registry / rpi-deploy / 0.6.0

rpi-deploy@0.6.0

Deployment tool for Docker Compose projects on Raspberry Pi. Builds the Rust CLI from source on install.

Static Scan Results

scanned 6d ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessFilesystemNetwork

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 6.70 KB of source, external domains: rustup.rs, sh.rustup.rs, win.rustup.rs

Source & flagged code

6 flagged

package.jsonView file

Lines 1-26json

2 "name": "rpi-deploy",

3 "version": "0.6.0",

4 "description": "Deployment tool for Docker Compose projects on Raspberry Pi. Builds the Rust CLI from source on install.",

5 "license": "MIT",

6 "repository": {

7 "type": "git",

8 "url": "git+https://github.com/khmilevoi/rpi-deploy.git"

9 },

10 "bin": { "rpi": "bin/rpi.js" },

11 "files": [

12 "bin/",

13 "scripts/postinstall.js",

14 "scripts/check-version.js",

15 "crates/",

16 "Cargo.toml",

17 "Cargo.lock"

18 ],

19 "scripts": {

20 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L20

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L20

21 "prepublishOnly": "node scripts/check-version.js"

22 },

23 "engines": { "node": ">=18" },

24 "os": ["linux", "darwin", "win32"]

25}

bin/rpi.jsView file

Lines 1-25javascript

1#!/usr/bin/env node

2// Shim installed as the global `rpi` command: runs the native binary that

3// scripts/postinstall.js built into dist/.

4'use strict';

6const { spawnSync } = require('node:child_process');

7const fs = require('node:fs');

High

scripts/postinstall.jsView file

Lines 1-28javascript

1#!/usr/bin/env node

2// rpi-deploy postinstall: builds the rpi binary from the bundled Rust sources.

3// Only runs when installed as a package (under node_modules); a bare

4// `npm install` in a source checkout is a no-op. Never runs apt/brew/winget and

5// never checks Docker (that is `rpi agent setup`'s job). May auto-install

6// rustup when cargo is missing.

7'use strict';

9const { spawnSync } = require('node:child_process');

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/rpi.jsView file

5L6: const { spawnSync } = require('node:child_process'); L7: const fs = require('node:fs');

High

Child Process

Package source references child process execution.

bin/rpi.jsView on unpkg · L5

scripts/postinstall.jsView file

8L9: const { spawnSync } = require('node:child_process'); L10: const fs = require('node:fs'); ... L13: L14: const pkgDir = path.resolve(__dirname, '..'); L15: const exe = process.platform === 'win32' ? '.exe' : ''; L16: const cargoBinDir = path.join(os.homedir(), '.cargo', 'bin'); ... L50: async function installRustup() { L51: log('cargo not found; installing Rust via rustup (https://rustup.rs)...'); L52: if (process.platform === 'win32') { ... L57: if (!res.ok) fail(`download ${url}: HTTP ${res.status}`); L58: fs.writeFileSync(tmp, Buffer.from(await res.arrayBuffer()));

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

scripts/postinstall.jsView on unpkg · L8

High

Install Named Payload File

Install-named source file stages remote content through filesystem writes and execution.

scripts/postinstall.jsView on unpkg · L8

58fs.writeFileSync(tmp, Buffer.from(await res.arrayBuffer())); L59: const r = spawnSync(tmp, ['-y'], { stdio: 'inherit' }); L60: if (r.status !== 0) fail('rustup-init failed'); ... L62: if (!which('curl')) { L63: fail('curl is required to install rustup; install curl, then rerun: npm install -g rpi-deploy'); L64: }

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/postinstall.jsView on unpkg · L58

Findings

5 High3 Medium4 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processbin/rpi.js

HighSandbox Evasion Gated Capabilityscripts/postinstall.js

HighInstall Named Payload Filescripts/postinstall.js

HighRuntime Package Installscripts/postinstall.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowUrl Strings

Source & flagged code

6 flagged

package.jsonView file

Lines 1-26json

2 "name": "rpi-deploy",

3 "version": "0.6.0",

4 "description": "Deployment tool for Docker Compose projects on Raspberry Pi. Builds the Rust CLI from source on install.",

5 "license": "MIT",

6 "repository": {

7 "type": "git",

8 "url": "git+https://github.com/khmilevoi/rpi-deploy.git"

9 },

10 "bin": { "rpi": "bin/rpi.js" },

11 "files": [

12 "bin/",

13 "scripts/postinstall.js",

14 "scripts/check-version.js",

15 "crates/",

16 "Cargo.toml",

17 "Cargo.lock"

18 ],

19 "scripts": {

20 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L20

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L20

21 "prepublishOnly": "node scripts/check-version.js"

22 },

23 "engines": { "node": ">=18" },

24 "os": ["linux", "darwin", "win32"]

25}

bin/rpi.jsView file

Lines 1-25javascript

1#!/usr/bin/env node

2// Shim installed as the global `rpi` command: runs the native binary that

3// scripts/postinstall.js built into dist/.

4'use strict';

6const { spawnSync } = require('node:child_process');

7const fs = require('node:fs');

High

scripts/postinstall.jsView file

Lines 1-28javascript

1#!/usr/bin/env node

2// rpi-deploy postinstall: builds the rpi binary from the bundled Rust sources.

3// Only runs when installed as a package (under node_modules); a bare

4// `npm install` in a source checkout is a no-op. Never runs apt/brew/winget and

5// never checks Docker (that is `rpi agent setup`'s job). May auto-install

6// rustup when cargo is missing.

7'use strict';

9const { spawnSync } = require('node:child_process');

Lines 38-78javascript

38}

40// Resolve cargo deterministically: a fresh rustup install is not in PATH yet.

41function cargoCmd() {

42 const local = path.join(cargoBinDir, `cargo${exe}`);

43 return fs.existsSync(local) ? local : 'cargo';

44}

46function hasCargo() {

47 return which('cargo') || fs.existsSync(path.join(cargoBinDir, `cargo${exe}`));

48}

50async function installRustup() {

51 log('cargo not found; installing Rust via rustup (https://rustup.rs)...');

52 if (process.platform === 'win32') {

53 const arch = process.arch === 'arm64' ? 'aarch64' : 'x86_64';

54 const url = `https://win.rustup.rs/${arch}`;

55 const tmp = path.join(os.tmpdir(), 'rustup-init.exe');

56 const res = await fetch(url);

57 if (!res.ok) fail(`download ${url}: HTTP ${res.status}`);

58 fs.writeFileSync(tmp, Buffer.from(await res.arrayBuffer()));

59 const r = spawnSync(tmp, ['-y'], { stdio: 'inherit' });

60 if (r.status !== 0) fail('rustup-init failed');

61 } else {

62 if (!which('curl')) {

63 fail('curl is required to install rustup; install curl, then rerun: npm install -g rpi-deploy');

64 }

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/postinstall.jsView on unpkg · L58

65 const r = spawnSync(

66 'sh',

67 ['-c', "curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y"],

68 { stdio: 'inherit' }

69 );

70 if (r.status !== 0) fail('rustup install failed');

71 }

72 if (!hasCargo()) fail(`cargo still not found after rustup install (expected in ${cargoBinDir})`);

73}

75function checkCToolchain() {

76 if (process.platform === 'win32') return; // cargo reports MSVC problems; hint printed on failure

77 if (!which('cc')) {

78 if (process.platform === 'darwin') {