registry / ripplo / 0.7.43

ripplo@0.7.43

⚠ Under review

CLI for Ripplo — AI-powered end-to-end testing

Static Scan Results

scanned 11d ago · by rust-scanner

Static analysis flagged 15 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareUrlStrings

Manifest

NoLicense

scanned 18 file(s), 1.64 MB of source, external domains: 127.0.0.1, evilmartians.com, json-schema.org, ripplo.ai, ripplo.invalid, www.w3.org, www.w3ctech.com

Source & flagged code

5 flagged

dist/chunk-33L574IL.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import{d as p,e as a}from"./chunk-4K4VY5OR.js";import{graphql as y}from"gql.tada";import{execFileSync as S,spawn as T}from"child_process";import{existsSync as m}from"fs";var g=2e3,w=["/opt/homebrew/bin/cloudflared","/usr/local/bin/cloudflared","/usr/bin/cloudflared"],d=class extends Error{};function v({token:n}){let e=h(),i=!1,r,o,s=()=>{if(i)return;let t=T(e,["tunnel","--no-autoupdate","run"],{env:{...process.env,TUNNEL_TOKEN:n},stdio:"ignore"});r=t,t.on("error",l=>{a.warn({err:l},"cloudflared spawn failed"),f()}),t.on("exit",(l,c)=>{a.warn({code:l,signal:c},"cloudflared exited"),r=void 0,f() ...

3 mutation ReleaseDevTunnel($devSessionId: String!) {

High

Child Process

Package source references child process execution.

dist/chunk-33L574IL.jsView on unpkg · L1

4 releaseDevTunnel(devSessionId: $devSessionId)

5 }

6`),x=y(`

7 mutation ProvisionDevTunnel($devSessionId: String!, $localUrl: String!, $engineUrl: String) {

8 provisionDevTunnel(devSessionId: $devSessionId, localUrl: $localUrl, engineUrl: $engineUrl) {

9 __typename

10 ... on DevTunnel {

11 hostname

12 tunnelId

13 tunnelToken

14 }

15 ... on DevSessionEndedError {

16 message

17 }

18 ... on TunnelNotConfiguredError {

19 message

20 }

21 }

Long lines were clipped for display.

dist/chunk-ZMZVVC65.jsView file

Lines 1-10javascript

1#!/usr/bin/env node

2import{g as w}from"./chunk-IRJGSXWE.js";import{h as k}from"./chunk-4K4VY5OR.js";import{readFileSync as M}from"fs";import{z as F}from"zod";var O=F.object({version:F.

dist/chunk-4K4VY5OR.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import{b as G,c as q}from"./chunk-SB7H6IAS.js";import{execFileSync as O}from"child_process";import U from"fs";import p from"path";function F(e){let r=L(e);return

dist/index.jsView file

Lines 73-113javascript

73 }

74`);function Gt(e){switch(e.status){case"active":return e.gitMidOperation?"\u2713 Dev session: ripplo daemon is live (hooks auto-paused while git is mid-merge/rebase/cherry-pick \u2014 they resume when the operation ends)":"\u2713 Dev session: ripplo daemon is live for this directory";case"starting":return"! Dev session: the daemon is running locally but hasn't registered with the server yet. Wait a few seconds and re-run `npx ripplo doctor`. If it persists, check the daemon output for auth or network errors.";case"missing":{let r="\u2717 Dev session: no daemon running for this directory. Start ...

75`)}}}async function zt(e){let r=Se(e),t=

Source & flagged code

5 flagged · loading source

dist/chunk-33L574IL.jsView file

1#!/usr/bin/env node L2: import{d as p,e as a}from"./chunk-4K4VY5OR.js";import{graphql as y}from"gql.tada";import{execFileSync as S,spawn as T}from"child_process";import{existsSync as m}from"fs";var g=2e3,... L3: mutation ReleaseDevTunnel($devSessionId: String!) {

High

Child Process

Package source references child process execution.

dist/chunk-33L574IL.jsView on unpkg · L1

dist/chunk-ZMZVVC65.jsView file

3`};return{diagnostics:l.[redacted](a,L).split(` L4: `).filter(u=>u.length>0),ok:!1}}function N(t,r){let n=t.file?.fileName;return n==null?!0:n.startsWith(r)}var D=p.join(".local","tsbuildinfo");function U(t){return{allowImportingTsE... L5: `)}function Xe(){return`${y} is up to date`}function Be(t){return[`${y} is ${t==="missing"?"missing":"out of date"} \u2014 run \`npx ripplo compile\` and commit the result`,h("setu...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/chunk-ZMZVVC65.jsView on unpkg · L3

dist/chunk-4K4VY5OR.jsView file

1#!/usr/bin/env node L2: import{b as G,c as q}from"./chunk-SB7H6IAS.js";import{execFileSync as O}from"child_process";import U from"fs";import p from"path";function F(e){let r=L(e);return r??P(e)}function P... L3: `),r}function se(e,r){return u.join(v(e),r)}function h(){return u.join(te.homedir(),oe)}function S(){let e=h();return a.existsSync(e)?a.chmodSync(e,448):a.mkdirSync(e,{mode:448,rec...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/chunk-4K4VY5OR.jsView on unpkg · L1

dist/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = ripplo@0.7.42 matchedIdentity = npm:cmlwcGxv:0.7.42 similarity = 0.889 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg

93} L94: `),ka="Failed to connect to Ripplo server";async function Yt({serverUrl:e,token:r}){try{let t=await c({config:U({serverUrl:e,token:r}),document:ya,variables:void 0});return t.curre... L95: `);let n=t.map(i=>Kt(i));process.stdout.write(n.join(` ... L105: `)}async function sn(e,r){let t=g(e).unwrapOr(void 0);t!=null&&await c({config:t,document:Oa,variables:{paused:r,projectId:t.projectId}}).catch(n=>{process.stderr.write(`Warning: c... L106: `)})}import te from"fs";import ne from"path";import{input as mn,select as fn}from"@inquirer/prompts";import{graphql as ul}from"gql.tada";import{exec as Da,execFile as _a}from"child... L107: `)[0]??t.message:String(t);return N.warn("Install failed (%s): %s",r,n),{cmd:r,ok:!1,reason:n}}}async function za(e){try{await Z(e);return}catch(r){return`Couldn't compile initial ...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L93

Findings

1 Critical4 High5 Medium5 Low

CriticalPrevious Version Dangerous Deltadist/index.js

HighChild Processdist/chunk-33L574IL.js

HighSame File Env Network Executiondist/chunk-4K4VY5OR.js

HighCommand Output Exfiltrationdist/index.js

HighObfuscated

MediumDynamic Requiredist/chunk-ZMZVVC65.js

MediumNetwork

MediumEnvironment Vars

MediumProtestware

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

5 flagged

dist/chunk-33L574IL.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

3 mutation ReleaseDevTunnel($devSessionId: String!) {

High

Child Process

Package source references child process execution.

dist/chunk-33L574IL.jsView on unpkg · L1

4 releaseDevTunnel(devSessionId: $devSessionId)

5 }

6`),x=y(`

7 mutation ProvisionDevTunnel($devSessionId: String!, $localUrl: String!, $engineUrl: String) {

8 provisionDevTunnel(devSessionId: $devSessionId, localUrl: $localUrl, engineUrl: $engineUrl) {

9 __typename

10 ... on DevTunnel {

11 hostname

12 tunnelId

13 tunnelToken

14 }

15 ... on DevSessionEndedError {

16 message

17 }

18 ... on TunnelNotConfiguredError {

19 message

20 }

21 }

Long lines were clipped for display.

dist/chunk-ZMZVVC65.jsView file

Lines 1-10javascript

1#!/usr/bin/env node

2import{g as w}from"./chunk-IRJGSXWE.js";import{h as k}from"./chunk-4K4VY5OR.js";import{readFileSync as M}from"fs";import{z as F}from"zod";var O=F.object({version:F.

dist/chunk-4K4VY5OR.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import{b as G,c as q}from"./chunk-SB7H6IAS.js";import{execFileSync as O}from"child_process";import U from"fs";import p from"path";function F(e){let r=L(e);return

dist/index.jsView file

Lines 73-113javascript

73 }

75`)}}}async function zt(e){let r=Se(e),t=