registry / ripplo / 0.7.40

ripplo@0.7.40

⚠ Under review

CLI for Ripplo — AI-powered end-to-end testing

Static Scan Results

scanned 12d ago · by rust-scanner

Static analysis flagged 15 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareUrlStrings

Manifest

NoLicense

scanned 13 file(s), 1.61 MB of source, external domains: 127.0.0.1, evilmartians.com, json-schema.org, ripplo.ai, ripplo.invalid, www.w3.org, www.w3ctech.com

Source & flagged code

5 flagged

dist/index.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import{A as Zn,B as on,C as er,D as ce,E as v,F as J,G as an,H as kr,I as wr,J as br,K as vr,L as Sr,M as Rr,N as Cr,O as xr,P as $e,Q as Pr,R as $r,S as jr,T as Tr,V as Lr,W as Nr,X as Dr,Y as Mr,Z as Or,_ as _r,a as Wn,aa as Fr,b as K,c as qn,d as Bn,e as C,f as de,g as L,ga as ue,ha as Ur,i as Vn,j as P,k as u,ka as ln,l as Gn,m as $,ma as Hr,n as zn,na as dn,o as Kn,p as Jn,q as Qn,r as E,s as I,t as Xn,ta as Wr,u as g,ua as qr,v as Ce,y as F,z as Yn}from"./chunk-ERNAR6DX.js";import{A as dr,C as sn,D as cr,E as ur,F as pr,H as mr,I as fr,N as gr,Q as Pe,R as hr,U as yr,aa as Er,c as Y,ca a ...

3 query AuthViewer {

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L1

4 currentUser {

5 name

6 email

7 }

8 }

9`);async function Jr(){let e=I(),n=O(e);if(n!=null&&await sa(e,n))return;let t=(await Kr({url:e,onDeviceCode:a=>{process.stdout.write(`Opening your browser to finish sign-in.

10`),process.stdout.write(`If it didn't open, visit: ${a.verificationUrl}

11`),process.stdout.write(`Verification code: ${a.userCode}

13`),process.stdout.write(`Waiting for approval...

14`)}})).match(a=>a,a=>{process.stderr.write(`${E(a)}

15`),process.exit(1)}),o=await cn({serverUrl:e,token:t}),i=y(process.cwd()),s=i?"Welcome back":"Welcome to Ripplo";process.stdout.write(`

16`),process.stdout.write(o.kind==="ok"?`${s}, ${aa(o.viewer)}.

17`:`${s}.

18`),process.stdout.write(`Session saved to ${tn(e)}.

19`),i||(process.stdout.write("\nNext: run `/ripplo:setup` in Claude Code to wire Ripplo into this project,\n"),process.stdout.write("or `npx ripplo init` to set it up by hand.\n"))}async function sa(e,n){let r=await cn({serverUrl:e,token:n});return r.kind==="ok"?(process.stdout.write(`Already signed in as ${r.viewer.email}. Run \`npx ripplo auth logout\` to switch accounts.

20`),!0):(r.kind==="unreachable"&&(process.stdout.write(`Could not reach the Ripplo server at ${e} (${r.message}). Your saved session may still be valid \u2014 fix connectivity and retry.

21`),process.exit(1)),process.stdout.write(`Your session expired \u2014 signing you back in.

Long lines were clipped for display.

Lines 73-113javascript

73 }

74`);function nt(e){switch(e.status){case"active":return e.gitMidOperation?"\u2713 Dev session: ripplo daemon is live (hooks auto-paused while git is mid-merge/rebase/cherry-pick \u2014 they resume when the operation ends)":"\u2713 Dev session: ripplo daemon is live for this directory";case"starting":return"! Dev session: the daemon is running locally but hasn't registered with the server yet. Wait a few seconds and re-run `npx ripplo doctor`. If it persists, check the daemon output for auth or network errors.";case"missing":{let n="\u2717 Dev session: no daemon running for this directory. Start ...

75`)}}}async function rt(e){let n=Ce(e),r=Yn(e),t=g(e).

•matchType = previous_version_dangerous_delta matchedPackage = ripplo@0.7.37 matchedIdentity = npm:cmlwcGxv:0.7.37 similarity = 0.385 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

dist/index.jsView on unpkg

dist/chunk-ERNAR6DX.jsView file

Lines 1-24javascript

1#!/usr/bin/env node

2import{B as Qe,O as Ge,P as Xe,S as Ye,T as Ze,a as N,b as qe,g as He,i as We,j as Be,k as Ve,l as g,m as ze,o as Je,p as ie,q as h,r as F,s as Ke,w

dist/chunk-NLPJM6WL.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import{b as G,c as q}from"./chunk-SB7H6IAS.js";import{execFileSync as O}from"child_process";import U from"fs";import p from"path";function F(e){let r=L(e);return

Source & flagged code

5 flagged · loading source

dist/index.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

dist/index.jsView on unpkg

1#!/usr/bin/env node L2: import{A as Zn,B as on,C as er,D as ce,E as v,F as J,G as an,H as kr,I as wr,J as br,K as vr,L as Sr,M as Rr,N as Cr,O as xr,P as $e,Q as Pr,R as $r,S as jr,T as Tr,V as Lr,W as Nr... L3: query AuthViewer {

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L1

93} L94: `),Ma="Failed to connect to Ripplo server";async function at({serverUrl:e,token:n}){try{let r=await c({config:H({serverUrl:e,token:n}),document:Da,variables:void 0});return r.curre... L95: `);let t=r.map(i=>tt(i));process.stdout.write(t.join(` ... L105: `)}async function ft(e,n){let r=g(e).unwrapOr(void 0);r!=null&&await c({config:r,document:el,variables:{paused:n,projectId:r.projectId}}).catch(t=>{process.stderr.write(`Warning: c... L106: `)})}import oe from"fs";import ie from"path";import{input as vt,select as St}from"@inquirer/prompts";import{graphql as jl}from"gql.tada";import{exec as tl,execFile as ol}from"child... L107: `)[0]??r.message:String(r);return M.warn("Install failed (%s): %s",n,t),{cmd:n,ok:!1,reason:t}}}async function ml(e){try{await re(e);return}catch(n){return`Couldn't compile initial...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L93

dist/chunk-ERNAR6DX.jsView file

4`};return{diagnostics:I.[redacted](s,l).split(` L5: `).filter(d=>d.length>0),ok:!1}}function Lt(e,n){let t=e.file?.fileName;return t==null?!0:t.startsWith(n)}var Ot=$.join(".local","tsbuildinfo");function Ut(e){return{allowImporting... L6: `)}function $a(){return`${T} is up to date`}function Ma(e){return[`${T} is ${e==="missing"?"missing":"out of date"} \u2014 run \`npx ripplo compile\` and commit the result`,C("setu...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/chunk-ERNAR6DX.jsView on unpkg · L4

dist/chunk-NLPJM6WL.jsView file

1#!/usr/bin/env node L2: import{b as G,c as q}from"./chunk-SB7H6IAS.js";import{execFileSync as O}from"child_process";import U from"fs";import p from"path";function F(e){let r=L(e);return r??P(e)}function P... L3: query AgentReviewContextWorker($reviewId: String!) {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/chunk-NLPJM6WL.jsView on unpkg · L1

Findings

1 Critical4 High5 Medium5 Low

CriticalPrevious Version Dangerous Deltadist/index.js

HighChild Processdist/index.js

HighSame File Env Network Executiondist/chunk-NLPJM6WL.js

HighCommand Output Exfiltrationdist/index.js

HighObfuscated

MediumDynamic Requiredist/chunk-ERNAR6DX.js

MediumNetwork

MediumEnvironment Vars

MediumProtestware

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

5 flagged

dist/index.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

3 query AuthViewer {

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L1

4 currentUser {

5 name

6 email

7 }

8 }

9`);async function Jr(){let e=I(),n=O(e);if(n!=null&&await sa(e,n))return;let t=(await Kr({url:e,onDeviceCode:a=>{process.stdout.write(`Opening your browser to finish sign-in.

10`),process.stdout.write(`If it didn't open, visit: ${a.verificationUrl}

11`),process.stdout.write(`Verification code: ${a.userCode}

13`),process.stdout.write(`Waiting for approval...

14`)}})).match(a=>a,a=>{process.stderr.write(`${E(a)}

15`),process.exit(1)}),o=await cn({serverUrl:e,token:t}),i=y(process.cwd()),s=i?"Welcome back":"Welcome to Ripplo";process.stdout.write(`

16`),process.stdout.write(o.kind==="ok"?`${s}, ${aa(o.viewer)}.

17`:`${s}.

18`),process.stdout.write(`Session saved to ${tn(e)}.

20`),!0):(r.kind==="unreachable"&&(process.stdout.write(`Could not reach the Ripplo server at ${e} (${r.message}). Your saved session may still be valid \u2014 fix connectivity and retry.

21`),process.exit(1)),process.stdout.write(`Your session expired \u2014 signing you back in.

Long lines were clipped for display.

Lines 73-113javascript

73 }

75`)}}}async function rt(e){let n=Ce(e),r=Yn(e),t=g(e).

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

dist/index.jsView on unpkg

dist/chunk-ERNAR6DX.jsView file

Lines 1-24javascript

1#!/usr/bin/env node

2import{B as Qe,O as Ge,P as Xe,S as Ye,T as Ze,a as N,b as qe,g as He,i as We,j as Be,k as Ve,l as g,m as ze,o as Je,p as ie,q as h,r as F,s as Ke,w

dist/chunk-NLPJM6WL.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import{b as G,c as q}from"./chunk-SB7H6IAS.js";import{execFileSync as O}from"child_process";import U from"fs";import p from"path";function F(e){let r=L(e);return