registry / ripplo / 0.7.41

ripplo@0.7.41

⚠ Under review

CLI for Ripplo — AI-powered end-to-end testing

Static Scan Results

scanned 12d ago · by rust-scanner

Static analysis flagged 15 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareUrlStrings

Manifest

NoLicense

scanned 13 file(s), 1.62 MB of source, external domains: 127.0.0.1, evilmartians.com, json-schema.org, ripplo.ai, ripplo.invalid, www.w3.org, www.w3ctech.com

Source & flagged code

5 flagged

dist/daemon-SGPPQESA.jsView file

Lines 13-53javascript

13 subscription TeleportRequestedWatch($devSessionId: String!) {

14 teleportRequested(devSessionId: $devSessionId) {

15 runId

16 stepIndex

17 kind

18 testSlug

19 workflowSlug

20 }

21 }

22`),$r=U(`

23 query TeleportRunRepro($id: String!) {

24 run(id: $id) {

25 id

26 reproJson

27 }

28 }

29`),Br=U(`

30 mutation ReportTeleportResult($devSessionId: String!, $runId: String!, $status: String!) {

31 reportTeleportResult(devSessionId: $devSessionId, runId: $runId, status: $status)

32 }

33`);function ze({cwd:e,devSessionId:r,onSubscriptionDead:o,sseClient:n}){let t=new Set,i=n.subscribe({query:Fr(Nr),variables:{devSessionId:r}},{complete:()=>{},error:a=>{let l=a instanceof Error?a.message:String(a);s.warn("teleportRequested SSE failed: %s; re-registering session",l),o(l)},next:a=>{jr({cwd:e,devSessionId:r,event:a.data?.teleportRequested,running:t})}});return()=>{t.forEach(a=>{a.abort()}),t.clear(),i()}}function jr({cwd:e,devSessionId:r,event:o,running:n}){if(o==null)return;let t=new AbortController;n.add(t),zr({cwd:e,devSessionId:r,event:o,signal:t.signal}).catch(i=>{s.error({e ...

34`);let l=await Fe({cwd:e,onReady:()=>{t("opened")},signal:n,step:o.stepIndex+1,target:i});l.kind==="done"&&l.result.kind==="handed-over"||(s.warn({kind:l.kind,runId:o.runId},"teleport could not open"),await t(l.kind==="unplannable"?"unplannable":"error"))}async function Jr({cwd

35 query DaemonExploration($devSessionId: String!) {

High

Child Process

Package source references child process execution.

dist/daemon-SGPPQESA.jsView on unpkg · L33

36 exploration(devSessionId: $devSessionId) {

37 active

38 localWorkers

39 maxTrailLength

40 }

41 }

42`),No=A(`

43 subscription WatchExplorationChanged($devSessionId: String!) {

44 explorationChanged(devSessionId: $devSessionId) {

45 exploration {

46 active

47 localWorkers

48 maxTrailLength

49 }

50 }

51 }

52`);function Sr({config:e,devSessionId:r,machinery:o,sseClient:n}){return $o({config:e,devSessionId:r,machinery:o}),n.subscribe({query:$(No),variables:{devSessionId:r}},{complete:()=>{},error:t=>{s.error(t,"exploration subscription error")},next:t=>{kr(o,t.data?.explorationChanged.exploration)}})}async function $o({config:e,devSessionId:r,machinery:o}){let n=await S({config:e,document:Fo,variables:{devSessionId:r}});kr(o,n.exploration)}function kr(e,r){r!=null&&(e.setMaxTrailLength(r.maxTrailLength),e.setConcurrency(r.localWorkers),e.setEnabled(r.active))}function vr({config:e,devSessionId:r,ma ...

53 subscription HooksPausedWatch($projectId: String!) {

Long lines were clipped for display.

dist/chunk-ERNAR6DX.jsView file

Lines 1-24javascript

1#!/usr/bin/env node

2import{B as Qe,O as Ge,P as Xe,S as Ye,T as Ze,a as N,b as qe,g as He,i as We,j as Be,k as Ve,l as g,m as ze,o as Je,p as ie,q as h,r as F,s as Ke,w

dist/chunk-NLPJM6WL.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import{b as G,c as q}from"./chunk-SB7H6IAS.js";import{execFileSync as O}from"child_process";import U from"fs";import p from"path";function F(e){let r=L(e);return

dist/index.jsView file

Lines 73-113javascript

73 }

74`);function it(e){switch(e.status){case"active":return e.gitMidOperation?"\u2713 Dev session: ripplo daemon is live (hooks auto-paused while git is mid-merge/rebase/cherry-pick \u2014 they resume when the operation ends)":"\u2713 Dev session: ripplo daemon is live for this directory";case"starting":return"! Dev session: the daemon is running locally but hasn't registered with the server yet. Wait a few seconds and re-run `npx ripplo doctor`. If it persists, check the daemon output for auth or network errors.";case"missing":{let r="\u2717 Dev session: no daemon running for this directory. Start ...

75`)}}}async function st(e){let r=$e(e),n=

Source & flagged code

5 flagged · loading source

dist/daemon-SGPPQESA.jsView file

33`);function ze({cwd:e,devSessionId:r,onSubscriptionDead:o,sseClient:n}){let t=new Set,i=n.subscribe({query:Fr(Nr),variables:{devSessionId:r}},{complete:()=>{},error:a=>{let l=a ins... L34: `);let l=await Fe({cwd:e,onReady:()=>{t("opened")},signal:n,step:o.stepIndex+1,target:i});l.kind==="done"&&l.result.kind==="handed-over"||(s.warn({kind:l.kind,runId:o.runId},"telep... L35: query DaemonExploration($devSessionId: String!) {

High

Child Process

Package source references child process execution.

dist/daemon-SGPPQESA.jsView on unpkg · L33

dist/chunk-ERNAR6DX.jsView file

4`};return{diagnostics:I.[redacted](s,l).split(` L5: `).filter(d=>d.length>0),ok:!1}}function Lt(e,n){let t=e.file?.fileName;return t==null?!0:t.startsWith(n)}var Ot=$.join(".local","tsbuildinfo");function Ut(e){return{allowImporting... L6: `)}function $a(){return`${T} is up to date`}function Ma(e){return[`${T} is ${e==="missing"?"missing":"out of date"} \u2014 run \`npx ripplo compile\` and commit the result`,C("setu...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/chunk-ERNAR6DX.jsView on unpkg · L4

dist/chunk-NLPJM6WL.jsView file

1#!/usr/bin/env node L2: import{b as G,c as q}from"./chunk-SB7H6IAS.js";import{execFileSync as O}from"child_process";import U from"fs";import p from"path";function F(e){let r=L(e);return r??P(e)}function P... L3: query AgentReviewContextWorker($reviewId: String!) {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/chunk-NLPJM6WL.jsView on unpkg · L1

dist/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = ripplo@0.7.37 matchedIdentity = npm:cmlwcGxv:0.7.37 similarity = 0.385 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

dist/index.jsView on unpkg

93} L94: `),Ha="Failed to connect to Ripplo server";async function ut({serverUrl:e,token:r}){try{let n=await c({config:W({serverUrl:e,token:r}),document:Wa,variables:void 0});return n.curre... L95: `);let t=n.map(i=>at(i));process.stdout.write(t.join(` ... L105: `)}async function kt(e,r){let n=g(e).unwrapOr(void 0);n!=null&&await c({config:n,document:sl,variables:{paused:r,projectId:n.projectId}}).catch(t=>{process.stderr.write(`Warning: c... L106: `)})}import ie from"fs";import se from"path";import{input as xt,select as Pt}from"@inquirer/prompts";import{graphql as Ol}from"gql.tada";import{exec as dl,execFile as cl}from"child... L107: `)[0]??n.message:String(n);return M.warn("Install failed (%s): %s",r,t),{cmd:r,ok:!1,reason:t}}}async function wl(e){try{await te(e);return}catch(r){return`Couldn't compile initial...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L93

Findings

1 Critical4 High5 Medium5 Low

CriticalPrevious Version Dangerous Deltadist/index.js

HighChild Processdist/daemon-SGPPQESA.js

HighSame File Env Network Executiondist/chunk-NLPJM6WL.js

HighCommand Output Exfiltrationdist/index.js

HighObfuscated

MediumDynamic Requiredist/chunk-ERNAR6DX.js

MediumNetwork

MediumEnvironment Vars

MediumProtestware

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

5 flagged

dist/daemon-SGPPQESA.jsView file

Lines 13-53javascript

13 subscription TeleportRequestedWatch($devSessionId: String!) {

14 teleportRequested(devSessionId: $devSessionId) {

15 runId

16 stepIndex

17 kind

18 testSlug

19 workflowSlug

20 }

21 }

22`),$r=U(`

23 query TeleportRunRepro($id: String!) {

24 run(id: $id) {

25 id

26 reproJson

27 }

28 }

29`),Br=U(`

30 mutation ReportTeleportResult($devSessionId: String!, $runId: String!, $status: String!) {

31 reportTeleportResult(devSessionId: $devSessionId, runId: $runId, status: $status)

32 }

35 query DaemonExploration($devSessionId: String!) {

High

Child Process

Package source references child process execution.

dist/daemon-SGPPQESA.jsView on unpkg · L33

36 exploration(devSessionId: $devSessionId) {

37 active

38 localWorkers

39 maxTrailLength

40 }

41 }

42`),No=A(`

43 subscription WatchExplorationChanged($devSessionId: String!) {

44 explorationChanged(devSessionId: $devSessionId) {

45 exploration {

46 active

47 localWorkers

48 maxTrailLength

49 }

50 }

51 }

53 subscription HooksPausedWatch($projectId: String!) {

Long lines were clipped for display.

dist/chunk-ERNAR6DX.jsView file

Lines 1-24javascript

1#!/usr/bin/env node

2import{B as Qe,O as Ge,P as Xe,S as Ye,T as Ze,a as N,b as qe,g as He,i as We,j as Be,k as Ve,l as g,m as ze,o as Je,p as ie,q as h,r as F,s as Ke,w

dist/chunk-NLPJM6WL.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import{b as G,c as q}from"./chunk-SB7H6IAS.js";import{execFileSync as O}from"child_process";import U from"fs";import p from"path";function F(e){let r=L(e);return

dist/index.jsView file

Lines 73-113javascript

73 }

75`)}}}async function st(e){let r=$e(e),n=