registry / octo-cli / 0.8.3

octo-cli@0.8.3

Octopus Observability CLI — query logs, alerts, traces, metrics and more

Static Scan Results

scanned 6d ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 8 file(s), 68.5 KB of source, external domains: octopus-app.zhenguanyu.com

Source & flagged code

2 flagged

dist/index.jsView file

Lines 1-40javascript

1#!/usr/bin/env node

2import {

3 resolveTimeRange

4} from "./chunk-5DSKY2SA.js";

5import {

6 OctoClient

7} from "./chunk-HZGSZ2X7.js";

8import {

9 getBaseUrl,

10 getConfigPath,

11 getCredentials,

12 getDefaultEnv,

13 saveConfig,

14 saveToken

15} from "./chunk-MXT7XNJU.js";

17// src/index.ts

18import { Command } from "commander";

20// src/commands.ts

21import { execSync } from "child_process";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L20

23// src/output.ts

24function printOutput(data, format = "json") {

25 if (format === "json") {

26 console.log(JSON.stringify(data, null, 2));

27 return;

28 }

29 if (format === "jsonl") {

30 const items = Array.isArray(data) ? data : [data];

31 for (const item of items) {

32 console.log(JSON.stringify(item));

33 }

34 return;

35 }

36 if (Array.isArray(data) && data.length > 0) {

37 printTable(data);

38 } else if (data && typeof data === "object") {

39 printKV(data);

40 } else {

Lines 68-108javascript

68 const credentials = getCredentials();

69 return new OctoClient(getBaseUrl(), credentials);

70}

71function registerCommands(program2) {

72 program2.command("login").description("Configure Octopus API credentials").option("--token <token>",

Source & flagged code

2 flagged · loading source

dist/index.jsView file

20// src/commands.ts L21: import { execSync } from "child_process"; L22:

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L20

88try { L89: execSync( L90: "npx reskill@latest install github:kanyun-inc/octo-cli/skills -g -y -a claude-code cursor codex", L91: { stdio: "inherit" }

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L88

Findings

3 High3 Medium4 Low

HighChild Processdist/index.js

HighShell

HighRuntime Package Installdist/index.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

dist/index.jsView file

Lines 1-40javascript

1#!/usr/bin/env node

2import {

3 resolveTimeRange

4} from "./chunk-5DSKY2SA.js";

5import {

6 OctoClient

7} from "./chunk-HZGSZ2X7.js";

8import {

9 getBaseUrl,

10 getConfigPath,

11 getCredentials,

12 getDefaultEnv,

13 saveConfig,

14 saveToken

15} from "./chunk-MXT7XNJU.js";

17// src/index.ts

18import { Command } from "commander";

20// src/commands.ts

21import { execSync } from "child_process";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L20

23// src/output.ts

24function printOutput(data, format = "json") {

25 if (format === "json") {

26 console.log(JSON.stringify(data, null, 2));

27 return;

28 }

29 if (format === "jsonl") {

30 const items = Array.isArray(data) ? data : [data];

31 for (const item of items) {

32 console.log(JSON.stringify(item));

33 }

34 return;

35 }

36 if (Array.isArray(data) && data.length > 0) {

37 printTable(data);

38 } else if (data && typeof data === "object") {

39 printKV(data);

40 } else {

Lines 68-108javascript

68 const credentials = getCredentials();

69 return new OctoClient(getBaseUrl(), credentials);

70}

71function registerCommands(program2) {

72 program2.command("login").description("Configure Octopus API credentials").option("--token <token>",