registry / quecksilver-cli / 1.0.1

quecksilver-cli@1.0.1

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 8 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 4 file(s), 5.46 KB of source, external domains: pwdncixmwxedfhtiwpmt.supabase.co, quecksilver.ch

Source & flagged code

2 flagged

src/auth.jsView file

Lines 1-21javascript

1import http from 'http';

2import { exec } from 'child_process';

3import { saveToken } from './config.js';

5const PORT = 51234;

6const APP_URL = 'https://quecksilver.ch';

7const LOGIN_URL = `${APP_URL}/cli-auth?redirect=${encodeURIComponent(`http://localhost:${PORT}/callback`)}`;

9function openBrowser(url) {

10 const platform = process.platform;

11 const cmd =

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

src/auth.jsView on unpkg · L1

12 platform === 'win32' ? `start "" "${url}"` :

13 platform === 'darwin' ? `open "${url}"` :

14 `xdg-open "${url}"`;

15 exec(cmd, (err) => {

16 if (err) {

17 console.log('Could not open the browser automatically. Open this link manually:');

18 console.log(url);

19 }

20 });

21}

•matchType = previous_version_dangerous_delta matchedPackage = quecksilver-cli@1.0.0 matchedIdentity = npm:cXVlY2tzaWx2ZXItY2xp:1.0.0 similarity = 0.750 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/auth.jsView on unpkg

Source & flagged code

2 flagged · loading source

src/auth.jsView file

1import http from 'http'; L2: import { exec } from 'child_process'; L3: import { saveToken } from './config.js'; ... L9: function openBrowser(url) { L10: const platform = process.platform; L11: const cmd = ... L27: res.writeHead(404); L28: res.end(); L29: return;

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

src/auth.jsView on unpkg · L1

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/auth.jsView on unpkg

Findings

2 High2 Medium4 Low

HighSandbox Evasion Gated Capabilitysrc/auth.js

HighPrevious Version Dangerous Deltasrc/auth.js

MediumNetwork

MediumStructural Risk Force Deep Review

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License