registry / iobend / 2.6.3

iobend@2.6.3

⚠ Under review

Developer Environment Manager

Static Scan Results

scanned 19d ago · by rust-scanner

Static analysis completed at 0.0% confidence. No malicious behavior was detected; 14 low-signal pattern(s) were surfaced and cleared.

Static reason

Automated AI review exhausted its retry budget. This package remains unresolved and must not warn or block users.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 119 file(s), 469 KB of source, external domains: api.adoptium.net, fonts.googleapis.com, github.com, go.dev, iobend.cloud, iobend.com, nodejs.org, pypi.org, raw.githubusercontent.com, registry.npmjs.org, www.iobend.com, www.python.org

Source & flagged code

7 flagged

src/commands/dotfiles/index.jsView file

Lines 1-25javascript

1import fs from 'fs/promises';

2import path from 'path';

3import os from 'os';

4import { logger, isJsonMode, printJson } from '../../utils/logger.js';

6const DOTFILES_DIR = path.join(os.homedir(), '.iobend', 'dotfiles');

7const TARGET_FILES = ['.zshrc', '.bashrc', '.gitconfig', '.vimrc', '.tmux.conf'];

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

src/commands/dotfiles/index.jsView on unpkg · L5

9/**

10 * iobend dotfiles [action]

11 * Synchronizes and backs up personal shell dotfiles across developer machines.

12 */

13export async function dotfilesCommand(actionArg = 'sync', options = {}) {

14 try {

15 await fs.mkdir(DOTFILES_DIR, { recursive: true });

16 const homeDir = os.homedir();

17 const action = actionArg.toLowerCase().trim();

19 const results = [];

21 for (const fileName of TARGET_FILES) {

22 const sourcePath = path.join(homeDir, fileName);

23 const backupPath = path.join(DOTFILES_DIR, fileName);

25 try {

src/commands/verify/index.jsView file

Lines 1-30javascript

1import { logger } from '../../utils/logger.js';

2import { getGlobalConfig } from '../../utils/config.js';

4export async function verifyCommand(tool) {

src/commands/scan/index.jsView file

Lines 1-24javascript

1import chalk from 'chalk';

2import ora from 'ora';

3import fs from 'fs';

4import path from 'path';

src/commands/info/index.jsView file

Lines 1-31javascript

1import { getToolInfo } from '../../installers/index.js';

2import { logger } from '../../utils/logger.js';

3import { getGlobalConfig } from '../../utils/config.js';

5export async

src/commands/completion/index.jsView file

Lines 1-30javascript

1import fs from 'fs';

2import path from 'path';

3import os from 'os';

4import { logger, isJsonMode, printJson } from '../../utils/logger.js';

src/commands/deps/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = iobend@2.6.1 matchedIdentity = npm:aW9iZW5k:2.6.1 similarity = 0.950 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/commands/deps/index.jsView on unpkg

Source & flagged code

7 flagged · loading source

src/commands/dotfiles/index.jsView file

iobend@2.6.3

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code