

16 child.on('close', (code) => resolve({ code: code ?? -1, output }));

17});

18// buildkit prints "pushing manifest for registry.fly.io/<app>:<label>@sha256:<digest>" on push.

19// Pin to the digest — the bare tag races on Fly's registry (MANIFEST_UNKNOWN); the digest always resolves.

20export function parseImageDigest(output, flyApp) {

21 const m = output.match(/pushing manifest for registry\.fly\.io\/[^\s]+@(sha256:[0-9a-f]+)/);

22 return m ? `registry.fly.io/${flyApp}@${m[1]}` : null;

23}

dist/ensure-skills.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/ensure-skills.jsView on unpkg