registry / oblien / 2.2.43

oblien@2.2.43

Official TypeScript SDK for the Oblien Workspace API

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 99 file(s), 396 KB of source, external domains: api.oblien.com, cdn.oblien.com, oblien.com, workspace.oblien.com

Source & flagged code

1 flagged

dist/cli/commands/auth.jsView file

Lines 1-24javascript

1/**

2 * oblien auth - Browser-based login flow (like `gh auth login`).

3 *

4 * 1. Gets a session token from /auth/token

5 * 2. Creates an auth session via /auth/session → https://auth.oblien.com/{id}

6 * 3. Opens the URL in the user's browser (or prints it)

7 * 4. Polls GET /auth/session/{id}/poll until the user finishes login

8 * 5. Stores the original JWT in ~/.oblien/credentials.json

9 * (the same Redis session now has user_id bound — the JWT is authenticated)

10 */

11import { createInterface } from 'node:readline';

12import { exec } from 'node:child_process';

13import { saveConfig, loadConfig, clearConfig, configPath } from '../config-store.js';

14import { printSuccess, printError } from '../output.js';

15const DEFAULT_BASE = 'https://api.oblien.com';

16// ── Helpers ─────────────────────────────────────────────────────────

17async function api(base, path, opts = {}) {

18 const url = `${base}${path}`;

19 const headers = { 'Content-Type': 'application/json' };

20 if (opts.token)

21 headers['Authorization'] = `Bearer ${opts.token}`;

22 const res = await fetch(url, {

23 method: opts.method ?? 'POST',

24 headers,

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli/commands/auth.jsView on unpkg · L4

Source & flagged code

1 flagged · loading source

dist/cli/commands/auth.jsView file

4* 1. Gets a session token from /auth/token L5: * 2. Creates an auth session via /auth/session → https://auth.oblien.com/{id} L6: * 3. Opens the URL in the user's browser (or prints it) ... L11: import { createInterface } from 'node:readline'; L12: import { exec } from 'node:child_process'; L13: import { saveConfig, loadConfig, clearConfig, configPath } from '../config-store.js'; ... L24: headers, L25: body: opts.body ? JSON.stringify(opts.body) : undefined, L26: }); L27: return res.json(); L28: } L29: function openBrowser(url) {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli/commands/auth.jsView on unpkg · L4

Findings

1 High3 Medium5 Low

HighSandbox Evasion Gated Capabilitydist/cli/commands/auth.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

1 flagged

dist/cli/commands/auth.jsView file

Lines 1-24javascript

1/**

2 * oblien auth - Browser-based login flow (like `gh auth login`).

3 *

4 * 1. Gets a session token from /auth/token

5 * 2. Creates an auth session via /auth/session → https://auth.oblien.com/{id}

6 * 3. Opens the URL in the user's browser (or prints it)

7 * 4. Polls GET /auth/session/{id}/poll until the user finishes login

8 * 5. Stores the original JWT in ~/.oblien/credentials.json

9 * (the same Redis session now has user_id bound — the JWT is authenticated)

10 */

11import { createInterface } from 'node:readline';

12import { exec } from 'node:child_process';

13import { saveConfig, loadConfig, clearConfig, configPath } from '../config-store.js';

14import { printSuccess, printError } from '../output.js';

15const DEFAULT_BASE = 'https://api.oblien.com';

16// ── Helpers ─────────────────────────────────────────────────────────

17async function api(base, path, opts = {}) {

18 const url = `${base}${path}`;

19 const headers = { 'Content-Type': 'application/json' };

20 if (opts.token)

21 headers['Authorization'] = `Bearer ${opts.token}`;

22 const res = await fetch(url, {

23 method: opts.method ?? 'POST',

24 headers,

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli/commands/auth.jsView on unpkg · L4