onveloz@0.0.0-beta.48
⚠ Under reviewCLI da plataforma Veloz — deploy rápido para o Brasil
Static Scan Results
scanned 20d ago · by rust-scannerStatic analysis completed at 72.0% confidence. No malicious behavior was detected; 13 low-signal pattern(s) were surfaced and cleared.
Static reason
One or more suspicious static signals were detected.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
6 flaggeddist/config-DaQHTlyP.mjsView file
10import { createInterface } from "node:readline";
L11: import { exec } from "node:child_process";
L12: import ora from "ora";
High
Child Process
Package source references child process execution.
dist/config-DaQHTlyP.mjsView on unpkg · L1010import { createInterface } from "node:readline";
L11: import { exec } from "node:child_process";
L12: import ora from "ora";
...
L14: //#region src/lib/helpers.ts
L15: /** True when the CLI is running as an MCP server (stdout = JSON-RPC transport). */
L16: function isMcpMode() {
L17: return process.env.VELOZ_MCP === "true";
L18: }
...
L30: function log(message) {
L31: if (isMcpMode()) process.stderr.write(`${message}\n`);
L32: else process.stdout.write(`${message}\n`);
...
L34: function startGroup(name) {
Low
Weak Crypto
Package source references weak cryptographic algorithms.
dist/config-DaQHTlyP.mjsView on unpkg · L10dist/index.mjsView file
10275//#region src/lib/auto-update.ts
L10276: const execAsync = promisify(exec);
L10277: /** The npm registry's `/<package>/latest` document; only the version is read. */
Findings
5 High2 Medium6 Low
HighChild Processdist/config-DaQHTlyP.mjs
HighShelldist/index.mjs
HighCredential Redirect Persistencedist/index.mjs
HighCross File Remote Execution Contextdist/index.mjs
HighSemantic Analysis Limiteddist/deploy-stream-C3kNZaLQ.mjs#virtual:normalized:round1
MediumNetwork
MediumEnvironment Vars
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Cryptodist/config-DaQHTlyP.mjs
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to onveloz@0.0.0-beta.48.
See all versions of onveloz for other recorded verdicts.
- Review the evidence and your use of onveloz@0.0.0-beta.48 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.