registry / rekor-cli / 0.1.123

rekor-cli@0.1.123

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNativeBindingsNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 1 file(s), 194 KB of source, external domains: 127.0.0.1, api.rekor.pro, api.workos.com, engaging-tip-62.authkit.app, mcp.rekor.pro, raw.githubusercontent.com

Source & flagged code

3 flagged

dist/index.jsView file

Lines 3248-3334javascript

3248 console.log(`Accepted. Report ${data.report.report_id} \u2192 ${data.report.status}.`);

3249 } catch (err) {

3250 reportActionError(err);

3251 }

3252});

3253reportCommand.command("contest <report_id>").description("Contest a shipped fix or a dismissal (\u2192 back to triage)").requiredOption("--reason <text>", "Why the fix/dismissal is wrong").action(async function(reportId, opts) {

3254 const client = new ApiClient();

3255 try {

3256 const data = await client.request(

3257 "POST",

3258 `/v1/reports/${encodeURIComponent(reportId)}/contest`,

3259 { reason: opts.reason }

3260 );

3261 console.log(`Contested. Report ${data.report.report_id} \u2192 ${data.report.status} (back to triage).`);

3262 } catch (err) {

3263 reportActionError(err);

3264 }

3265});

3266

3267// src/commands/update.ts

3268import { Command as Command25 } from "commander";

3269import { execSync } from "child_process";

3270

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L3268

3271// src/version-cache.ts

3272import { readFileSync as readFileSync13, writeFileSync as writeFileSync6, mkdirSync as mkdirSync4 } from "fs";

3273import { join as join8 } from "path";

3274var NPM_PACKAGE = "rekor-cli";

3275var NPM_VIEW_VERSION_CMD = `npm view ${NPM_PACKAGE} version`;

3276var CLI_CACHE_FILE = "update-check.json";

3277var SKILL_CACHE_FILE = "skill-update-check.json";

3278var MAX_AGE_MS = 6 * 60 * 60 * 1e3;

3279function isUpdateCheckDisabled() {

3280 return Boolean(

3281 process.env["NO_UPDATE_NOTIFIER"] || process.env["REKOR_NO_UPDATE_CHECK"] || isCI()

3282 );

3283}

3284function readCache(filename) {

3285 try {

3286 const parsed = JSON.parse(readFileSync13(join8(CONFIG_DIR, filename), "utf-8"));

3287 if (typeof parsed.lastCheck !== "number") return null;

3288 if (parsed.latest !== null && typeof parsed.latest !== "string") return null;

3294function writeCache(filename, cache) {

3295 try {

3296 mkdirSync4(CONFIG_DIR, { recursive: true });

3297 writeFileSync6(join8(CONFIG_DIR, filename), JSON.stringify(cache));

3298 } catch {

3299 }

3300}

3301function isCacheStale(filename) {

3302 const cache = readCache(filename);

3303 return !cache || Date.now() - cache.lastCheck >= MAX_AGE_MS;

3304}

3305function touchCache(filename) {

3306 writeCache(filename, { lastCheck: Date.now(), latest: readCache(filename)?.latest ?? null });

3307}

3308

3309// src/commands/update.ts

3310var updateCommand = new Command25("update").description("Update the Rekor CLI to the latest published version").action(() => {

3311 console.log(`Current version: ${package_default.version}`);

3312 console.log("Checking for updates...");

3313 let latest;

3314 try {

3315 latest = execSync(NPM_VIEW_VERSION_CMD, { timeout: 1e4 }).toString().trim();

3316 } catch {

3317 console.error(`Could not reach npm to check for updates.`);

3318 console.error(`Try manually: npm install -g ${NPM_PACKAGE}`);

3319 process.exit(1);

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L3314

3320 }

3321 if (!isNewerVersion(latest, package_default.version)) {

3322 console.log(`Already on the latest version (${package_default.version}).`);

3323 return;

3324 }

3325 console.log(`Updating ${package_default.version} \u2192 ${latest}...`);

3326 try {

3327 execSync(`npm install -g ${NPM_PACKAGE}@latest`, {

3328 timeout: 12e4,

3329 stdio: "inherit"

3330 });

3331 console.log(`Updated to ${latest}.`);

3332 } catch (err) {

3333 console.error(`Update failed: ${err instanceof Error ? err.message : String(err)}`);

3334 console.error(`Try manually: npm install -g ${NPM_PACKAGE}`);

Lines 4224-4264javascript

4224program.addCommand(providersCommand);

4225program.addCommand(tokensCommand);

4226program.addCommand(secretsCommand);

4227program.addCommand(toolsetsCommand);

4228program.addCommand(actionsCommand);

4229program.addCommand(seedCommand);

4230program.addCommand(templateCommand);

4231program.addCommand(adminCommand);

4232program.addCommand

Source & flagged code

3 flagged · loading source

dist/index.jsView file

3268import { Command as Command25 } from "commander"; L3269: import { execSync } from "child_process"; L3270:

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L3268

4244if (opts.skill) touchCache(SKILL_CACHE_FILE); L4245: spawn(process.execPath, [entryPath, REFRESH_COMMAND], { L4246: detached: true, ... L4250: env: { L4251: ...process.env, L4252: [ENV_REFRESH_CLI]: opts.cli ? "1" : "", ... L4259: function refreshCliCache() { L4260: return new Promise((resolve4) => { L4261: exec(NPM_VIEW_VERSION_CMD, { timeout: REFRESH_TIMEOUT_MS }, (err, stdout) => {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L4244

3314try { L3315: latest = execSync(NPM_VIEW_VERSION_CMD, { timeout: 1e4 }).toString().trim(); L3316: } catch { L3317: console.error(`Could not reach npm to check for updates.`); L3318: console.error(`Try manually: npm install -g ${NPM_PACKAGE}`); L3319: process.exit(1);

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L3314

Findings

4 High3 Medium5 Low

HighChild Processdist/index.js

HighShell

HighSame File Env Network Executiondist/index.js

HighRuntime Package Installdist/index.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

3 flagged

dist/index.jsView file

Lines 3248-3334javascript

3248 console.log(`Accepted. Report ${data.report.report_id} \u2192 ${data.report.status}.`);

3249 } catch (err) {

3250 reportActionError(err);

3251 }

3252});

3254 const client = new ApiClient();

3255 try {

3256 const data = await client.request(

3257 "POST",

3258 `/v1/reports/${encodeURIComponent(reportId)}/contest`,

3259 { reason: opts.reason }

3260 );

3261 console.log(`Contested. Report ${data.report.report_id} \u2192 ${data.report.status} (back to triage).`);

3262 } catch (err) {

3263 reportActionError(err);

3264 }

3265});

3266

3267// src/commands/update.ts

3268import { Command as Command25 } from "commander";

3269import { execSync } from "child_process";

3270

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L3268

3271// src/version-cache.ts

3272import { readFileSync as readFileSync13, writeFileSync as writeFileSync6, mkdirSync as mkdirSync4 } from "fs";

3273import { join as join8 } from "path";

3274var NPM_PACKAGE = "rekor-cli";

3275var NPM_VIEW_VERSION_CMD = `npm view ${NPM_PACKAGE} version`;

3276var CLI_CACHE_FILE = "update-check.json";

3277var SKILL_CACHE_FILE = "skill-update-check.json";

3278var MAX_AGE_MS = 6 * 60 * 60 * 1e3;

3279function isUpdateCheckDisabled() {

3280 return Boolean(

3281 process.env["NO_UPDATE_NOTIFIER"] || process.env["REKOR_NO_UPDATE_CHECK"] || isCI()

3282 );

3283}

3284function readCache(filename) {

3285 try {

3286 const parsed = JSON.parse(readFileSync13(join8(CONFIG_DIR, filename), "utf-8"));

3287 if (typeof parsed.lastCheck !== "number") return null;

3288 if (parsed.latest !== null && typeof parsed.latest !== "string") return null;

3294function writeCache(filename, cache) {

3295 try {

3296 mkdirSync4(CONFIG_DIR, { recursive: true });

3297 writeFileSync6(join8(CONFIG_DIR, filename), JSON.stringify(cache));

3298 } catch {

3299 }

3300}

3301function isCacheStale(filename) {

3302 const cache = readCache(filename);

3303 return !cache || Date.now() - cache.lastCheck >= MAX_AGE_MS;

3304}

3305function touchCache(filename) {

3306 writeCache(filename, { lastCheck: Date.now(), latest: readCache(filename)?.latest ?? null });

3307}

3308

3309// src/commands/update.ts

3310var updateCommand = new Command25("update").description("Update the Rekor CLI to the latest published version").action(() => {

3311 console.log(`Current version: ${package_default.version}`);

3312 console.log("Checking for updates...");

3313 let latest;

3314 try {

3315 latest = execSync(NPM_VIEW_VERSION_CMD, { timeout: 1e4 }).toString().trim();

3316 } catch {

3317 console.error(`Could not reach npm to check for updates.`);

3318 console.error(`Try manually: npm install -g ${NPM_PACKAGE}`);

3319 process.exit(1);

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L3314

3320 }

3321 if (!isNewerVersion(latest, package_default.version)) {

3322 console.log(`Already on the latest version (${package_default.version}).`);

3323 return;

3324 }

3325 console.log(`Updating ${package_default.version} \u2192 ${latest}...`);

3326 try {

3327 execSync(`npm install -g ${NPM_PACKAGE}@latest`, {

3328 timeout: 12e4,

3329 stdio: "inherit"

3330 });

3331 console.log(`Updated to ${latest}.`);

3332 } catch (err) {

3333 console.error(`Update failed: ${err instanceof Error ? err.message : String(err)}`);

3334 console.error(`Try manually: npm install -g ${NPM_PACKAGE}`);

Lines 4224-4264javascript

4224program.addCommand(providersCommand);

4225program.addCommand(tokensCommand);

4226program.addCommand(secretsCommand);

4227program.addCommand(toolsetsCommand);

4228program.addCommand(actionsCommand);

4229program.addCommand(seedCommand);

4230program.addCommand(templateCommand);

4231program.addCommand(adminCommand);

4232program.addCommand