registry / rekor-cli / 0.1.97

rekor-cli@0.1.97

Static Scan Results

scanned 2d ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNativeBindingsNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 1 file(s), 171 KB of source, external domains: 127.0.0.1, api.rekor.pro, api.workos.com, engaging-tip-62.authkit.app, mcp.rekor.pro, raw.githubusercontent.com

Source & flagged code

4 flagged

dist/index.jsView file

Lines 2776-2816javascript

2776 console.log(`Accepted. Report ${data.report.report_id} \u2192 ${data.report.status}.`);

2777 } catch (err) {

2778 reportActionError(err);

2779 }

2780});

2781reportCommand.command("contest <report_id>").description("Contest a shipped fix or a dismissal (\u2192 back to triage)").requiredOption("--reason <text>", "Why the fix/dismissal is wrong").action(async function(reportId, opts) {

2782 const client = new ApiClient();

2783 try {

2784 const data = await client.request(

2785 "POST",

2786 `/v1/reports/${encodeURIComponent(reportId)}/contest`,

2787 { reason: opts.reason }

2788 );

2789 console.log(`Contested. Report ${data.report.report_id} \u2192 ${data.report.status} (back to triage).`);

2790 } catch (err) {

2791 reportActionError(err);

2792 }

2793});

2794

2795// src/commands/update.ts

2796import { Command as Command22 } from "commander";

2797import { execFileSync } from "child_process";

2798

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L2796

2799// src/version-cache.ts

2800import { readFileSync as readFileSync12, writeFileSync as writeFileSync5, mkdirSync as mkdirSync4 } from "fs";

2801import { join as join8 } from "path";

2802var NPM_PACKAGE = "rekor-cli";

2803var CLI_CACHE_FILE = "update-check.json";

2804var SKILL_CACHE_FILE = "skill-update-check.json";

2805var MAX_AGE_MS = 6 * 60 * 60 * 1e3;

2806function isUpdateCheckDisabled() {

2807 return Boolean(

2808 process.env["NO_UPDATE_NOTIFIER"] || process.env["REKOR_NO_UPDATE_CHECK"] || isCI()

2809 );

2810}

2811function readCache(filename) {

2812 try {

2813 const parsed = JSON.parse(readFileSync12(join8(CONFIG_DIR, filename), "utf-8"));

2814 if (typeof parsed.lastCheck !== "number") return null;

2815 if (parsed.latest !== null && typeof parsed.latest !== "string") return null;

2816 return parsed;

Lines 2860-2900javascript

2860 commander: "^14.0.0",

2861 open: "^11.0.0",

2862 yaml: "^2.9.0"

2863 },

2864 optionalDependencies: {

2865 "@sentry/node": "^10.59.0"

2866 },

2867 devDependencies: {

2868 "@types/node"

Lines 3729-3769javascript

3729program.addCommand(batchCommand);

3730program.addCommand(providersCommand);

3731program.addCommand(tokensCommand);

3732program.addCommand(secretsCommand);

3733program.addCommand(endpointsCommand);

3734program.addCommand(toolsCommand);

3735program.addCommand(templateCommand);

3736program.addCommand(adminCommand);

3737program.addCommand

Source & flagged code

4 flagged · loading source

dist/index.jsView file

2796import { Command as Command22 } from "commander"; L2797: import { execFileSync } from "child_process"; L2798:

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L2796

2880try { L2881: latest = execFileSync("npm", ["view", NPM_PACKAGE, "version"], { timeout: 1e4, shell: true }).toString().trim(); L2882: } catch {

High

Shell

Package source references shell execution.

dist/index.jsView on unpkg · L2880

3749if (opts.skill) touchCache(SKILL_CACHE_FILE); L3750: spawn(process.execPath, [entryPath, REFRESH_COMMAND], { L3751: detached: true, ... L3755: env: { L3756: ...process.env, L3757: [ENV_REFRESH_CLI]: opts.cli ? "1" : "", ... L3764: function refreshCliCache() { L3765: return new Promise((resolve4) => { L3766: execFile(

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L3749

2880try { L2881: latest = execFileSync("npm", ["view", NPM_PACKAGE, "version"], { timeout: 1e4, shell: true }).toString().trim(); L2882: } catch { L2883: console.error(`Could not reach npm to check for updates.`); L2884: console.error(`Try manually: npm install -g ${NPM_PACKAGE}`); L2885: process.exit(1);

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L2880

Findings

4 High3 Medium5 Low

HighChild Processdist/index.js

HighShelldist/index.js

HighSame File Env Network Executiondist/index.js

HighRuntime Package Installdist/index.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

4 flagged

dist/index.jsView file

Lines 2776-2816javascript

2776 console.log(`Accepted. Report ${data.report.report_id} \u2192 ${data.report.status}.`);

2777 } catch (err) {

2778 reportActionError(err);

2779 }

2780});

2782 const client = new ApiClient();

2783 try {

2784 const data = await client.request(

2785 "POST",

2786 `/v1/reports/${encodeURIComponent(reportId)}/contest`,

2787 { reason: opts.reason }

2788 );

2789 console.log(`Contested. Report ${data.report.report_id} \u2192 ${data.report.status} (back to triage).`);

2790 } catch (err) {

2791 reportActionError(err);

2792 }

2793});

2794

2795// src/commands/update.ts

2796import { Command as Command22 } from "commander";

2797import { execFileSync } from "child_process";

2798

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L2796

2799// src/version-cache.ts

2800import { readFileSync as readFileSync12, writeFileSync as writeFileSync5, mkdirSync as mkdirSync4 } from "fs";

2801import { join as join8 } from "path";

2802var NPM_PACKAGE = "rekor-cli";

2803var CLI_CACHE_FILE = "update-check.json";

2804var SKILL_CACHE_FILE = "skill-update-check.json";

2805var MAX_AGE_MS = 6 * 60 * 60 * 1e3;

2806function isUpdateCheckDisabled() {

2807 return Boolean(

2808 process.env["NO_UPDATE_NOTIFIER"] || process.env["REKOR_NO_UPDATE_CHECK"] || isCI()

2809 );

2810}

2811function readCache(filename) {

2812 try {

2813 const parsed = JSON.parse(readFileSync12(join8(CONFIG_DIR, filename), "utf-8"));

2814 if (typeof parsed.lastCheck !== "number") return null;

2815 if (parsed.latest !== null && typeof parsed.latest !== "string") return null;

2816 return parsed;

Lines 2860-2900javascript

2860 commander: "^14.0.0",

2861 open: "^11.0.0",

2862 yaml: "^2.9.0"

2863 },

2864 optionalDependencies: {

2865 "@sentry/node": "^10.59.0"

2866 },

2867 devDependencies: {

2868 "@types/node"

Lines 3729-3769javascript

3729program.addCommand(batchCommand);

3730program.addCommand(providersCommand);

3731program.addCommand(tokensCommand);

3732program.addCommand(secretsCommand);

3733program.addCommand(endpointsCommand);

3734program.addCommand(toolsCommand);

3735program.addCommand(templateCommand);

3736program.addCommand(adminCommand);

3737program.addCommand