registry / rekor-cli / 0.1.101

rekor-cli@0.1.101

Static Scan Results

scanned 1d ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNativeBindingsNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 1 file(s), 171 KB of source, external domains: 127.0.0.1, api.rekor.pro, api.workos.com, engaging-tip-62.authkit.app, mcp.rekor.pro, raw.githubusercontent.com

Source & flagged code

4 flagged

dist/index.jsView file

Lines 2777-2817javascript

2777 console.log(`Accepted. Report ${data.report.report_id} \u2192 ${data.report.status}.`);

2778 } catch (err) {

2779 reportActionError(err);

2780 }

2781});

2782reportCommand.command("contest <report_id>").description("Contest a shipped fix or a dismissal (\u2192 back to triage)").requiredOption("--reason <text>", "Why the fix/dismissal is wrong").action(async function(reportId, opts) {

2783 const client = new ApiClient();

2784 try {

2785 const data = await client.request(

2786 "POST",

2787 `/v1/reports/${encodeURIComponent(reportId)}/contest`,

2788 { reason: opts.reason }

2789 );

2790 console.log(`Contested. Report ${data.report.report_id} \u2192 ${data.report.status} (back to triage).`);

2791 } catch (err) {

2792 reportActionError(err);

2793 }

2794});

2795

2796// src/commands/update.ts

2797import { Command as Command22 } from "commander";

2798import { execFileSync } from "child_process";

2799

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L2797

2800// src/version-cache.ts

2801import { readFileSync as readFileSync12, writeFileSync as writeFileSync5, mkdirSync as mkdirSync4 } from "fs";

2802import { join as join8 } from "path";

2803var NPM_PACKAGE = "rekor-cli";

2804var CLI_CACHE_FILE = "update-check.json";

2805var SKILL_CACHE_FILE = "skill-update-check.json";

2806var MAX_AGE_MS = 6 * 60 * 60 * 1e3;

2807function isUpdateCheckDisabled() {

2808 return Boolean(

2809 process.env["NO_UPDATE_NOTIFIER"] || process.env["REKOR_NO_UPDATE_CHECK"] || isCI()

2810 );

2811}

2812function readCache(filename) {

2813 try {

2814 const parsed = JSON.parse(readFileSync12(join8(CONFIG_DIR, filename), "utf-8"));

2815 if (typeof parsed.lastCheck !== "number") return null;

2816 if (parsed.latest !== null && typeof parsed.latest !== "string") return null;

2817 return parsed;

Lines 2861-2901javascript

2861 commander: "^14.0.0",

2862 open: "^11.0.0",

2863 yaml: "^2.9.0"

2864 },

2865 optionalDependencies: {

2866 "@sentry/node": "^10.59.0"

2867 },

2868 devDependencies: {

2869 "@types/node"

Lines 3740-3780javascript

3740program.addCommand(batchCommand);

3741program.addCommand(providersCommand);

3742program.addCommand(tokensCommand);

3743program.addCommand(secretsCommand);

3744program.addCommand(toolsetsCommand);

3745program.addCommand(toolsCommand);

3746program.addCommand(templateCommand);

3747program.addCommand(adminCommand);

3748program.addCommand

Source & flagged code

4 flagged · loading source

dist/index.jsView file

2797import { Command as Command22 } from "commander"; L2798: import { execFileSync } from "child_process"; L2799:

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L2797

2881try { L2882: latest = execFileSync("npm", ["view", NPM_PACKAGE, "version"], { timeout: 1e4, shell: true }).toString().trim(); L2883: } catch {

High

Shell

Package source references shell execution.

dist/index.jsView on unpkg · L2881

3760if (opts.skill) touchCache(SKILL_CACHE_FILE); L3761: spawn(process.execPath, [entryPath, REFRESH_COMMAND], { L3762: detached: true, ... L3766: env: { L3767: ...process.env, L3768: [ENV_REFRESH_CLI]: opts.cli ? "1" : "", ... L3775: function refreshCliCache() { L3776: return new Promise((resolve4) => { L3777: execFile(

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L3760

2881try { L2882: latest = execFileSync("npm", ["view", NPM_PACKAGE, "version"], { timeout: 1e4, shell: true }).toString().trim(); L2883: } catch { L2884: console.error(`Could not reach npm to check for updates.`); L2885: console.error(`Try manually: npm install -g ${NPM_PACKAGE}`); L2886: process.exit(1);

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L2881

Findings

4 High3 Medium5 Low

HighChild Processdist/index.js

HighShelldist/index.js

HighSame File Env Network Executiondist/index.js

HighRuntime Package Installdist/index.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

4 flagged

dist/index.jsView file

Lines 2777-2817javascript

2777 console.log(`Accepted. Report ${data.report.report_id} \u2192 ${data.report.status}.`);

2778 } catch (err) {

2779 reportActionError(err);

2780 }

2781});

2783 const client = new ApiClient();

2784 try {

2785 const data = await client.request(

2786 "POST",

2787 `/v1/reports/${encodeURIComponent(reportId)}/contest`,

2788 { reason: opts.reason }

2789 );

2790 console.log(`Contested. Report ${data.report.report_id} \u2192 ${data.report.status} (back to triage).`);

2791 } catch (err) {

2792 reportActionError(err);

2793 }

2794});

2795

2796// src/commands/update.ts

2797import { Command as Command22 } from "commander";

2798import { execFileSync } from "child_process";

2799

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L2797

2800// src/version-cache.ts

2801import { readFileSync as readFileSync12, writeFileSync as writeFileSync5, mkdirSync as mkdirSync4 } from "fs";

2802import { join as join8 } from "path";

2803var NPM_PACKAGE = "rekor-cli";

2804var CLI_CACHE_FILE = "update-check.json";

2805var SKILL_CACHE_FILE = "skill-update-check.json";

2806var MAX_AGE_MS = 6 * 60 * 60 * 1e3;

2807function isUpdateCheckDisabled() {

2808 return Boolean(

2809 process.env["NO_UPDATE_NOTIFIER"] || process.env["REKOR_NO_UPDATE_CHECK"] || isCI()

2810 );

2811}

2812function readCache(filename) {

2813 try {

2814 const parsed = JSON.parse(readFileSync12(join8(CONFIG_DIR, filename), "utf-8"));

2815 if (typeof parsed.lastCheck !== "number") return null;

2816 if (parsed.latest !== null && typeof parsed.latest !== "string") return null;

2817 return parsed;

Lines 2861-2901javascript

2861 commander: "^14.0.0",

2862 open: "^11.0.0",

2863 yaml: "^2.9.0"

2864 },

2865 optionalDependencies: {

2866 "@sentry/node": "^10.59.0"

2867 },

2868 devDependencies: {

2869 "@types/node"

Lines 3740-3780javascript

3740program.addCommand(batchCommand);

3741program.addCommand(providersCommand);

3742program.addCommand(tokensCommand);

3743program.addCommand(secretsCommand);

3744program.addCommand(toolsetsCommand);

3745program.addCommand(toolsCommand);

3746program.addCommand(templateCommand);

3747program.addCommand(adminCommand);

3748program.addCommand