registry / lastlight / 0.18.0

lastlight@0.18.0

Last Light CLI — a lean global client + host-local `server` lifecycle for the Last Light GitHub maintenance agent, plus the Claude Code plugin.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 9 file(s), 173 KB of source, external domains: 127.0.0.1, github.com, lastlight.example.com

Source & flagged code

5 flagged

dist/setup.jsView file

Lines 30-71javascript

30 * Returns the resolved absolute path or null if not found.

31 */

32function resolvePem(input) {

33 let expanded = input;

34 if (expanded.startsWith("~/")) {

35 expanded = join(process.env.HOME || "", expanded.slice(2));

36 }

37 const candidates = [

38 resolve(expanded),

39 resolve("..", expanded),

40 ];

41 for (const candidate of candidates) {

42 if (isPemFile(candidate))

43 return candidate;

44 }

45 return null;

46}

47export function isPemFile(filePath) {

48 try {

49 const content = readFileSync(filePath, "utf8");

50 return (content.startsWith("-----BEGIN RSA PRIVATE KEY-----") ||

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/setup.jsView on unpkg · L50

Critical

Secret Pattern

RSA private key in dist/setup.js

dist/setup.jsView on unpkg · L50

51 content.startsWith("-----BEGIN PRIVATE KEY-----"));

Critical

Secret Pattern

RSA private key in dist/setup.js

dist/setup.jsView on unpkg · L51

52 }

53 catch {

54 return false;

55 }

56}

57export function isSlackBotToken(s) {

58 return s.startsWith("xoxb-");

59}

60export function isSlackAppToken(s) {

61 return s.startsWith("xapp-");

62}

63// ── .env serialization (exported for unit tests) ────────────────────────────

64export function buildEnvContent(config) {

65 // `undefined` mode is treated as `app` for backward compatibility.

66 const mode = config.mode ?? "app";

67 const lines = [

68 "# ── Last Light — Environment Variables ─────────────────────",

69 "# Generated by: npx lastlight setup",

70 "",

71 "# ── Overlay (this deployment's private config + assets) ──",

dist/cli.jsView file

Lines 1-37javascript

1#!/usr/bin/env node

2/**

3 * Last Light CLI — `lastlight`.

4 *

5 * A thin client for a running Last Light instance. It does NOT run agents

6 * itself; it POSTs triggers and reads the instance's admin API over HTTP.

7 *

8 * lastlight login [url] Authenticate (browser) + save the token

9 * lastlight <github-url|ref> Triage that issue (default — cheap)

10 * lastlight build <ref> Run the FULL build cycle

Source & flagged code

5 flagged · loading source

dist/setup.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code