registry / rpi-deploy / 0.12.0

rpi-deploy@0.12.0

Deployment tool for Docker Compose projects on Raspberry Pi. Builds the Rust CLI from source on install.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 10.4 KB of source, external domains: github.com, rustup.rs, sh.rustup.rs, win.rustup.rs

Source & flagged code

6 flagged

package.jsonView file

Lines 1-26json

2 "name": "rpi-deploy",

3 "version": "0.12.0",

4 "description": "Deployment tool for Docker Compose projects on Raspberry Pi. Builds the Rust CLI from source on install.",

5 "license": "MIT",

6 "repository": {

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/rpi.jsView file

5L6: const { spawnSync } = require('node:child_process'); L7: const fs = require('node:fs');

High

Child Process

Package source references child process execution.

bin/rpi.jsView on unpkg · L5

scripts/postinstall.jsView file

8L9: const { spawnSync } = require('node:child_process'); L10: const fs = require('node:fs'); ... L13: L14: const pkgDir = path.resolve(__dirname, '..'); L15: const exe = process.platform === 'win32' ? '.exe' : ''; L16: const cargoBinDir = path.join(os.homedir(), '.cargo', 'bin'); ... L52: async function fetchTo(url, dest) { L53: const res = await fetch(url, { redirect: 'follow' }); L54: if (!res.ok) throw new Error(`download ${url}: HTTP ${res.status}`); L55: fs.writeFileSync(dest, Buffer.from(await res.arrayBuffer())); L56: }

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

scripts/postinstall.jsView on unpkg · L8

High

Install Named Payload File

Install-named source file stages remote content through filesystem writes and execution.

scripts/postinstall.jsView on unpkg · L8

152fs.writeFileSync(tmp, Buffer.from(await res.arrayBuffer())); L153: const r = spawnSync(tmp, ['-y'], { stdio: 'inherit' }); L154: if (r.status !== 0) fail('rustup-init failed'); ... L156: if (!which('curl')) { L157: fail('curl is required to install rustup; install curl, then rerun: npm install -g rpi-deploy'); L158: }

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/postinstall.jsView on unpkg · L152

Findings

5 High4 Medium5 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processbin/rpi.js

HighSandbox Evasion Gated Capabilityscripts/postinstall.js

HighInstall Named Payload Filescripts/postinstall.js

HighRuntime Package Installscripts/postinstall.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

bin/rpi.jsView file

Lines 1-25javascript

1#!/usr/bin/env node

2// Shim installed as the global `rpi` command: runs the native binary that

3// scripts/postinstall.js built into dist/.

4'use strict';

6const { spawnSync } = require('node:child_process');

7const fs = require('node:fs');

High

Child Process

Package source references child process execution.

bin/rpi.jsView on unpkg · L5

8const os = require('node:os');

9const path = require('node:path');

11const exe = process.platform === 'win32' ? '.exe' : '';

12const bin = path.join(__dirname, '..', 'dist', `rpi${exe}`);

14if (!fs.existsSync(bin)) {

15 console.error('rpi: binary not built; reinstall without --ignore-scripts: npm install -g rpi-deploy');

16 process.exit(1);

17}

19const r = spawnSync(bin, process.argv.slice(2), { stdio: 'inherit' });

20if (r.error) {

21 console.error(`rpi: failed to run ${bin}: ${r.error.message}`);

22 process.exit(1);

23}

24if (r.signal) {

25 // POSIX convention: terminated by signal N -> exit code 128+N.

scripts/postinstall.jsView file

Lines 1-28javascript

1#!/usr/bin/env node

2// rpi-deploy postinstall: builds the rpi binary from the bundled Rust sources.

3// Only runs when installed as a package (under node_modules); a bare

4// `npm install` in a source checkout is a no-op. Never runs apt/brew/winget and

5// never checks Docker (that is `rpi agent setup`'s job). May auto-install

6// rustup when cargo is missing.

7'use strict';

9const { spawnSync } = require('node:child_process');

10const fs = require('node:fs');

11const os = require('node:os');

12const path = require('node:path');

14const pkgDir = path.resolve(__dirname, '..');

15const exe = process.platform === 'win32' ? '.exe' : '';

16const cargoBinDir = path.join(os.homedir(), '.cargo', 'bin');

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

scripts/postinstall.jsView on unpkg · L8

High

Install Named Payload File

Install-named source file stages remote content through filesystem writes and execution.

scripts/postinstall.jsView on unpkg · L8

18const REPO = 'khmilevoi/rpi-deploy';

20// Rust target triples with prebuilt binaries on GitHub Releases, keyed by

21// `${process.platform}-${process.arch}`. Anything else builds from source.

22const TARGET_TRIPLES = {

23 'win32-x64': 'x86_64-pc-windows-msvc',

24 'linux-x64': 'x86_64-unknown-linux-musl',

25 'linux-arm64': 'aarch64-unknown-linux-musl',

26};

28function targetTriple(platform, arch) {

Lines 132-172javascript

132}

133

134// Resolve cargo deterministically: a fresh rustup install is not in PATH yet.

135function cargoCmd() {

136 const local = path.join(cargoBinDir, `cargo${exe}`);

137 return fs.existsSync(local) ? local : 'cargo';

138}