registry  /  replicas-cli  /  0.2.330

replicas-cli@0.2.330

CLI for managing Replicas workspaces - SSH into cloud dev environments with automatic port forwarding

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket
Supply chain
HighEntropyStringsUrlStrings
Manifest
WildcardDependency
scanned 21 file(s), 1.49 MB of source, external domains: 127.0.0.1, 169.254.169.254, 169.254.170.2, a.co, api.tryreplicas.com, auth.openai.com, aws.amazon.com, claude.ai, console.anthropic.com, developers.google.com, developers.linear.app, docs.aws.amazon.com, docs.google.com, docs.replicas.dev, docs.slack.dev, docs.tryreplicas.com, example.com, github.com, gitlab.com, linear.app, news.ycombinator.com, portal.sso, portal.sso-fips, react-native.canny.io, replicas.dev, signin-fips.amazonaws-us-gov.com, slack.com, sts.amazonaws.com, team.slack.com, tryreplicas.com, www.w3.org

Source & flagged code

4 flagged · loading source
dist/index.mjsView file
7456patternName = supabase_service_key severity = critical line = 7456 matchedText = var supa...tM";
Critical
Critical Secret

Package contains a critical-looking secret pattern.

dist/index.mjsView on unpkg · L7456
7456patternName = supabase_service_key severity = critical line = 7456 matchedText = var supa...tM";
Critical
Secret Pattern

Supabase service role key (JWT) in dist/index.mjs

dist/index.mjsView on unpkg · L7456
dist/chunk-NVNLENJ4.mjsView file
9dateToUtcString, L10: fromBase64, L11: fromUtf8, ... L337: var DEFAULT_PROFILE = "default"; L338: var getProfileName = (init) => init.profile || process.env[ENV_PROFILE] || DEFAULT_PROFILE; L339: ... L362: if (!homeDirCache[homeDirCacheKey]) L363: homeDirCache[homeDirCacheKey] = homedir(); L364: return homeDirCache[homeDirCacheKey]; ... L686: if (region === "*") { L687: console.warn(`@smithy/config-resolver WARN - Please use the caller region instead of "*". See "sigv4a" in https://github.com/aws/aws-sdk-js-v3/blob/main/supplemental-docs/CLIENTS.m... L688: } else {
Low
Weak Crypto

Package source references weak cryptographic algorithms.

dist/chunk-NVNLENJ4.mjsView on unpkg · L9
dist/dist-es-UXGKQHMI.mjsView file
72if (response.statusCode === 200) { L73: const parsed = JSON.parse(str); L74: if (typeof parsed.AccessKeyId !== "string" || typeof parsed.SecretAccessKey !== "string" || typeof parsed.Token !== "string" || typeof parsed.Expiration !== "string") { ... L113: var AWS_CONTAINER_CREDENTIALS_RELATIVE_URI = "AWS_CONTAINER_CREDENTIALS_RELATIVE_URI"; L114: var DEFAULT_LINK_LOCAL_HOST = "http://169.254.170.2"; L115: var AWS_CONTAINER_CREDENTIALS_FULL_URI = "AWS_CONTAINER_CREDENTIALS_FULL_URI"; ... L120: let host; L121: const relative = options.[redacted] ?? process.env[AWS_CONTAINER_CREDENTIALS_RELATIVE_URI]; L122: const full = options.awsContainerCredentialsFullUri ?? process.env[AWS_CONTAINER_CREDENTIALS_FULL_URI];
High
Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/dist-es-UXGKQHMI.mjsView on unpkg · L72

Findings

2 Critical1 High4 Medium6 Low
CriticalCritical Secretdist/index.mjs
CriticalSecret Patterndist/index.mjs
HighCloud Metadata Accessdist/dist-es-UXGKQHMI.mjs
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumWildcard Dependency
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Cryptodist/chunk-NVNLENJ4.mjs
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings