registry / rekor-cli / 0.1.96

rekor-cli@0.1.96

Static Scan Results

scanned 3d ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNativeBindingsNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 1 file(s), 167 KB of source, external domains: 127.0.0.1, api.rekor.pro, api.workos.com, engaging-tip-62.authkit.app, mcp.rekor.pro, raw.githubusercontent.com

Source & flagged code

4 flagged

dist/index.jsView file

Lines 2730-2770javascript

2730 console.log(`Accepted. Report ${data.report.report_id} \u2192 ${data.report.status}.`);

2731 } catch (err) {

2732 reportActionError(err);

2733 }

2734});

2735reportCommand.command("contest <report_id>").description("Contest a shipped fix or a dismissal (\u2192 back to triage)").requiredOption("--reason <text>", "Why the fix/dismissal is wrong").action(async function(reportId, opts) {

2736 const client = new ApiClient();

2737 try {

2738 const data = await client.request(

2739 "POST",

2740 `/v1/reports/${encodeURIComponent(reportId)}/contest`,

2741 { reason: opts.reason }

2742 );

2743 console.log(`Contested. Report ${data.report.report_id} \u2192 ${data.report.status} (back to triage).`);

2744 } catch (err) {

2745 reportActionError(err);

2746 }

2747});

2748

2749// src/commands/update.ts

2750import { Command as Command21 } from "commander";

2751import { execFileSync } from "child_process";

2752

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L2750

2753// src/version-cache.ts

2754import { readFileSync as readFileSync12, writeFileSync as writeFileSync5, mkdirSync as mkdirSync4 } from "fs";

2755import { join as join8 } from "path";

2756var NPM_PACKAGE = "rekor-cli";

2757var CLI_CACHE_FILE = "update-check.json";

2758var SKILL_CACHE_FILE = "skill-update-check.json";

2759var MAX_AGE_MS = 6 * 60 * 60 * 1e3;

2760function isUpdateCheckDisabled() {

2761 return Boolean(

2762 process.env["NO_UPDATE_NOTIFIER"] || process.env["REKOR_NO_UPDATE_CHECK"] || isCI()

2763 );

2764}

2765function readCache(filename) {

2766 try {

2767 const parsed = JSON.parse(readFileSync12(join8(CONFIG_DIR, filename), "utf-8"));

2768 if (typeof parsed.lastCheck !== "number") return null;

2769 if (parsed.latest !== null && typeof parsed.latest !== "string") return null;

2770 return parsed;

Lines 2814-2854javascript

2814 commander: "^14.0.0",

2815 open: "^11.0.0",

2816 yaml: "^2.9.0"

2817 },

2818 optionalDependencies: {

2819 "@sentry/node": "^10.59.0"

2820 },

2821 devDependencies: {

2822 "@types/node"

Lines 3657-3697javascript

3657program.addCommand(triggersCommand);

3658program.addCommand(batchCommand);

3659program.addCommand(providersCommand);

3660program.addCommand(tokensCommand);

3661program.addCommand(secretsCommand);

3662program.addCommand(endpointsCommand);

3663program.addCommand(templateCommand);

3664program.addCommand(adminCommand);

3665program.addCommand

Source & flagged code

4 flagged · loading source

dist/index.jsView file

2750import { Command as Command21 } from "commander"; L2751: import { execFileSync } from "child_process"; L2752:

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L2750

2834try { L2835: latest = execFileSync("npm", ["view", NPM_PACKAGE, "version"], { timeout: 1e4, shell: true }).toString().trim(); L2836: } catch {

High

Shell

Package source references shell execution.

dist/index.jsView on unpkg · L2834

3677if (opts.skill) touchCache(SKILL_CACHE_FILE); L3678: spawn(process.execPath, [entryPath, REFRESH_COMMAND], { L3679: detached: true, ... L3683: env: { L3684: ...process.env, L3685: [ENV_REFRESH_CLI]: opts.cli ? "1" : "", ... L3692: function refreshCliCache() { L3693: return new Promise((resolve4) => { L3694: execFile(

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L3677

2834try { L2835: latest = execFileSync("npm", ["view", NPM_PACKAGE, "version"], { timeout: 1e4, shell: true }).toString().trim(); L2836: } catch { L2837: console.error(`Could not reach npm to check for updates.`); L2838: console.error(`Try manually: npm install -g ${NPM_PACKAGE}`); L2839: process.exit(1);

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L2834

Findings

4 High3 Medium5 Low

HighChild Processdist/index.js

HighShelldist/index.js

HighSame File Env Network Executiondist/index.js

HighRuntime Package Installdist/index.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

4 flagged

dist/index.jsView file

Lines 2730-2770javascript

2730 console.log(`Accepted. Report ${data.report.report_id} \u2192 ${data.report.status}.`);

2731 } catch (err) {

2732 reportActionError(err);

2733 }

2734});

2736 const client = new ApiClient();

2737 try {

2738 const data = await client.request(

2739 "POST",

2740 `/v1/reports/${encodeURIComponent(reportId)}/contest`,

2741 { reason: opts.reason }

2742 );

2743 console.log(`Contested. Report ${data.report.report_id} \u2192 ${data.report.status} (back to triage).`);

2744 } catch (err) {

2745 reportActionError(err);

2746 }

2747});

2748

2749// src/commands/update.ts

2750import { Command as Command21 } from "commander";

2751import { execFileSync } from "child_process";

2752

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L2750

2753// src/version-cache.ts

2754import { readFileSync as readFileSync12, writeFileSync as writeFileSync5, mkdirSync as mkdirSync4 } from "fs";

2755import { join as join8 } from "path";

2756var NPM_PACKAGE = "rekor-cli";

2757var CLI_CACHE_FILE = "update-check.json";

2758var SKILL_CACHE_FILE = "skill-update-check.json";

2759var MAX_AGE_MS = 6 * 60 * 60 * 1e3;

2760function isUpdateCheckDisabled() {

2761 return Boolean(

2762 process.env["NO_UPDATE_NOTIFIER"] || process.env["REKOR_NO_UPDATE_CHECK"] || isCI()

2763 );

2764}

2765function readCache(filename) {

2766 try {

2767 const parsed = JSON.parse(readFileSync12(join8(CONFIG_DIR, filename), "utf-8"));

2768 if (typeof parsed.lastCheck !== "number") return null;

2769 if (parsed.latest !== null && typeof parsed.latest !== "string") return null;

2770 return parsed;

Lines 2814-2854javascript

2814 commander: "^14.0.0",

2815 open: "^11.0.0",

2816 yaml: "^2.9.0"

2817 },

2818 optionalDependencies: {

2819 "@sentry/node": "^10.59.0"

2820 },

2821 devDependencies: {

2822 "@types/node"

Lines 3657-3697javascript

3657program.addCommand(triggersCommand);

3658program.addCommand(batchCommand);

3659program.addCommand(providersCommand);

3660program.addCommand(tokensCommand);

3661program.addCommand(secretsCommand);

3662program.addCommand(endpointsCommand);

3663program.addCommand(templateCommand);

3664program.addCommand(adminCommand);

3665program.addCommand