registry / ripplo / 0.7.59

ripplo@0.7.59

⚠ Under review

CLI for Ripplo — AI-powered end-to-end testing

Static Scan Results

scanned 6h ago · by rust-scanner

Static analysis flagged 16 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareUrlStrings

Manifest

NoLicense

scanned 16 file(s), 2.17 MB of source, external domains: 127.0.0.1, avatars.githubusercontent.com, cdn.jsdelivr.net, evilmartians.com, fakerjs.dev, github.com, json-schema.org, loremflickr.com, picsum.photos, ripplo.ai, ripplo.invalid, www.w3.org, www.w3ctech.com

Source & flagged code

5 flagged

dist/chunk-QKILUEUW.jsView file

Lines 1-9javascript

1#!/usr/bin/env node

2import { createRequire as __ripploCreateRequire } from "node:module";

3const require = globalThis.require ?? __ripploCreateRequire(import.meta.url);

4import{B as R,C as h,D as v,E as x,F as q,G as p,H as N,I as O,a as w,f as S,i as P,t as g,u,v as y,w as C,y as E,z as b}from"./chunk-ORRK3V4W.js";import{h as D}from"./chunk-PXYDLKAG.js";import{va as I}from"./chunk-6AY37H4A.js";import{spawn as J}from"child_process";import A from"fs";import F from"net";import{setTimeout as k}from"timers/promises";import{err as d,ok as f}from"neverthrow";import{ResponseError as G}from"vscode-jsonrpc/node";var T=12e4,_=300,M=5e3;async function sn({cliEntry:o,cwd:n}){let e=u(n),r=await i(e);return r!=null?j({cliEntry:o,connection:l(r,!1),cwd:n}):V({cliEntry:o,cwd: ...

5`),process.exit(1));let r=g(e.value),t=await L(n);if(o.format==="summary"){r.length>0&&process.stdout.write(`stub workflows: ${r.join(", ")}

High

Child Process

Package source references child process execution.

dist/chunk-QKILUEUW.jsView on unpkg · L3

6`),process.stdout.write(`${I(t)}

7`);return}let m={daemon:t.kind==="running"?{active:t.status.active,explorer:t.status.explorer,exploring:t.status.exploring,progress:t.status.progress,queued:t.status.queued,running:!0}:{running:t.kind==="unresponsive",state:t.kind},tests:r.map(a=>({id:a,implemented:!1}))};process.stdout.write(`${JSON.stringify(m,null,2)}

8`)}export{sn as a,cn as b,un as c,dn as d,ln as e,L as f,wn as g};

Long lines were clipped for display.

dist/chunk-ORRK3V4W.jsView file

Lines 1-11javascript

1#!/usr/bin/env node

2import { createRequire as __ripploCreateRequire } from "node:module";

3const require = globalThis.require ?? __ripploCreateRequire(import.meta.url);

4import{i as T}from"./chunk-PXYDLKAG.js";import{A as G,C

dist/chunk-PXYDLKAG.jsView file

Lines 1-23javascript

1#!/usr/bin/env node

2import { createRequire as __ripploCreateRequire } from "node:module";

3const require = globalThis.require ?? __ripploCreateRequire(import.meta.url);

4import{b as G,c as q}from"./chunk-63TU4VJ7.js";import{execFileSync

dist/index.jsView file

Lines 75-115javascript

75 id

76 }

77 }

78 }

79`);function An(e){switch(e.status){case"active":return e.gitMidOperation?"\u2713 Dev session: ripplo daemon is live (hooks auto-paused while git is mid-merge/rebase/cherry-pick \u2014 they resume when the operation ends)":"\u2713 Dev session: ripplo daemon is live for this directory";case"starting":return"! Dev session: the daemon is running locally but hasn't registered with the server yet. Wait a few seconds and re-run `npx ripplo doctor`. If it persists, check the daemon output for auth or network errors.";case"missing":{let t="\u2717 Dev session: no daemon running for this directory. Start ...

80`)}}}async function

Source & flagged code

5 flagged · loading source

dist/chunk-QKILUEUW.jsView file

3const require = globalThis.require ?? __ripploCreateRequire(import.meta.url); L4: import{B as R,C as h,D as v,E as x,F as q,G as p,H as N,I as O,a as w,f as S,i as P,t as g,u,v as y,w as C,y as E,z as b}from"./chunk-ORRK3V4W.js";import{h as D}from"./chunk-PXYDLK... L5: `),process.exit(1));let r=g(e.value),t=await L(n);if(o.format==="summary"){r.length>0&&process.stdout.write(`stub workflows: ${r.join(", ")}

High

Child Process

Package source references child process execution.

dist/chunk-QKILUEUW.jsView on unpkg · L3

dist/chunk-ORRK3V4W.jsView file

2import { createRequire as __ripploCreateRequire } from "node:module"; L3: const require = globalThis.require ?? __ripploCreateRequire(import.meta.url); L4: import{i as T}from"./chunk-PXYDLKAG.js";import{A as G,C as Y,F as Q,G as Z,f as R,g as p,h as q,i as l,m as X,n as V,o as B,p as K}from"./chunk-6AY37H4A.js";import{readFileSync as ...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/chunk-ORRK3V4W.jsView on unpkg · L2

dist/chunk-PXYDLKAG.jsView file

3const require = globalThis.require ?? __ripploCreateRequire(import.meta.url); L4: import{b as G,c as q}from"./chunk-63TU4VJ7.js";import{execFileSync as O}from"child_process";import U from"fs";import p from"path";function F(e){let r=L(e);return r??A(e)}function A... L5: `),r}function se(e,r){return u.join(v(e),r)}function h(){return u.join(te.homedir(),oe)}function S(){let e=h();return a.existsSync(e)?a.chmodSync(e,448):a.mkdirSync(e,{mode:448,rec...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/chunk-PXYDLKAG.jsView on unpkg · L3

dist/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = ripplo@0.7.56 matchedIdentity = npm:cmlwcGxv:0.7.56 similarity = 0.688 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg

95} L96: `),Ul="Failed to connect to Ripplo server";async function Nn({serverUrl:e,token:t}){try{let r=await c({config:_({serverUrl:e,token:t}),document:Fl,variables:void 0});return r.curre... L97: `);let n=r.map(i=>Tn(i));process.stdout.write(n.join(` ... L107: `)}async function Hn(e,t){let r=g(e).unwrapOr(void 0);r!=null&&await c({config:r,document:od,variables:{paused:t,projectId:r.projectId}}).catch(n=>{process.stderr.write(`Warning: c... L108: `)})}import se from"fs";import ae from"path";import{input as Jn,select as Qn}from"@inquirer/prompts";import{graphql as Od}from"gql.tada";import{exec as id,execFile as sd}from"child... L109: `)[0]??r.message:String(r);return Z.warn("Install failed (%s): %s",t,n),{cmd:t,ok:!1,reason:n}}}async function gd(e){try{await oe(e);return}catch(t){return`Couldn't compile initial...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L95

Findings

1 Critical4 High5 Medium6 Low

CriticalPrevious Version Dangerous Deltadist/index.js

HighChild Processdist/chunk-QKILUEUW.js

HighSame File Env Network Executiondist/chunk-PXYDLKAG.js

HighCommand Output Exfiltrationdist/index.js

HighObfuscated

MediumDynamic Requiredist/chunk-ORRK3V4W.js

MediumNetwork

MediumEnvironment Vars

MediumProtestware

MediumStructural Risk Force Deep Review

LowScripts Present

LowEval

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

5 flagged

dist/chunk-QKILUEUW.jsView file

Lines 1-9javascript

1#!/usr/bin/env node

2import { createRequire as __ripploCreateRequire } from "node:module";

3const require = globalThis.require ?? __ripploCreateRequire(import.meta.url);

5`),process.exit(1));let r=g(e.value),t=await L(n);if(o.format==="summary"){r.length>0&&process.stdout.write(`stub workflows: ${r.join(", ")}

High

Child Process

Package source references child process execution.

dist/chunk-QKILUEUW.jsView on unpkg · L3

6`),process.stdout.write(`${I(t)}

8`)}export{sn as a,cn as b,un as c,dn as d,ln as e,L as f,wn as g};

Long lines were clipped for display.

dist/chunk-ORRK3V4W.jsView file

Lines 1-11javascript

1#!/usr/bin/env node

2import { createRequire as __ripploCreateRequire } from "node:module";

3const require = globalThis.require ?? __ripploCreateRequire(import.meta.url);

4import{i as T}from"./chunk-PXYDLKAG.js";import{A as G,C

dist/chunk-PXYDLKAG.jsView file

Lines 1-23javascript

1#!/usr/bin/env node

2import { createRequire as __ripploCreateRequire } from "node:module";

3const require = globalThis.require ?? __ripploCreateRequire(import.meta.url);

4import{b as G,c as q}from"./chunk-63TU4VJ7.js";import{execFileSync

dist/index.jsView file

Lines 75-115javascript

75 id

76 }

77 }

78 }

80`)}}}async function