onveloz@0.0.0-beta.53
⚠ Under reviewCLI da plataforma Veloz — deploy rápido para o Brasil
Static Scan Results
scanned 8d ago · by rust-scannerStatic analysis completed at 72.0% confidence. No malicious behavior was detected; 13 low-signal pattern(s) were surfaced and cleared.
Static reason
One or more suspicious static signals were detected.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
6 flaggeddist/config-D-XV6erZ.mjsView file
10import { createInterface } from "node:readline";
L11: import { exec } from "node:child_process";
L12: import { Writable } from "node:stream";
High
Child Process
Package source references child process execution.
dist/config-D-XV6erZ.mjsView on unpkg · L1010import { createInterface } from "node:readline";
L11: import { exec } from "node:child_process";
L12: import { Writable } from "node:stream";
...
L15: //#region src/lib/helpers.ts
L16: /** True when the CLI is running as an MCP server (stdout = JSON-RPC transport). */
L17: function isMcpMode() {
L18: return process.env.VELOZ_MCP === "true";
L19: }
...
L31: function log(message) {
L32: if (isMcpMode()) process.stderr.write(`${message}\n`);
L33: else process.stdout.write(`${message}\n`);
...
L35: function startGroup(name) {
Low
Weak Crypto
Package source references weak cryptographic algorithms.
dist/config-D-XV6erZ.mjsView on unpkg · L10dist/index.mjsView file
14029//#region src/lib/auto-update.ts
L14030: const execAsync = promisify(exec);
L14031: /** The npm registry's `/<package>/latest` document; only the version is read. */
Findings
5 High2 Medium6 Low
HighChild Processdist/config-D-XV6erZ.mjs
HighShelldist/index.mjs
HighCredential Redirect Persistencedist/index.mjs
HighCross File Remote Execution Contextdist/index.mjs
HighSemantic Analysis Limiteddist/deploy-stream-CTVlVo3B.mjs#virtual:normalized:round1
MediumNetwork
MediumEnvironment Vars
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Cryptodist/config-D-XV6erZ.mjs
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to onveloz@0.0.0-beta.53.
See all versions of onveloz for other recorded verdicts.
- Review the evidence and your use of onveloz@0.0.0-beta.53 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.