registry / ripplo / 0.7.47

ripplo@0.7.47

⚠ Under review

CLI for Ripplo — AI-powered end-to-end testing

Static Scan Results

scanned 8d ago · by rust-scanner

Static analysis flagged 15 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareUrlStrings

Manifest

NoLicense

scanned 16 file(s), 1.65 MB of source, external domains: 127.0.0.1, evilmartians.com, json-schema.org, ripplo.ai, ripplo.invalid, www.w3.org, www.w3ctech.com

Source & flagged code

5 flagged

dist/index.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import{a as _,b as Q,c as Sr,d as Rr,e as Ie,f as xr,g as Cr,h as $r,i as Hr}from"./chunk-HX7AAG7Q.js";import{A as Dr,G as me,K as _r,M as at,O as lt,Q as Fr,V as Ur,W as Wr,X as qr,Y as Br,a as qt,b as z,c as Bt,d as Vt,e as Xt,f as P,g as A,h as Yt,i as h,j as J,k as Zt,l as er,m as it,n as tr,o as pe,p as v,q as Ir,r as Ar,t as jr,u as Tr,v as Lr,w as Mr,x as Nr,y as Or}from"./chunk-JZVB5QXR.js";import{c as Pe}from"./chunk-4J4T7534.js";import{a as $,b as ue,c as D,e as Gt,f as T,g as u,h as zt,i as E,j as Kt,k as Jt,l as Qt}from"./chunk-LISHXK5I.js";import{a as Lt,b as Mt,c as Nt,d as c,e a ...

3 query AuthViewer {

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L1

4 currentUser {

5 name

6 email

7 }

8 }

9`);async function Qr(){let e=A(),t=N(e);if(t!=null&&await sa(e,t))return;let n=(await Jr({url:e,onDeviceCode:a=>{process.stdout.write(`Opening your browser to finish sign-in.

10`),process.stdout.write(`If it didn't open, visit: ${a.verificationUrl}

11`),process.stdout.write(`Verification code: ${a.userCode}

13`),process.stdout.write(`Waiting for approval...

14`)}})).match(a=>a,a=>{process.stderr.write(`${P(a)}

15`),process.exit(1)}),o=await dt({serverUrl:e,token:n}),i=g(process.cwd()),s=i?"Welcome back":"Welcome to Ripplo";process.stdout.write(`

16`),process.stdout.write(o.kind==="ok"?`${s}, ${aa(o.viewer)}.

17`:`${s}.

18`),process.stdout.write(`Session saved to ${ot(e)}.

19`),i||(process.stdout.write("\nNext: run `/ripplo:setup` in Claude Code to wire Ripplo into this project,\n"),process.stdout.write("or `npx ripplo init` to set it up by hand.\n"))}async function sa(e,t){let r=await dt({serverUrl:e,token:t});return r.kind==="ok"?(process.stdout.write(`Already signed in as ${r.viewer.email}. Run \`npx ripplo auth logout\` to switch accounts.

20`),!0):(r.kind==="unreachable"&&(process.stdout.write(`Could not reach the Ripplo server at ${e} (${r.message}). Your saved session may still be valid \u2014 fix connectivity and retry.

21`),process.exit(1)),process.stdout.write(`Your session expired \u2014 signing you back in.

Long lines were clipped for display.

Lines 73-113javascript

73 }

74`);function rn(e){switch(e.status){case"active":return e.gitMidOperation?"\u2713 Dev session: ripplo daemon is live (hooks auto-paused while git is mid-merge/rebase/cherry-pick \u2014 they resume when the operation ends)":"\u2713 Dev session: ripplo daemon is live for this directory";case"starting":return"! Dev session: the daemon is running locally but hasn't registered with the server yet. Wait a few seconds and re-run `npx ripplo doctor`. If it persists, check the daemon output for auth or network errors.";case"missing":{let t="\u2717 Dev session: no daemon running for this directory. Start ...

75`)}}}async function nn(e){let t=Pe(e),r=Zt(e),n=h(e).

dist/chunk-LISHXK5I.jsView file

Lines 1-10javascript

1#!/usr/bin/env node

2import{h as k}from"./chunk-4K4VY5OR.js";import{g as w}from"./chunk-S3KN37I7.js";import{readFileSync as M}from"fs";import{z as F}from"zod";var O=F.object({version:F.

dist/daemon-GF3KQQXW.jsView file

Lines 13-53javascript

13 subscription TeleportRequestedWatch($devSessionId: String!) {

14 teleportRequested(devSessionId: $devSessionId) {

15 runId

16 stepIndex

17 kind

18 testSlug

19 workflowSlug

20 }

21 }

22`),eo=N(`

23 query TeleportRunRepro

dist/chunk-HX7AAG7Q.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = ripplo@0.7.42 matchedIdentity = npm:cmlwcGxv:0.7.42 similarity = 0.750 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/chunk-HX7AAG7Q.jsView on unpkg

Source & flagged code

5 flagged · loading source

dist/index.jsView file

1#!/usr/bin/env node L2: import{a as _,b as Q,c as Sr,d as Rr,e as Ie,f as xr,g as Cr,h as $r,i as Hr}from"./chunk-HX7AAG7Q.js";import{A as Dr,G as me,K as _r,M as at,O as lt,Q as Fr,V as Ur,W as Wr,X as q... L3: query AuthViewer {

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L1

93} L94: `),Oa="Failed to connect to Ripplo server";async function dn({serverUrl:e,token:t}){try{let r=await c({config:F({serverUrl:e,token:t}),document:Na,variables:void 0});return r.curre... L95: `);let n=r.map(i=>on(i));process.stdout.write(n.join(` ... L105: `)}async function gn(e,t){let r=h(e).unwrapOr(void 0);r!=null&&await c({config:r,document:el,variables:{paused:t,projectId:r.projectId}}).catch(n=>{process.stderr.write(`Warning: c... L106: `)})}import ie from"fs";import se from"path";import{input as Rn,select as xn}from"@inquirer/prompts";import{graphql as Il}from"gql.tada";import{exec as tl,execFile as rl}from"child... L107: `)[0]??r.message:String(r);return Z.warn("Install failed (%s): %s",t,n),{cmd:t,ok:!1,reason:n}}}async function ul(e){try{await _(e);return}catch(t){return`Couldn't compile initial ...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L93

dist/chunk-LISHXK5I.jsView file

3`};return{diagnostics:l.[redacted](a,L).split(` L4: `).filter(u=>u.length>0),ok:!1}}function N(t,r){let n=t.file?.fileName;return n==null?!0:n.startsWith(r)}var D=p.join(".local","tsbuildinfo");function U(t){return{allowImportingTsE... L5: `)}function Xe(){return`${y} is up to date`}function Be(t){return[`${y} is ${t==="missing"?"missing":"out of date"} \u2014 run \`npx ripplo compile\` and commit the result`,h("setu...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/chunk-LISHXK5I.jsView on unpkg · L3

dist/daemon-GF3KQQXW.jsView file

33`);function Ve({cwd:e,devSessionId:r,onSubscriptionDead:o,sseClient:n}){let t=new Set,i=n.subscribe({query:Xr(Zr),variables:{devSessionId:r}},{complete:()=>{},error:l=>{let s=l ins... L34: `);let s=await Qe({cwd:e,onReady:()=>{t("opened")},signal:n,step:o.stepIndex+1,target:i});s.kind==="done"&&s.result.kind==="handed-over"||(a.warn({kind:s.kind,runId:o.runId},"telep... L35: mutation ProvisionDevTunnel($devSessionId: String!, $localUrl: String!, $engineUrl: String) {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/daemon-GF3KQQXW.jsView on unpkg · L33

dist/chunk-HX7AAG7Q.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/chunk-HX7AAG7Q.jsView on unpkg

Findings

1 Critical4 High5 Medium5 Low

CriticalPrevious Version Dangerous Deltadist/chunk-HX7AAG7Q.js

HighChild Processdist/index.js

HighSame File Env Network Executiondist/daemon-GF3KQQXW.js

HighCommand Output Exfiltrationdist/index.js

HighObfuscated

MediumDynamic Requiredist/chunk-LISHXK5I.js

MediumNetwork

MediumEnvironment Vars

MediumProtestware

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

5 flagged

dist/index.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

3 query AuthViewer {

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L1

4 currentUser {

5 name

6 email

7 }

8 }

9`);async function Qr(){let e=A(),t=N(e);if(t!=null&&await sa(e,t))return;let n=(await Jr({url:e,onDeviceCode:a=>{process.stdout.write(`Opening your browser to finish sign-in.

10`),process.stdout.write(`If it didn't open, visit: ${a.verificationUrl}

11`),process.stdout.write(`Verification code: ${a.userCode}

13`),process.stdout.write(`Waiting for approval...

14`)}})).match(a=>a,a=>{process.stderr.write(`${P(a)}

15`),process.exit(1)}),o=await dt({serverUrl:e,token:n}),i=g(process.cwd()),s=i?"Welcome back":"Welcome to Ripplo";process.stdout.write(`

16`),process.stdout.write(o.kind==="ok"?`${s}, ${aa(o.viewer)}.

17`:`${s}.

18`),process.stdout.write(`Session saved to ${ot(e)}.

20`),!0):(r.kind==="unreachable"&&(process.stdout.write(`Could not reach the Ripplo server at ${e} (${r.message}). Your saved session may still be valid \u2014 fix connectivity and retry.

21`),process.exit(1)),process.stdout.write(`Your session expired \u2014 signing you back in.

Long lines were clipped for display.

Lines 73-113javascript

73 }

75`)}}}async function nn(e){let t=Pe(e),r=Zt(e),n=h(e).

dist/chunk-LISHXK5I.jsView file

Lines 1-10javascript

1#!/usr/bin/env node

2import{h as k}from"./chunk-4K4VY5OR.js";import{g as w}from"./chunk-S3KN37I7.js";import{readFileSync as M}from"fs";import{z as F}from"zod";var O=F.object({version:F.

dist/daemon-GF3KQQXW.jsView file

Lines 13-53javascript

13 subscription TeleportRequestedWatch($devSessionId: String!) {

14 teleportRequested(devSessionId: $devSessionId) {

15 runId

16 stepIndex

17 kind

18 testSlug

19 workflowSlug

20 }

21 }

22`),eo=N(`

23 query TeleportRunRepro

dist/chunk-HX7AAG7Q.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/chunk-HX7AAG7Q.jsView on unpkg