registry / react-native-update-cli / 2.15.3

react-native-update-cli@2.15.3

command line tool for react-native-update (remote updates for react native)

Static Scan Results

scanned 4h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 88 file(s), 513 KB of source, external domains: api.cresc.app, api.cresc.dev, cresc.dev, github.com, pushy.reactnative.cn, update.react-native.cn, update.reactnative.cn

Source & flagged code

5 flagged

lib/user.jsView file

Lines 6-46javascript

6 enumerable: true,

7 get: function() {

8 return userCommands;

9 }

10});

11const _crypto = /*#__PURE__*/ _interop_require_default(require("crypto"));

12const _api = require("./api");

13const _utils = require("./utils");

14const _i18n = require("./utils/i18n");

15function _interop_require_default(obj) {

16 return obj && obj.__esModule ? obj : {

17 default: obj

18 };

19}

20function md5(str) {

21 return _crypto.default.createHash('md5').update(str).digest('hex');

22}

23const userCommands = {

24 login: async ({ args })=>{

25 const email = args[0] || await (0, _utils.question)('email:');

26 const pwd = args[1] || await (0, _utils.question)('password:', true);

Medium

Secret Pattern

Package contains a possible secret pattern.

lib/user.jsView on unpkg · L26

27 const { token, info } = await (0, _api.post)('/user/login', {

28 email,

29 pwd: md5(pwd)

30 });

31 (0, _api.replaceSession)({

32 token

33 });

34 await (0, _api.saveSession)();

35 console.log((0, _i18n.t)('welcomeMessage', {

36 name: info.name

37 }));

38 },

39 logout: async (_context)=>{

40 await (0, _api.closeSession)();

41 console.log((0, _i18n.t)('loggedOut'));

42 },

43 me: async ()=>{

44 const me = await (0, _api.get)('/user/me');

45 for(const k in me){

46 if (k !== 'ok') {

lib/utils/app-info-parser/ipa.jsView file

Lines 5-45javascript

5Object.defineProperty(exports, "IpaParser", {

6 enumerable: true,

7 get: function() {

8 return IpaParser;

9 }

10});

11const _utils = require("./utils");

12const _zip = require("./zip");

13const parseBplist = require('bplist-parser').parseBuffer;

14const cgbiToPng = require('cgbi-to-png');

15const PlistName = /payload\/[^/]+?.app\/info.plist$/i;

16const ProvisionName = /payload\/.+?\.app\/embedded.mobileprovision/;

17let parsePlistPromise;

18function loadParsePlist() {

19 if (!parsePlistPromise) {

20 parsePlistPromise = Promise.resolve().then(async ()=>{

21 try {

22 return require('plist').parse;

23 } catch (requireError) {

24 var _plistModule_parse;

25 var _plistModule_default;

26 const importModule = new Function('specifier', 'return import(specifier)');

27 const plistModule = await importModule('plist');

Low

Eval

Package source references a known benign dynamic code generation pattern.

lib/utils/app-info-parser/ipa.jsView on unpkg · L25

28 const parsePlist = (_plistModule_parse = plistModule.parse) != null ? _plistModule_parse : (_plistModule_default = plistModule.default) == null ? void 0 : _plistModule_default.parse;

29 if (!parsePlist) {

30 throw requireError;

31 }

32 return parsePlist;

33 }

34 });

35 }

36 return parsePlistPromise;

37}

38class IpaParser extends _zip.Zip {

39 async parse() {

40 const parsePlist = await loadParsePlist();

41 const buffers = await this.getEntries([

42 PlistName,

43 ProvisionName

44 ]);

45 if (!buffers[PlistName]) {

lib/bundle-runner.jsView file

Lines 22-62javascript

22 return prepareSentryUploadArtifacts;

23 },

24 get readSourcemapDebugId () {

25 return readSourcemapDebugId;

26 },

27 get resolveExpoCli () {

28 return resolveExpoCli;

29 },

30 get resolveHermesCommand () {

31 return resolveHermesCommand;

32 },

33 get resolveSentryUploadMode () {

34 return resolveSentryUploadMode;

35 },

36 get runReactNativeBundleCommand () {

37 return runReactNativeBundleCommand;

38 },

39 get uploadSourcemapForSentry () {

40 return uploadSourcemapForSentry;

41 }

42});

43const _child_process = require("child_process");

44const _compareversions = require("compare-versions");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

lib/bundle-runner.jsView on unpkg · L42

45const _fsextra = /*#__PURE__*/ _interop_require_wildcard(require("fs-extra"));

46const _os = /*#__PURE__*/ _interop_require_default(require("os"));

47const _path = /*#__PURE__*/ _interop_require_default(require("path"));

48const _i18n = require("./utils/i18n");

49const _runtime = require("./utils/runtime");

50function _interop_require_default(obj) {

51 return obj && obj.__esModule ? obj : {

52 default: obj

53 };

54}

55function _getRequireWildcardCache(nodeInterop) {

56 if (typeof WeakMap !== "function") return null;

57 var cacheBabelInterop = new WeakMap();

58 var cacheNodeInterop = new WeakMap();

59 return (_getRequireWildcardCache = function(nodeInterop) {

60 return nodeInterop ? cacheNodeInterop : cacheBabelInterop;

61 })(nodeInterop);

62}

src/user.tsView file

Lines 1-34typescript

1import crypto from 'crypto';

2import type { CommandContext } from 'types';

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/user.tsView on unpkg · L1

3import { closeSession, get, post, replaceSession, saveSession } from './api';

4import { question } from './utils';

5import { t } from './utils/i18n';

7function md5(str: string) {

8 return crypto.createHash('md5').update(str).digest('hex');

11export const userCommands = {

12 login: async ({ args }: { args: string[] }) => {

13 const email = args[0] || (await question('email:'));

14 const pwd = args[1] || (await question('password:', true));

Medium

Secret Pattern

Hardcoded password in src/user.ts

src/user.tsView on unpkg · L14

15 const { token, info } = await post('/user/login', {

16 email,

17 pwd: md5(pwd),

18 });

19 replaceSession({ token });

20 await saveSession();

21 console.log(t('welcomeMessage', { name: info.name }));

22 },

23 logout: async (_context: CommandContext) => {

24 await closeSession();

25 console.log(t('loggedOut'));

26 },

27 me: async () => {

28 const me = await get('/user/me');

29 for (const k in me) {

30 if (k !== 'ok') {

31 console.log(`${k}: ${me[k]}`);

32 }

33 }

34 },

Source & flagged code

5 flagged · loading source

lib/user.jsView file

26patternName = generic_password severity = medium line = 26 matchedText = const pw...ue);

Medium

Secret Pattern

Package contains a possible secret pattern.

lib/user.jsView on unpkg · L26

lib/utils/app-info-parser/ipa.jsView file

25var _plistModule_default; L26: const importModule = new Function('specifier', 'return import(specifier)'); L27: const plistModule = await importModule('plist');

Low

Eval

Package source references a known benign dynamic code generation pattern.

lib/utils/app-info-parser/ipa.jsView on unpkg · L25

lib/bundle-runner.jsView file

42}); L43: const _child_process = require("child_process"); L44: const _compareversions = require("compare-versions");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

lib/bundle-runner.jsView on unpkg · L42

src/user.tsView file

14patternName = generic_password severity = medium line = 14 matchedText = const pw...e));

Medium

Secret Pattern

Hardcoded password in src/user.ts

src/user.tsView on unpkg · L14

1import crypto from 'crypto'; L2: import type { CommandContext } from 'types';

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/user.tsView on unpkg · L1

Findings

6 Medium7 Low

MediumSecret Patternlib/user.js

MediumDynamic Requirelib/bundle-runner.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumSecret Patternsrc/user.ts

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvallib/utils/app-info-parser/ipa.js

LowWeak Cryptosrc/user.ts

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

5 flagged

lib/user.jsView file

Lines 6-46javascript

6 enumerable: true,

7 get: function() {

8 return userCommands;

9 }

10});

11const _crypto = /*#__PURE__*/ _interop_require_default(require("crypto"));

12const _api = require("./api");

13const _utils = require("./utils");

14const _i18n = require("./utils/i18n");

15function _interop_require_default(obj) {

16 return obj && obj.__esModule ? obj : {

17 default: obj

18 };

19}

20function md5(str) {

21 return _crypto.default.createHash('md5').update(str).digest('hex');

22}

23const userCommands = {

24 login: async ({ args })=>{

25 const email = args[0] || await (0, _utils.question)('email:');

26 const pwd = args[1] || await (0, _utils.question)('password:', true);

Medium

Secret Pattern

Package contains a possible secret pattern.

lib/user.jsView on unpkg · L26

27 const { token, info } = await (0, _api.post)('/user/login', {

28 email,

29 pwd: md5(pwd)

30 });

31 (0, _api.replaceSession)({

32 token

33 });

34 await (0, _api.saveSession)();

35 console.log((0, _i18n.t)('welcomeMessage', {

36 name: info.name

37 }));

38 },

39 logout: async (_context)=>{

40 await (0, _api.closeSession)();

41 console.log((0, _i18n.t)('loggedOut'));

42 },

43 me: async ()=>{

44 const me = await (0, _api.get)('/user/me');

45 for(const k in me){

46 if (k !== 'ok') {

lib/utils/app-info-parser/ipa.jsView file

Lines 5-45javascript

5Object.defineProperty(exports, "IpaParser", {

6 enumerable: true,

7 get: function() {

8 return IpaParser;

9 }

10});

11const _utils = require("./utils");

12const _zip = require("./zip");

13const parseBplist = require('bplist-parser').parseBuffer;

14const cgbiToPng = require('cgbi-to-png');

15const PlistName = /payload\/[^/]+?.app\/info.plist$/i;

16const ProvisionName = /payload\/.+?\.app\/embedded.mobileprovision/;

17let parsePlistPromise;

18function loadParsePlist() {

19 if (!parsePlistPromise) {

20 parsePlistPromise = Promise.resolve().then(async ()=>{

21 try {

22 return require('plist').parse;

23 } catch (requireError) {

24 var _plistModule_parse;

25 var _plistModule_default;

26 const importModule = new Function('specifier', 'return import(specifier)');

27 const plistModule = await importModule('plist');

Low

Eval

Package source references a known benign dynamic code generation pattern.

lib/utils/app-info-parser/ipa.jsView on unpkg · L25

28 const parsePlist = (_plistModule_parse = plistModule.parse) != null ? _plistModule_parse : (_plistModule_default = plistModule.default) == null ? void 0 : _plistModule_default.parse;

29 if (!parsePlist) {

30 throw requireError;

31 }

32 return parsePlist;

33 }

34 });

35 }

36 return parsePlistPromise;

37}

38class IpaParser extends _zip.Zip {

39 async parse() {

40 const parsePlist = await loadParsePlist();

41 const buffers = await this.getEntries([

42 PlistName,

43 ProvisionName

44 ]);

45 if (!buffers[PlistName]) {

lib/bundle-runner.jsView file

Lines 22-62javascript

22 return prepareSentryUploadArtifacts;

23 },

24 get readSourcemapDebugId () {

25 return readSourcemapDebugId;

26 },

27 get resolveExpoCli () {

28 return resolveExpoCli;

29 },

30 get resolveHermesCommand () {

31 return resolveHermesCommand;

32 },

33 get resolveSentryUploadMode () {

34 return resolveSentryUploadMode;

35 },

36 get runReactNativeBundleCommand () {

37 return runReactNativeBundleCommand;

38 },

39 get uploadSourcemapForSentry () {

40 return uploadSourcemapForSentry;

41 }

42});

43const _child_process = require("child_process");

44const _compareversions = require("compare-versions");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

lib/bundle-runner.jsView on unpkg · L42

45const _fsextra = /*#__PURE__*/ _interop_require_wildcard(require("fs-extra"));

46const _os = /*#__PURE__*/ _interop_require_default(require("os"));

47const _path = /*#__PURE__*/ _interop_require_default(require("path"));

48const _i18n = require("./utils/i18n");

49const _runtime = require("./utils/runtime");

50function _interop_require_default(obj) {

51 return obj && obj.__esModule ? obj : {

52 default: obj

53 };

54}

55function _getRequireWildcardCache(nodeInterop) {

56 if (typeof WeakMap !== "function") return null;

57 var cacheBabelInterop = new WeakMap();

58 var cacheNodeInterop = new WeakMap();

59 return (_getRequireWildcardCache = function(nodeInterop) {

60 return nodeInterop ? cacheNodeInterop : cacheBabelInterop;

61 })(nodeInterop);

62}

src/user.tsView file

Lines 1-34typescript

1import crypto from 'crypto';

2import type { CommandContext } from 'types';

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/user.tsView on unpkg · L1

3import { closeSession, get, post, replaceSession, saveSession } from './api';

4import { question } from './utils';

5import { t } from './utils/i18n';

7function md5(str: string) {

8 return crypto.createHash('md5').update(str).digest('hex');

11export const userCommands = {

12 login: async ({ args }: { args: string[] }) => {

13 const email = args[0] || (await question('email:'));

14 const pwd = args[1] || (await question('password:', true));

Medium

Secret Pattern

Hardcoded password in src/user.ts

src/user.tsView on unpkg · L14

15 const { token, info } = await post('/user/login', {

16 email,

17 pwd: md5(pwd),

18 });

19 replaceSession({ token });

20 await saveSession();

21 console.log(t('welcomeMessage', { name: info.name }));

22 },

23 logout: async (_context: CommandContext) => {

24 await closeSession();

25 console.log(t('loggedOut'));

26 },

27 me: async () => {

28 const me = await get('/user/me');

29 for (const k in me) {

30 if (k !== 'ok') {

31 console.log(`${k}: ${me[k]}`);

32 }

33 }

34 },