registry / networkr / 0.3.0

networkr@0.3.0

One-line install for the Networkr SEO network — audit, onboard, and auto-publish SEO blog content to your site. Agent-first, no dashboard.

Static Scan Results

scanned 4h ago · by rust-scanner

Static analysis flagged 8 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 19 file(s), 170 KB of source, external domains: api.networkr.dev, networkr.dev

Source & flagged code

2 flagged

lib/commands/init.jsView file

Lines 359-399javascript

359

360 // Collect adapter creds. Flags/env fill in as much as possible; the

361 // remainder falls to prompts when TTY. A --json or non-TTY run with

362 // missing creds throws a clear error naming the flag.

363 const extras = collectAdapterExtras(flags, db_type);

364 const requiredKeys = STORAGE_REQUIRED[db_type] || [];

365 const missing = requiredKeys.filter(k => !(k in extras));

366

367 if (missing.length > 0) {

368 if (!process.stdout.isTTY || isJson) {

369 const flagNames = missing.map(k => `--${FLAG_MAP[k].flag}`).join(', ');

370 throw new Error(`Missing storage credentials for ${db_type}: ${flagNames}`);

371 }

372 // Interactive: prompt for just the missing ones. Keeps password-typed

373 // inputs hidden, and uses sensible defaults where the backend already

374 // accepts them.

375 const promptSpecs = missing.map(k => {

376 const label = {

377 db_url: 'Database URL',

378 db_key: 'Service / admin key',

379 db_password: 'Admin password',

Medium

Secret Pattern

Package contains a possible secret pattern.

lib/commands/init.jsView on unpkg · L379

380 db_table: 'Table name',

381 db_collection: 'Collection name',

382 firebase_project_id: 'Firebase project ID',

383 firebase_service_email: 'Firebase service-account email',

384 firebase_service_key: 'Firebase service-account private key',

385 appwrite_project_id: 'Appwrite project ID',

386 appwrite_api_key: 'Appwrite API key',

387 appwrite_database_id: 'Appwrite database ID',

388 mongodb_endpoint: 'MongoDB Data API endpoint',

389 mongodb_api_key: 'MongoDB API key',

390 }[k] || k;

391 const isSecret = /(_key|_password)$/.test(k);

392 return { type: isSecret ? 'password' : 'text', name: k, message: label };

393 });

394 const filled = await prompts(promptSpecs, { onCancel });

395 Object.assign(extras, filled);

396 }

397

398 // --internal-links override: takes JSON array string OR comma-separated

399 // path list. Server accepts either {name,url} objects or bare paths.

lib/commands/recorder.jsView file

Lines 1-41javascript

1// `npx networkr recorder` — Loom-style screen recordings from the terminal.

2//

3// The terminal can't capture your screen (getDisplayMedia is a browser API),

4// so this command is the ORCHESTRATOR: it opens the hosted recorder page in

5// your browser with your tenant key in the URL hash, then watches the backend

6// pipeline (upload → process → transcribe → AI kit) and drives posting to

7// socials — all without leaving the terminal.

8//

9// npx networkr recorder open recorder + watch the pipeline

10// (first TTY run: 30-second settings wizard)

11// npx networkr recorder settings re-run the wizard (--json prints current)

Source & flagged code

2 flagged · loading source

lib/commands/init.jsView file

379patternName = generic_password severity = medium line = 379 matchedText = db_passw...rd',

Medium

Secret Pattern

Package contains a possible secret pattern.

lib/commands/init.jsView on unpkg · L379

lib/commands/recorder.jsView file

21L22: import { spawn } from 'node:child_process'; L23: import pc from 'picocolors'; ... L31: const RECORDER_PAGE = () => L32: process.env.NETWORKR_RECORDER_URL || 'https://networkr.dev/recorder'; L33: ... L51: function openBrowser(url) { L52: const cmd = process.platform === 'darwin' ? 'open' L53: : process.platform === 'win32' ? 'start' ... L107: if (cancelled) return null; L108: const r = await api('/api/recorder/settings', { method: 'PUT', token: key, body: answers }); L109: ok(`saved — recordings cap at ${fmtLen(r.settings.max_seconds)}, ${r.settings.bg} cam, ${r.settings.corner} corner`);

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

lib/commands/recorder.jsView on unpkg · L21

Findings

1 High4 Medium3 Low

HighSandbox Evasion Gated Capabilitylib/commands/recorder.js

MediumSecret Patternlib/commands/init.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

lib/commands/init.jsView file

Lines 359-399javascript

359

360 // Collect adapter creds. Flags/env fill in as much as possible; the

361 // remainder falls to prompts when TTY. A --json or non-TTY run with

362 // missing creds throws a clear error naming the flag.

363 const extras = collectAdapterExtras(flags, db_type);

364 const requiredKeys = STORAGE_REQUIRED[db_type] || [];

365 const missing = requiredKeys.filter(k => !(k in extras));

366

367 if (missing.length > 0) {

368 if (!process.stdout.isTTY || isJson) {

369 const flagNames = missing.map(k => `--${FLAG_MAP[k].flag}`).join(', ');

370 throw new Error(`Missing storage credentials for ${db_type}: ${flagNames}`);

371 }

372 // Interactive: prompt for just the missing ones. Keeps password-typed

373 // inputs hidden, and uses sensible defaults where the backend already

374 // accepts them.

375 const promptSpecs = missing.map(k => {

376 const label = {

377 db_url: 'Database URL',

378 db_key: 'Service / admin key',

379 db_password: 'Admin password',

Medium

Secret Pattern

Package contains a possible secret pattern.

lib/commands/init.jsView on unpkg · L379

380 db_table: 'Table name',

381 db_collection: 'Collection name',

382 firebase_project_id: 'Firebase project ID',

383 firebase_service_email: 'Firebase service-account email',

384 firebase_service_key: 'Firebase service-account private key',

385 appwrite_project_id: 'Appwrite project ID',

386 appwrite_api_key: 'Appwrite API key',

387 appwrite_database_id: 'Appwrite database ID',

388 mongodb_endpoint: 'MongoDB Data API endpoint',

389 mongodb_api_key: 'MongoDB API key',

390 }[k] || k;

391 const isSecret = /(_key|_password)$/.test(k);

392 return { type: isSecret ? 'password' : 'text', name: k, message: label };

393 });

394 const filled = await prompts(promptSpecs, { onCancel });

395 Object.assign(extras, filled);

396 }

397

398 // --internal-links override: takes JSON array string OR comma-separated

399 // path list. Server accepts either {name,url} objects or bare paths.

lib/commands/recorder.jsView file

Lines 1-41javascript

1// `npx networkr recorder` — Loom-style screen recordings from the terminal.

2//

3// The terminal can't capture your screen (getDisplayMedia is a browser API),

4// so this command is the ORCHESTRATOR: it opens the hosted recorder page in

5// your browser with your tenant key in the URL hash, then watches the backend

6// pipeline (upload → process → transcribe → AI kit) and drives posting to

7// socials — all without leaving the terminal.

8//

9// npx networkr recorder open recorder + watch the pipeline

10// (first TTY run: 30-second settings wizard)

11// npx networkr recorder settings re-run the wizard (--json prints current)