registry / rpi-deploy / 0.12.0

rpi-deploy@0.12.0

Deployment tool for Docker Compose projects on Raspberry Pi. Builds the Rust CLI from source on install.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 10.4 KB of source, external domains: github.com, rustup.rs, sh.rustup.rs, win.rustup.rs

Source & flagged code

6 flagged

package.jsonView file

Lines 1-26json

2 "name": "rpi-deploy",

3 "version": "0.12.0",

4 "description": "Deployment tool for Docker Compose projects on Raspberry Pi. Builds the Rust CLI from source on install.",

5 "license": "MIT",

6 "repository": {

7 "type": "git",

8 "url": "git+https://github.com/khmilevoi/rpi-deploy.git"

9 },

10 "bin": { "rpi": "bin/rpi.js" },

11 "files": [

12 "bin/",

13 "scripts/postinstall.js",

14 "scripts/check-version.js",

15 "crates/",

16 "Cargo.toml",

17 "Cargo.lock"

18 ],

19 "scripts": {

20 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L20

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L20

21 "prepublishOnly": "node scripts/check-version.js"

22 },

23 "engines": { "node": ">=18" },

24 "os": ["linux", "darwin", "win32"]

25}

bin/rpi.jsView file

Lines 1-25javascript

1#!/usr/bin/env node

2// Shim installed as the global `rpi` command: runs the native binary that

3// scripts/postinstall.js built into dist/.

4'use strict';

6const { spawnSync } = require('node:child_process');

7const fs = require('node:fs');

High

scripts/postinstall.jsView file

Lines 1-28javascript

1#!/usr/bin/env node

2// rpi-deploy postinstall: builds the rpi binary from the bundled Rust sources.

3// Only runs when installed as a package (under node_modules); a bare

4// `npm install` in a source checkout is a no-op. Never runs apt/brew/winget and

5// never checks Docker (that is `rpi agent setup`'s job). May auto-install

6// rustup when cargo is missing.

7'use strict';

9const { spawnSync } = require('node:child_process');

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/rpi.jsView file

5L6: const { spawnSync } = require('node:child_process'); L7: const fs = require('node:fs');

High

Child Process

Package source references child process execution.

bin/rpi.jsView on unpkg · L5

scripts/postinstall.jsView file

8L9: const { spawnSync } = require('node:child_process'); L10: const fs = require('node:fs'); ... L13: L14: const pkgDir = path.resolve(__dirname, '..'); L15: const exe = process.platform === 'win32' ? '.exe' : ''; L16: const cargoBinDir = path.join(os.homedir(), '.cargo', 'bin'); ... L52: async function fetchTo(url, dest) { L53: const res = await fetch(url, { redirect: 'follow' }); L54: if (!res.ok) throw new Error(`download ${url}: HTTP ${res.status}`); L55: fs.writeFileSync(dest, Buffer.from(await res.arrayBuffer())); L56: }

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

scripts/postinstall.jsView on unpkg · L8

High

Install Named Payload File

Install-named source file stages remote content through filesystem writes and execution.

scripts/postinstall.jsView on unpkg · L8

152fs.writeFileSync(tmp, Buffer.from(await res.arrayBuffer())); L153: const r = spawnSync(tmp, ['-y'], { stdio: 'inherit' }); L154: if (r.status !== 0) fail('rustup-init failed'); ... L156: if (!which('curl')) { L157: fail('curl is required to install rustup; install curl, then rerun: npm install -g rpi-deploy'); L158: }

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/postinstall.jsView on unpkg · L152

Findings

5 High4 Medium5 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processbin/rpi.js

HighSandbox Evasion Gated Capabilityscripts/postinstall.js

HighInstall Named Payload Filescripts/postinstall.js

HighRuntime Package Installscripts/postinstall.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

6 flagged

package.jsonView file

Lines 1-26json

2 "name": "rpi-deploy",

3 "version": "0.12.0",

4 "description": "Deployment tool for Docker Compose projects on Raspberry Pi. Builds the Rust CLI from source on install.",

5 "license": "MIT",

6 "repository": {

7 "type": "git",

8 "url": "git+https://github.com/khmilevoi/rpi-deploy.git"

9 },

10 "bin": { "rpi": "bin/rpi.js" },

11 "files": [

12 "bin/",

13 "scripts/postinstall.js",

14 "scripts/check-version.js",

15 "crates/",

16 "Cargo.toml",

17 "Cargo.lock"

18 ],

19 "scripts": {

20 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L20

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L20

21 "prepublishOnly": "node scripts/check-version.js"

22 },

23 "engines": { "node": ">=18" },

24 "os": ["linux", "darwin", "win32"]

25}

bin/rpi.jsView file

Lines 1-25javascript

1#!/usr/bin/env node

2// Shim installed as the global `rpi` command: runs the native binary that

3// scripts/postinstall.js built into dist/.

4'use strict';

6const { spawnSync } = require('node:child_process');

7const fs = require('node:fs');

High

scripts/postinstall.jsView file

Lines 1-28javascript

1#!/usr/bin/env node

2// rpi-deploy postinstall: builds the rpi binary from the bundled Rust sources.

3// Only runs when installed as a package (under node_modules); a bare

4// `npm install` in a source checkout is a no-op. Never runs apt/brew/winget and

5// never checks Docker (that is `rpi agent setup`'s job). May auto-install

6// rustup when cargo is missing.

7'use strict';

9const { spawnSync } = require('node:child_process');

Lines 132-172javascript

132}

133

134// Resolve cargo deterministically: a fresh rustup install is not in PATH yet.

135function cargoCmd() {

136 const local = path.join(cargoBinDir, `cargo${exe}`);

137 return fs.existsSync(local) ? local : 'cargo';

138}

139

140function hasCargo() {

141 return which('cargo') || fs.existsSync(path.join(cargoBinDir, `cargo${exe}`));

142}

143

144async function installRustup() {

145 log('cargo not found; installing Rust via rustup (https://rustup.rs)...');

146 if (process.platform === 'win32') {

147 const arch = process.arch === 'arm64' ? 'aarch64' : 'x86_64';

148 const url = `https://win.rustup.rs/${arch}`;

149 const tmp = path.join(os.tmpdir(), 'rustup-init.exe');

150 const res = await fetch(url);

151 if (!res.ok) fail(`download ${url}: HTTP ${res.status}`);

152 fs.writeFileSync(tmp, Buffer.from(await res.arrayBuffer()));

153 const r = spawnSync(tmp, ['-y'], { stdio: 'inherit' });

154 if (r.status !== 0) fail('rustup-init failed');

155 } else {

156 if (!which('curl')) {

157 fail('curl is required to install rustup; install curl, then rerun: npm install -g rpi-deploy');

158 }

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/postinstall.jsView on unpkg · L152

159 const r = spawnSync(

160 'sh',

161 ['-c', "curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y"],

162 { stdio: 'inherit' }

163 );

164 if (r.status !== 0) fail('rustup install failed');

165 }

166 if (!hasCargo()) fail(`cargo still not found after rustup install (expected in ${cargoBinDir})`);

167}

168

169function checkCToolchain() {

170 if (process.platform === 'win32') return; // cargo reports MSVC problems; hint printed on failure

171 if (!which('cc')) {

172 if (process.platform === 'darwin') {