registry / octo-cli / 0.10.0

octo-cli@0.10.0

⚠ Under review

Octopus Observability CLI — query logs, alerts, traces, metrics and more

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 8 file(s), 96.5 KB of source, external domains: octopus-app.zhenguanyu.com

Source & flagged code

3 flagged

dist/index.jsView file

Lines 1-40javascript

1#!/usr/bin/env node

2import {

3 resolveTimeRange

4} from "./chunk-5DSKY2SA.js";

5import {

6 OctoClient

7} from "./chunk-OGYJWGOF.js";

8import {

9 getBaseUrl,

10 getConfigPath,

11 getCredentials,

12 getDefaultEnv,

13 saveConfig,

14 saveToken

15} from "./chunk-MXT7XNJU.js";

17// src/index.ts

18import { Command } from "commander";

20// src/commands.ts

21import { execSync } from "child_process";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L20

23// src/output.ts

24function printOutput(data, format = "json") {

25 if (format === "json") {

26 console.log(JSON.stringify(data, null, 2));

27 return;

28 }

29 if (format === "jsonl") {

30 const items = Array.isArray(data) ? data : [data];

31 for (const item of items) {

32 console.log(JSON.stringify(item));

33 }

34 return;

35 }

36 if (Array.isArray(data) && data.length > 0) {

37 printTable(data);

38 } else if (data && typeof data === "object") {

39 printKV(data);

40 } else {

Lines 183-223javascript

183 const credentials = getCredentials();

184 return new OctoClient(getBaseUrl(), credentials);

185}

186function registerCommands(program2) {

187 program2.command("login").description("Configure Octopus API credentials").option("--token <token>"

•matchType = previous_version_dangerous_delta matchedPackage = octo-cli@0.8.3 matchedIdentity = npm:b2N0by1jbGk:0.8.3 similarity = 0.625 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg

Source & flagged code

3 flagged · loading source

dist/index.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg

20// src/commands.ts L21: import { execSync } from "child_process"; L22:

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L20

203try { L204: execSync( L205: "npx reskill@latest install github:kanyun-inc/octo-cli/skills -g -y -a claude-code cursor codex", L206: { stdio: "inherit" }

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L203

Findings

1 Critical3 High3 Medium4 Low

CriticalPrevious Version Dangerous Deltadist/index.js

HighChild Processdist/index.js

HighShell

HighRuntime Package Installdist/index.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

dist/index.jsView file

Lines 1-40javascript

1#!/usr/bin/env node

2import {

3 resolveTimeRange

4} from "./chunk-5DSKY2SA.js";

5import {

6 OctoClient

7} from "./chunk-OGYJWGOF.js";

8import {

9 getBaseUrl,

10 getConfigPath,

11 getCredentials,

12 getDefaultEnv,

13 saveConfig,

14 saveToken

15} from "./chunk-MXT7XNJU.js";

17// src/index.ts

18import { Command } from "commander";

20// src/commands.ts

21import { execSync } from "child_process";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L20

23// src/output.ts

24function printOutput(data, format = "json") {

25 if (format === "json") {

26 console.log(JSON.stringify(data, null, 2));

27 return;

28 }

29 if (format === "jsonl") {

30 const items = Array.isArray(data) ? data : [data];

31 for (const item of items) {

32 console.log(JSON.stringify(item));

33 }

34 return;

35 }

36 if (Array.isArray(data) && data.length > 0) {

37 printTable(data);

38 } else if (data && typeof data === "object") {

39 printKV(data);

40 } else {

Lines 183-223javascript

183 const credentials = getCredentials();

184 return new OctoClient(getBaseUrl(), credentials);

185}

186function registerCommands(program2) {

187 program2.command("login").description("Configure Octopus API credentials").option("--token <token>"

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg