registry / nonsudo / 2.1.0

nonsudo@2.1.0

Runtime governance and execution evidence for AI agents.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystem

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

Manifest

NoLicense

scanned 6 file(s), 3.72 MB of source, external domains: dub.sh, feross.org, git.io, github.com

Source & flagged code

3 flagged

dist/proxy-entry.mjsView file

1import {dirname,resolve,join,relative,isAbsolute}from'path';import'fs/promises';import {readFileSync,realpathSync,statSync}from'fs';import {randomUUID,timingSafeEqual}from'crypto';... L2: `)}};Tu.defaultYaml={explicit:false,version:"1.2"};Tu.defaultTags={"!!":"tag:yaml.org,2002:"};SI.Directives=Tu;});var wm=E(Pu=>{var EI=fe(),GL=Ou();function zL(n){if(/[\x00-\x19\s,...

High

Child Process

Package source references child process execution.

dist/proxy-entry.mjsView on unpkg · L1

142at `+t[r].toString();return i}return e&&(i+=" at "+E1(e)),i}function Vq(n,e,t){var s="\x1B[36;1m"+this._namespace+"\x1B[22;39m \x1B[33;1mdeprecated\x1B[22;39m \x1B[0m"+n+"\x1B[39m"... L143: \x1B[36mat `+t[i].toString()+"\x1B[39m";return s}return e&&(s+=" \x1B[36m"+E1(e)+"\x1B[39m"),s}function E1(n){return Nq(Cq,n[0])+":"+n[1]+":"+n[2]}function yg(){var n=Error.stackTr... L144: return function (`+t+`) {log.call(deprecate, message, site)

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/proxy-entry.mjsView on unpkg · L142

dist/index.jsView file

Lines 1-21javascript

1'use strict';var fs$1=require('fs'),path=require('path'),child_process=require('child_process'),crypto=require('crypto');var eo=Object.create;var In=Object.defineProperty;var to=Object.getOwnPropertyDescriptor;var no=Object.getOwnPropertyNames;var io=Object.getPrototypeOf,ro=Object.prototype.hasOwnProperty;

2`).replace(/^/gm," ".repeat(o))}let u=[`Usage: ${n.commandUsage(e)}`,""],d=n.commandDescription(e);d.length>0&&(u=u.concat([n.wrap(d,r,0),""]));let l=n.visibleArguments(e).map(f=>a(n.argumentTerm(f),n.argumentDescription(f)));l.length>0&&(u=u.concat(["Arguments:",c(l),""]));let h=n.visibleOptions(e).map(f=>a(n.optionTerm(f),n.optionDescription(f)));if(h.length>0&&(u=u.concat(["Options:",c(h),""])),this.showGlobalOptions){let f=n.visibleGlobalOptions(e).map(g=>a(n.optionTerm(g),n.optionDescription(g)));f.length>0&&(u=u.concat(["Global Options:",c(f),""]));}let m=n.visibleCommands(e).map(f=>a(n. ...

3`)}padWidth(e,n){return Math.max(n.longestOptionTermLength(e,n),n.longestGlobalOptionTermLength(e,n),n.longestSubcommandTermLength(e,n),n.longestArgumentTermLength(e,n))}wrap(e,n,

4`,`

5`),d=" ".repeat(i),h="\\s\u200B",m=new RegExp(`

6|.{1,${a-1}}([${h}]|$)|[^${h}]+?([${h}]|$)`,"g"),f=u.match(m)||[];return c+f.map((g,O)=>g===`

7`?"":(O>0?d:"")+g.trimEnd()).join(`

8`)}};Bn.Help=Tt;});var Pt=ie(Lt=>{var{InvalidArgumentError:Vo}=Te(),Dt=class{constructor(e,n){this.flags=e,this.description=n||"",this.required=e.includes("<"),this.optional=e.

9(Did you mean one of ${i.join(", ")}?)`:i.length===1?`

10(Did you mean ${i[0]}?)`:""}qn.suggestSimilar=qo;});var Yn=ie(Wn=>{var jo=Se("events").EventEmitter,$t=Se("child_process"),J=Se("path"),Ut=Se("fs"),T=Se("process"),{Argument:Ko,

11- specify the name in Command constructor or using .name()`);return n=n||{},n.isDefault&&(this._defaultCommandName=e._name),(n.noHelp||n.hidden)&&(e._hidden=true),this._registerCommand(e),e.parent=this,e._checkForBrokenPassThrough(),this}createArgument(e,n){return new Ko(e,n)}argument(e,n,i,r){let o=this.createArgument(e,n);return typeof i=="function"?o.default(r).argParser(i):o.default(i),this.addArgument(o),this}arguments(e){return e.trim().split(/ +/).forEach(n=>{this.argument(n);}),this}addArgument(e){let n=this.registeredArguments.slice(-1)[0];if(n&&n.variadic)throw new Error(`only the la ...

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/index.jsView on unpkg · L1

12Expecting one of '${i.join("', '")}'`);return this._lifeCycleHooks[e]?this._lifeCycleHooks[e].push(n):this._lifeCycleHooks[e]=[n],this}exitOverride(e){return e?this._exitCallback=e:this._exitCallback=n=>{if(n.code!=="commander.executeSubCommandAsync")throw n},this}_exit(e,n,i){this._exitCallback&&this._exitCallback(new Ft(e,n,i)),T.exit(e);}action(e){let n=i=>{let r=this.registeredArguments.length,o=i.slice(0,r);return this._storeOptionsAsProperties?o[r]=this:o[r]=this.opts(),o.push(this),e.apply(this,o)};return this._actionHandler=n,this}createOption(e,n){return new Kn(e,n)}_callParseArg(e,n, ...

13- already used by option '${n.flags}'`)}this.options.push(e);}_registerCommand(e){let n=r=>[r.name()].concat(r.aliases()),i=n(e).find(r=>this._findCommand(r));if(i){let r=n(this._findCommand(i)).join("|"),o=n(e).

14 - if '${e._name}' is not meant to be an executable command, remove description parameter from '.command()' and use '.description()' instead

15 - if the default executable name is not suitable, use the executableFile option to supply a custom name or path

16 - ${l}`;throw new Error(h)}else if(d.code==="EACCES")throw new Error(`'${s}' not executable`);if(!u)T.exit(1);else {let l=new Ft(1,"commander.executeSubCommandAsync","(error)");l.nestedError=d,u(l);}}),this.runningCommand=c;}_dispatchSubcommand(e,n,i){let r=this._findCommand(e);r||this.help({error:true});let o;return o=this._chainOrCallSubCommandHook(o,r,"preSubcommand"),o=this._chainOrCall(o,()=>{if(r._executableHandler)this._executeSubCommand(r,n.concat(i));else return r._parseCommand(n,i)}),o}_dispatchHelpCommand(e){e||this.help();let n=this._findCommand(e);return n&&!n._executableHandler& ...

17`,this._outputConfiguration.writeErr),typeof this._showHelpAfterError=="string"?this._outputConfiguration.writeErr(`${this._showHelpAfterError}

18`):this._showHelpAfterError&&(this._outputConfiguration.writeErr(`

19`),this.outputHelp({error:true}));let i=n||{},r=i.exitCode||1,o=i.code||"commander.error";this._exit(r,o,e);}_parseOptionsEnv(){this.options.forEach(e=>{if(e.envVar&&e.envVar in T.env){let n=e.attributeName();(this.getOptionValue(n)===void

20`),this._exit(0,"commander.version",e);}),this}description(e,n){return e===void 0&&n===void 0?this._description:(this._description=e,n&&(this._argsDescription=n),this)}summary(e){return e===void 0?this._summary:(this._summary=e,this)}alias(e){if(e===void 0)return this._aliases[0];let n=this;if(this.commands.length!==0&&this.commands[this.commands.length-1]._executableHandler&&(n=this.commands[this.commands.length-1]),e===n._name)throw new Error("Command alias can't be the same as its name");let i=this.parent?._findCommand(e);if(i){let r=[i.name()].concat(i.aliases()).join("|");throw new Error( ...

21Expecting one of '${i.join("', '")}'`);let r=`${e}Help`;return this.on(r,o=>{let s;typeof n=="function"?s=n({error:o.error,command:o.command}):s=n,s&&o.write(`${s}

Long lines were clipped for display.

Source & flagged code

3 flagged · loading source

dist/proxy-entry.mjsView file

High

Child Process

Package source references child process execution.

dist/proxy-entry.mjsView on unpkg · L1

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/proxy-entry.mjsView on unpkg · L142

dist/index.jsView file

1Cross-file remote execution chain: dist/index.js spawns dist/proxy-entry.js; helper contains network access plus dynamic code execution. L1: 'use strict';var fs$1=require('fs'),path=require('path'),child_process=require('child_process'),crypto=require('crypto');var eo=Object.create;var In=Object.defineProperty;var to=Ob... L2: `).replace(/^/gm," ".repeat(o))}let u=[`Usage: ${n.commandUsage(e)}`,""],d=n.commandDescription(e);d.length>0&&(u=u.concat([n.wrap(d,r,0),""]));let l=n.visibleArguments(e).map(f=>a... ... L9: (Did you mean one of ${i.join(", ")}?)`:i.length===1?` L10: (Did you mean ${i[0]}?)`:""}qn.suggestSimilar=qo;});var Yn=ie(Wn=>{var jo=Se("events").EventEmitter,$t=Se("child_process"),J=Se("path"),Ut=Se("fs"),T=Se("process"),{Argument:Ko,hum... L11: - specify the name in Command constructor or using .name()`);return n=n||{},n.isDefault&&(this._defaultCommandName=e._name),(n.noHelp||n.hidden)&&(e._hidden=true),this._registerCom... ... L136: Writes PUBLIC material only: a JWK map { <key_id>: JWK, "default": JWK } L137: (OKP/Ed25519, base64url public point in \`x\`). The seed and private key L138: are never written or echoed. Pass the output to ... L145: Delegates to: pnpm …

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/index.jsView on unpkg · L1

Findings

3 High2 Medium6 Low

HighChild Processdist/proxy-entry.mjs

HighCross File Remote Execution Contextdist/index.js

HighObfuscated

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvaldist/proxy-entry.mjs

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

3 flagged

dist/proxy-entry.mjsView file

High

Child Process

Package source references child process execution.

dist/proxy-entry.mjsView on unpkg · L1

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/proxy-entry.mjsView on unpkg · L142

dist/index.jsView file

Lines 1-21javascript

3`)}padWidth(e,n){return Math.max(n.longestOptionTermLength(e,n),n.longestGlobalOptionTermLength(e,n),n.longestSubcommandTermLength(e,n),n.longestArgumentTermLength(e,n))}wrap(e,n,

4`,`

5`),d=" ".repeat(i),h="\\s\u200B",m=new RegExp(`

6|.{1,${a-1}}([${h}]|$)|[^${h}]+?([${h}]|$)`,"g"),f=u.match(m)||[];return c+f.map((g,O)=>g===`

7`?"":(O>0?d:"")+g.trimEnd()).join(`

8`)}};Bn.Help=Tt;});var Pt=ie(Lt=>{var{InvalidArgumentError:Vo}=Te(),Dt=class{constructor(e,n){this.flags=e,this.description=n||"",this.required=e.includes("<"),this.optional=e.

9(Did you mean one of ${i.join(", ")}?)`:i.length===1?`

10(Did you mean ${i[0]}?)`:""}qn.suggestSimilar=qo;});var Yn=ie(Wn=>{var jo=Se("events").EventEmitter,$t=Se("child_process"),J=Se("path"),Ut=Se("fs"),T=Se("process"),{Argument:Ko,

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/index.jsView on unpkg · L1

14 - if '${e._name}' is not meant to be an executable command, remove description parameter from '.command()' and use '.description()' instead

15 - if the default executable name is not suitable, use the executableFile option to supply a custom name or path

17`,this._outputConfiguration.writeErr),typeof this._showHelpAfterError=="string"?this._outputConfiguration.writeErr(`${this._showHelpAfterError}

18`):this._showHelpAfterError&&(this._outputConfiguration.writeErr(`

21Expecting one of '${i.join("', '")}'`);let r=`${e}Help`;return this.on(r,o=>{let s;typeof n=="function"?s=n({error:o.error,command:o.command}):s=n,s&&o.write(`${s}

Long lines were clipped for display.