registry / run402 / 3.7.3

run402@3.7.3

⚠ Under review

CLI for Run402 — provision Postgres databases, deploy static sites, generate images, and manage wallets via x402 and MPP micropayments.

Static Scan Results

scanned 3d ago · by rust-scanner

Static analysis flagged 12 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 139 file(s), 1.45 MB of source, external domains: 127.0.0.1, api.github.com, api.run402.com, app.run402.com, docs.run402.com, eagles.kychon.com, example.com, hooks.example.com, my-receiver.example.com, myapp.run402.com, new.example.com, rpc.moderato.tempo.xyz, run402.com, token.actions.githubusercontent.com

Source & flagged code

4 flagged

sdk/dist/scoped.jsView file

Lines 70-110javascript

70 projectId;

71 constructor(parent, projectId) {

72 this.parent = parent;

73 this.projectId = projectId;

74 }

75 publish(opts) {

76 return this.parent.apps.publish(this.projectId, opts);

77 }

78 listVersions() {

79 return this.parent.apps.listVersions(this.projectId);

80 }

81 updateVersion(versionId, opts) {

82 return this.parent.apps.updateVersion(this.projectId, versionId, opts);

83 }

84 deleteVersion(versionId) {

85 return this.parent.apps.deleteVersion(this.projectId, versionId);

86 }

87 // Pass-through.

88 browse(tags) {

89 return this.parent.apps.browse(tags);

90 }

91 fork(opts) {

92 return this.parent.apps.fork(opts);

High

Child Process

Package source references child process execution.

sdk/dist/scoped.jsView on unpkg · L90

93 }

94 getApp(versionId) {

95 return this.parent.apps.getApp(versionId);

96 }

97}

98class ScopedAi {

99 parent;

100 projectId;

101 constructor(parent, projectId) {

102 this.parent = parent;

103 this.projectId = projectId;

104 }

105 translate(opts) {

106 return this.parent.ai.translate(this.projectId, opts);

107 }

108 moderate(text) {

109 return this.parent.ai.moderate(this.projectId, text);

110 }

•matchType = previous_version_dangerous_delta matchedPackage = run402@3.7.0 matchedIdentity = npm:cnVuNDAy:3.7.0 similarity = 0.917 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

sdk/dist/scoped.jsView on unpkg

sdk/dist/node/_paid-stack.jsView file

Lines 37-77javascript

37 try {

38 return await load();

39 }

40 catch (err) {

41 if (isModuleNotFound(err))

42 this.missing.add(pkg);

43 else

lib/dev.mjsView file

Lines 89-129javascript

89 });

90 }

91 if (!process.env.RUN402_SERVICE_KEY) {

92 fail({

93 code: "BAD_USAGE",

94 message: "Missing RUN402_SERVICE_KEY.",

95 hint: "Add it to .env.local. Get the service key from 'run402 projects list' or your Run402 dashboard.",

96 });

97 }

Source & flagged code

4 flagged · loading source

sdk/dist/scoped.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

sdk/dist/scoped.jsView on unpkg

90} L91: fork(opts) { L92: return this.parent.apps.fork(opts);

High

Child Process

Package source references child process execution.

sdk/dist/scoped.jsView on unpkg · L90

sdk/dist/node/_paid-stack.jsView file

57const c = new LoadCollector(); L58: const accounts = await c.load("viem", () => import("viem/accounts")); L59: const viemMod = await c.load("viem", () => import("viem"));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

sdk/dist/node/_paid-stack.jsView on unpkg · L57

lib/dev.mjsView file

109// Astro's normal output. L110: const child = spawn("npx", ["astro", "dev", "--port", port, "--host", host], { L111: stdio: "inherit",

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

lib/dev.mjsView on unpkg · L109

Findings

1 Critical3 High4 Medium4 Low

CriticalPrevious Version Dangerous Deltasdk/dist/scoped.js

HighChild Processsdk/dist/scoped.js

HighShell

HighRuntime Package Installlib/dev.mjs

MediumDynamic Requiresdk/dist/node/_paid-stack.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

sdk/dist/scoped.jsView file

Lines 70-110javascript

70 projectId;

71 constructor(parent, projectId) {

72 this.parent = parent;

73 this.projectId = projectId;

74 }

75 publish(opts) {

76 return this.parent.apps.publish(this.projectId, opts);

77 }

78 listVersions() {

79 return this.parent.apps.listVersions(this.projectId);

80 }

81 updateVersion(versionId, opts) {

82 return this.parent.apps.updateVersion(this.projectId, versionId, opts);

83 }

84 deleteVersion(versionId) {

85 return this.parent.apps.deleteVersion(this.projectId, versionId);

86 }

87 // Pass-through.

88 browse(tags) {

89 return this.parent.apps.browse(tags);

90 }

91 fork(opts) {

92 return this.parent.apps.fork(opts);

High

Child Process

Package source references child process execution.

sdk/dist/scoped.jsView on unpkg · L90

93 }

94 getApp(versionId) {

95 return this.parent.apps.getApp(versionId);

96 }

97}

98class ScopedAi {

99 parent;

100 projectId;

101 constructor(parent, projectId) {

102 this.parent = parent;

103 this.projectId = projectId;

104 }

105 translate(opts) {

106 return this.parent.ai.translate(this.projectId, opts);

107 }

108 moderate(text) {

109 return this.parent.ai.moderate(this.projectId, text);

110 }

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

sdk/dist/scoped.jsView on unpkg

sdk/dist/node/_paid-stack.jsView file

Lines 37-77javascript

37 try {

38 return await load();

39 }

40 catch (err) {

41 if (isModuleNotFound(err))

42 this.missing.add(pkg);

43 else

lib/dev.mjsView file

Lines 89-129javascript

89 });

90 }

91 if (!process.env.RUN402_SERVICE_KEY) {

92 fail({

93 code: "BAD_USAGE",

94 message: "Missing RUN402_SERVICE_KEY.",

95 hint: "Add it to .env.local. Get the service key from 'run402 projects list' or your Run402 dashboard.",

96 });

97 }