registry / replicas-cli / 0.2.392

replicas-cli@0.2.392

CLI for managing Replicas workspaces - SSH into cloud dev environments with automatic port forwarding

Static Scan Results

scanned 5h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsObfuscatedUrlStrings

Manifest

WildcardDependency

scanned 21 file(s), 2.12 MB of source, external domains: 127.0.0.1, 169.254.169.254, 169.254.170.2, a.co, api.tryreplicas.com, auth.openai.com, aws.amazon.com, claude.ai, console.anthropic.com, developers.google.com, developers.linear.app, docs.aws.amazon.com, docs.google.com, docs.replicas.dev, docs.slack.dev, docs.tryreplicas.com, example.com, github.com, gitlab.com, json-schema.org, linear.app, news.ycombinator.com, portal.sso, portal.sso-fips, react-native.canny.io, replicas.dev, signin-fips.amazonaws-us-gov.com, slack.com, sts.amazonaws.com, team.slack.com, tryreplicas.com, www.w3.org

Source & flagged code

4 flagged

dist/index.mjsView file

7457patternName = supabase_service_key severity = critical line = 7457 matchedText = var supa...tM";

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/index.mjsView on unpkg · L7457

7457patternName = supabase_service_key severity = critical line = 7457 matchedText = var supa...tM";

Critical

Secret Pattern

Supabase service role key (JWT) in dist/index.mjs

dist/index.mjsView on unpkg · L7457

dist/chunk-5YGPPG6H.mjsView file

Lines 1-29javascript

1#!/usr/bin/env bun

2import {

3 LazyJsonString,

4 NumericValue,

5 Uint8ArrayBlobAdapter,

6 _parseEpochTimestamp,

7 _parseRfc3339DateTimeWithOffset,

8 _parseRfc7231DateTime,

9 dateToUtcString,

10 fromBase64,

11 fromUtf8,

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/chunk-5YGPPG6H.mjsView on unpkg · L9

12 generateIdempotencyToken,

13 quoteHeader,

14 sdkStreamMixin,

15 splitEvery,

16 splitHeader,

17 toBase64,

18 toUtf8

19} from "./chunk-QLNB4JLM.mjs";

20import {

21 __publicField

22} from "./chunk-MPRIIAGC.mjs";

24// ../node_modules/.bun/@smithy+types@4.14.1/node_modules/@smithy/types/dist-es/middleware.js

25var SMITHY_CONTEXT_KEY = "__smithy_context";

27// ../node_modules/.bun/@smithy+types@4.14.1/node_modules/@smithy/types/dist-es/profile.js

28var IniSectionType;

29(function(IniSectionType2) {

dist/dist-es-Q7U2N35F.mjsView file

Lines 8-48javascript

8import "./chunk-QLNB4JLM.mjs";

9import {

10 __publicField

11} from "./chunk-MPRIIAGC.mjs";

13// ../node_modules/.bun/@smithy+credential-provider-imds@4.4.1/node_modules/@smithy/credential-provider-imds/dist-es/remoteProvider/ImdsCredentials.js

14var isImdsCredentials =

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code