registry / quecksilver-cli / 1.7.9

quecksilver-cli@1.7.9

Static Scan Results

scanned 17h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

Manifest

NoLicense

scanned 8 file(s), 246 KB of source, external domains: pwdncixmwxedfhtiwpmt.supabase.co, quecksilver.ch, registry.npmjs.org

Source & flagged code

3 flagged

package.jsonView file

Lines 1-15json

2 "name": "quecksilver-cli",

3 "version": "1.7.9",

4 "bin": {

5 "quecksilver": "bin/cli.js"

6 },

7 "scripts": {

8 "postinstall": "node bin/postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L8

9 },

10 "type": "module",

11 "engines": {

12 "node": ">=18"

13 }

14}

src/index.jsView file

Lines 1-40javascript

1import readline from 'readline';

2import { readFileSync, existsSync, statSync, mkdirSync, writeFileSync } from 'fs';

3import { fileURLToPath } from 'url';

4import { dirname, join, extname, basename } from 'path';

Source & flagged code

3 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

src/index.jsView file

20patternName = supabase_service_key severity = critical line = 20 matchedText = const SU...9o';

Critical

Critical Secret

Package contains a critical-looking secret pattern.

src/index.jsView on unpkg · L20

20patternName = supabase_service_key severity = critical line = 20 matchedText = const SU...9o';

Critical

Secret Pattern

Supabase service role key (JWT) in src/index.js

src/index.jsView on unpkg · L20

Findings

2 Critical1 High2 Medium6 Low

CriticalCritical Secretsrc/index.js

CriticalSecret Patternsrc/index.js

HighInstall Time Lifecycle Scriptspackage.json

MediumNetwork

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

LowNo License