registry / ripplo / 0.7.55

ripplo@0.7.55

CLI for Ripplo — AI-powered end-to-end testing

Static Scan Results

scanned 1d ago · by rust-scanner

Static analysis flagged 15 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareUrlStrings

Manifest

NoLicense

scanned 16 file(s), 2.17 MB of source, external domains: 127.0.0.1, avatars.githubusercontent.com, cdn.jsdelivr.net, evilmartians.com, fakerjs.dev, github.com, json-schema.org, loremflickr.com, picsum.photos, ripplo.ai, ripplo.invalid, www.w3.org, www.w3ctech.com

Source & flagged code

4 flagged

dist/index.jsView file

Lines 1-23javascript

1#!/usr/bin/env node

2import { createRequire as __ripploCreateRequire } from "node:module";

3const require = globalThis.require ?? __ripploCreateRequire(import.meta.url);

4import{a as Wn,b as Hn,c as je,d as qn,e as Bn,f as Vn,g as lr}from"./chunk-2AFQ4C6G.js";import{A as nr,G as fe,K as rr,M as pt,O as or,P as Te,R as ir,V as sr,W as ar,X as dr,Y as cr,a as Zt,b as z,c as en,d as tn,e as dn,f as P,g as I,h as cn,i as g,j as J,k as _n,l as Fn,m as ut,n as Un,o as me,p as v,q as Kn,r as Jn,t as Qn,u as Xn,v as Yn,w as Zn,x as er,y as tr}from"./chunk-Q6NPLTSY.js";import{c as Ae}from"./chunk-ZPCVY23H.js";import{a as $,b as pe,c as F,e as rn,f as L,g as u,h as on,i as A,j as sn,k as an,l as ln,m as Mn,n as Ln,o as Nn,p as On,q as oe,r as Ie,s as Dn,t as K}from"./chu ...

5 query AuthViewer {

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L3

6 currentUser {

7 name

8 email

9 }

10 }

11`);async function hr(){let e=I(),t=T(e);if(t!=null&&await Ma(e,t))return;let r=(await gr({url:e,onDeviceCode:a=>{process.stdout.write(`Opening your browser to finish sign-in.

12`),process.stdout.write(`If it didn't open, visit: ${a.verificationUrl}

13`),process.stdout.write(`Verification code: ${a.userCode}

15`),process.stdout.write(`Waiting for approval...

16`)}})).match(a=>a,a=>{process.stderr.write(`${P(a)}

17`),process.exit(1)}),o=await mt({serverUrl:e,token:r}),i=h(process.cwd()),s=i?"Welcome back":"Welcome to Ripplo";process.stdout.write(`

18`),process.stdout.write(o.kind==="ok"?`${s}, ${La(o.viewer)}.

19`:`${s}.

20`),process.stdout.write(`Session saved to ${lt(e)}.

21`),i||(process.stdout.write("\nNext: run `npx ripplo setup` to wire Ripplo into this project,\n"),process.stdout.write("or `npx ripplo init` to set it up by hand.\n"))}async function Ma(e,t){let n=await mt({serverUrl:e,token:t});return n.kind==="ok"?(process.stdout.write(`Already signed in as ${n.viewer.email}. Run \`npx ripplo auth logout\` to switch accounts.

22`),!0):(n.kind==="unreachable"&&(process.stdout.write(`Could not reach the Ripplo server at ${e} (${n.message}). Your saved session may still be valid \u2014 fix connectivity and retry.

23`),process.exit(1)),process.stdout.write(`Your session expired \u2014 signing you back in.

Long lines were clipped for display.

Lines 75-115javascript

75 id

76 }

77 }

78 }

79`);function Rr(e){switch(e.status){case"active":return e.gitMidOperation?"\u2713 Dev session: ripplo daemon is live (hooks auto-paused while git is mid-merge/rebase/cherry-pick \u2014 they resume when the operation ends)":"\u2713 Dev session: ripplo daemon is live for this directory";case"starting":return"! Dev session: the daemon is running locally but hasn't registered with the server yet. Wait a few seconds and re-run `npx ripplo doctor`. If it persists, check the daemon output for auth or network errors.";case"missing":{let t="\u2717 Dev session: no daemon running for this directory. Start ...

80`)}}}async function xr(e){let t

dist/chunk-3JC4ZODN.jsView file

Lines 1-13javascript

1#!/usr/bin/env node

2import { createRequire as __ripploCreateRequire } from "node:module";

3const require = globalThis.require ?? __ripploCreateRequire(import.meta.url);

4import{i as T}from"./chunk-PXYDLKAG.js";import{B as Y,D

dist/chunk-PXYDLKAG.jsView file

Lines 1-23javascript

1#!/usr/bin/env node

2import { createRequire as __ripploCreateRequire } from "node:module";

3const require = globalThis.require ?? __ripploCreateRequire(import.meta.url);

4import{b as G,c as q}from"./chunk-63TU4VJ7.js";import{execFileSync

Source & flagged code

4 flagged · loading source

dist/index.jsView file

3const require = globalThis.require ?? __ripploCreateRequire(import.meta.url); L4: import{a as Wn,b as Hn,c as je,d as qn,e as Bn,f as Vn,g as lr}from"./chunk-2AFQ4C6G.js";import{A as nr,G as fe,K as rr,M as pt,O as or,P as Te,R as ir,V as sr,W as ar,X as dr,Y as... L5: query AuthViewer {

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L3

95} L96: `),bl="Failed to connect to Ripplo server";async function Er({serverUrl:e,token:t}){try{let n=await c({config:D({serverUrl:e,token:t}),document:wl,variables:void 0});return n.curre... L97: `);let r=n.map(i=>Cr(i));process.stdout.write(r.join(` ... L107: `)}async function Nr(e,t){let n=g(e).unwrapOr(void 0);n!=null&&await c({config:n,document:_l,variables:{paused:t,projectId:n.projectId}}).catch(r=>{process.stderr.write(`Warning: c... L108: `)})}import ae from"fs";import le from"path";import{input as Hr,select as qr}from"@inquirer/prompts";import{graphql as md}from"gql.tada";import{exec as Fl,execFile as Ul}from"child... L109: `)[0]??n.message:String(n);return Z.warn("Install failed (%s): %s",t,r),{cmd:t,ok:!1,reason:r}}}async function Jl(e){try{await oe(e);return}catch(t){return`Couldn't compile initial...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L95

dist/chunk-3JC4ZODN.jsView file

2import { createRequire as __ripploCreateRequire } from "node:module"; L3: const require = globalThis.require ?? __ripploCreateRequire(import.meta.url); L4: import{i as T}from"./chunk-PXYDLKAG.js";import{B as Y,D as Q,E as Z,f as R,g as p,h as q,i as l,m as X,n as V,o as B,p as K,z as G}from"./chunk-OUOQU2Q2.js";import{readFileSync as ...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/chunk-3JC4ZODN.jsView on unpkg · L2

dist/chunk-PXYDLKAG.jsView file

3const require = globalThis.require ?? __ripploCreateRequire(import.meta.url); L4: import{b as G,c as q}from"./chunk-63TU4VJ7.js";import{execFileSync as O}from"child_process";import U from"fs";import p from"path";function F(e){let r=L(e);return r??A(e)}function A... L5: `),r}function se(e,r){return u.join(v(e),r)}function h(){return u.join(te.homedir(),oe)}function S(){let e=h();return a.existsSync(e)?a.chmodSync(e,448):a.mkdirSync(e,{mode:448,rec...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/chunk-PXYDLKAG.jsView on unpkg · L3

Findings

4 High5 Medium6 Low

HighChild Processdist/index.js

HighSame File Env Network Executiondist/chunk-PXYDLKAG.js

HighCommand Output Exfiltrationdist/index.js

HighObfuscated

MediumDynamic Requiredist/chunk-3JC4ZODN.js

MediumNetwork

MediumEnvironment Vars

MediumProtestware

MediumStructural Risk Force Deep Review

LowScripts Present

LowEval

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

4 flagged

dist/index.jsView file

Lines 1-23javascript

1#!/usr/bin/env node

2import { createRequire as __ripploCreateRequire } from "node:module";

3const require = globalThis.require ?? __ripploCreateRequire(import.meta.url);

5 query AuthViewer {

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L3

6 currentUser {

7 name

8 email

9 }

10 }

11`);async function hr(){let e=I(),t=T(e);if(t!=null&&await Ma(e,t))return;let r=(await gr({url:e,onDeviceCode:a=>{process.stdout.write(`Opening your browser to finish sign-in.

12`),process.stdout.write(`If it didn't open, visit: ${a.verificationUrl}

13`),process.stdout.write(`Verification code: ${a.userCode}

15`),process.stdout.write(`Waiting for approval...

16`)}})).match(a=>a,a=>{process.stderr.write(`${P(a)}

17`),process.exit(1)}),o=await mt({serverUrl:e,token:r}),i=h(process.cwd()),s=i?"Welcome back":"Welcome to Ripplo";process.stdout.write(`

18`),process.stdout.write(o.kind==="ok"?`${s}, ${La(o.viewer)}.

19`:`${s}.

20`),process.stdout.write(`Session saved to ${lt(e)}.

22`),!0):(n.kind==="unreachable"&&(process.stdout.write(`Could not reach the Ripplo server at ${e} (${n.message}). Your saved session may still be valid \u2014 fix connectivity and retry.

23`),process.exit(1)),process.stdout.write(`Your session expired \u2014 signing you back in.

Long lines were clipped for display.

Lines 75-115javascript

75 id

76 }

77 }

78 }

80`)}}}async function xr(e){let t

dist/chunk-3JC4ZODN.jsView file

Lines 1-13javascript

1#!/usr/bin/env node

2import { createRequire as __ripploCreateRequire } from "node:module";

3const require = globalThis.require ?? __ripploCreateRequire(import.meta.url);

4import{i as T}from"./chunk-PXYDLKAG.js";import{B as Y,D

dist/chunk-PXYDLKAG.jsView file

Lines 1-23javascript

1#!/usr/bin/env node

2import { createRequire as __ripploCreateRequire } from "node:module";

3const require = globalThis.require ?? __ripploCreateRequire(import.meta.url);

4import{b as G,c as q}from"./chunk-63TU4VJ7.js";import{execFileSync