registry / quecksilver-cli / 1.0.5

quecksilver-cli@1.0.5

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 6 file(s), 12.6 KB of source, external domains: pwdncixmwxedfhtiwpmt.supabase.co, quecksilver.ch

Source & flagged code

5 flagged

package.jsonView file

Lines 1-15json

2 "name": "quecksilver-cli",

3 "version": "1.0.5",

4 "bin": {

5 "quecksilver": "bin/cli.js"

6 },

7 "scripts": {

8 "postinstall": "node bin/postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L8

9 },

10 "type": "module",

11 "engines": {

12 "node": ">=18"

13 }

14}

src/index.jsView file

Lines 1-33javascript

1import readline from 'readline';

2import { readFileSync } from 'fs';

3import { fileURLToPath } from 'url';

4import { dirname, join } from 'path';

src/auth.jsView file

Lines 1-21javascript

1import http from 'http';

2import { exec } from 'child_process';

3import { saveToken } from './config.js';

5const PORT =

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

src/index.jsView file

13patternName = supabase_service_key severity = critical line = 13 matchedText = const SU...9o';

Critical

Critical Secret

Package contains a critical-looking secret pattern.

src/index.jsView on unpkg · L13

13patternName = supabase_service_key severity = critical line = 13 matchedText = const SU...9o';

Critical

Secret Pattern

Supabase service role key (JWT) in src/index.js

src/index.jsView on unpkg · L13

src/auth.js

Findings

2 Critical3 High2 Medium5 Low

CriticalCritical Secretsrc/index.js

CriticalSecret Patternsrc/index.js

HighInstall Time Lifecycle Scriptspackage.json

HighSandbox Evasion Gated Capabilitysrc/auth.js

HighPrevious Version Dangerous Deltasrc/auth.js

MediumNetwork

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License