registry / otterkit / 0.8.1

otterkit@0.8.1

OtterKit CLI — provision and connect tunnels for AI agents

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 16 file(s), 104 KB of source, external domains: api.otterkit.com, app.otterkit.com, otterkit.app, www.otterkit.com

Source & flagged code

4 flagged

dist/login.jsView file

Lines 1-30javascript

1/**

2 * `otterkit login` — browser device-authorization flow.

3 *

4 * 1. POST /api/device/start → prints a user code and opens the portal.

5 * 2. User signs in (Clerk) and approves the code in the portal.

6 * 3. CLI polls /api/device/poll until approved, then saves the token.

7 *

8 * Login/balance talk to the portal API (OTTERKIT_API_URL), distinct from

9 * tunnel provisioning which talks to OTTERKIT_TUNNEL_URL.

10 */

11import { spawn } from 'node:child_process';

12import { saveCredentials, clearCredentials, getToken, loadCredentials } from './credentials.js';

High

Child Process

Package source references child process execution.

dist/login.jsView on unpkg · L10

13const API_SERVER = process.env.OTTERKIT_API_URL || 'https://api.otterkit.com';

14/* ── ANSI helpers (kept local; mirrors index.ts) ── */

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/login.jsView on unpkg · L10

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/login.jsView on unpkg · L10

15const c = {

16 reset: '\x1b[0m',

17 bold: '\x1b[1m',

18 green: '\x1b[32m',

19 cyan: '\x1b[36m',

20 red: '\x1b[31m',

21 gray: '\x1b[90m',

22};

23const CHECK = `${c.green}✓${c.reset}`;

24const CROSS = `${c.red}✗${c.reset}`;

25const dim = (s) => `${c.gray}${s}${c.reset}`;

26async function api(path, body, token) {

27 const resp = await fetch(`${API_SERVER}${path}`, {

28 method: body ? 'POST' : 'GET',

29 headers: {

30 'Content-Type': 'application/json',

•matchType = previous_version_dangerous_delta matchedPackage = otterkit@0.3.0 matchedIdentity = npm:b3R0ZXJraXQ:0.3.0 similarity = 0.400 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/login.jsView on unpkg

Source & flagged code

4 flagged · loading source

dist/login.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code