onveloz@0.0.0-beta.45
⚠ Under reviewCLI da plataforma Veloz — deploy rápido para o Brasil
Static Scan Results
scanned 1mo ago · by rust-scannerStatic analysis completed at 72.0% confidence. No malicious behavior was detected; 13 low-signal pattern(s) were surfaced and cleared.
Static reason
One or more suspicious static signals were detected.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
6 flaggeddist/deploy-stream-BPe1wrzQ.mjsView file
8import chalk from "chalk";
L9: import { execSync } from "node:child_process";
L10:
High
Child Process
Package source references child process execution.
dist/deploy-stream-BPe1wrzQ.mjsView on unpkg · L8dist/index.mjsView file
9920//#region src/lib/auto-update.ts
L9921: const execAsync = promisify(exec);
L9922: const PACKAGE_NAME = "onveloz";
High
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/index.mjs:
import { appendFileSync, constants, createReadStream, createWriteStream, existsSync, mkdirSync, readFileSync, readdirSync, realpathSync, statSync, unlinkSync, writeFileSync } from ...
import * as readline from "node:readline";
import { chmod, copyFile, lstat, mkdir, mkdtemp, open, readFile, readdir, realpath, rm, stat, writeFile } from "node:fs/promises";
".claude",
yield* io(() => writeFile(destination, file.content, {
"Treat credentials, API keys, and environment variables as secrets and never expose them unnecessarily.",
writeFileSync(CACHE_FILE, JSON.stringify(cache, null, 2), "utf-8");
writeFileSync(STATE_FILE, JSO
Findings
5 High2 Medium6 Low
HighChild Processdist/deploy-stream-BPe1wrzQ.mjs
HighShelldist/index.mjs
HighCredential Redirect Persistencedist/index.mjs
HighCross File Remote Execution Contextdist/index.mjs
HighSemantic Analysis Limiteddist/deploy-stream-BPe1wrzQ.mjs#virtual:normalized:round1
MediumNetwork
MediumEnvironment Vars
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Cryptodist/config-CPTQd4xp.mjs
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to onveloz@0.0.0-beta.45.
See all versions of onveloz for other recorded verdicts.
- Review the evidence and your use of onveloz@0.0.0-beta.45 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.