registry / run402 / 4.0.3

run402@4.0.3

⚠ Under review

CLI for Run402 — provision Postgres databases, deploy static sites, generate images, and manage wallets via x402 and MPP micropayments.

Static Scan Results

scanned 10h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 155 file(s), 1.68 MB of source, external domains: 127.0.0.1, api.github.com, api.run402.com, app.run402.com, docs.run402.com, eagles.kychon.com, example.com, github.com, hooks.example.com, my-receiver.example.com, myapp.run402.com, new.example.com, registry.example.test, registry.npmjs.org, rpc.moderato.tempo.xyz, run402.com, token.actions.githubusercontent.com

Source & flagged code

4 flagged

sdk/dist/scoped.jsView file

Lines 70-110javascript

70 projectId;

71 constructor(parent, projectId) {

72 this.parent = parent;

73 this.projectId = projectId;

74 }

75 publish(opts) {

76 return this.parent.apps.publish(this.projectId, opts);

77 }

78 listVersions() {

79 return this.parent.apps.listVersions(this.projectId);

80 }

81 updateVersion(versionId, opts) {

82 return this.parent.apps.updateVersion(this.projectId, versionId, opts);

83 }

84 deleteVersion(versionId) {

85 return this.parent.apps.deleteVersion(this.projectId, versionId);

86 }

87 // Pass-through.

88 browse(tags) {

89 return this.parent.apps.browse(tags);

90 }

91 fork(opts) {

92 return this.parent.apps.fork(opts);

High

Child Process

Package source references child process execution.

sdk/dist/scoped.jsView on unpkg · L90

93 }

94 getApp(versionId) {

95 return this.parent.apps.getApp(versionId);

96 }

97 upsertInstallState(input) {

98 return this.parent.apps.upsertInstallState({ ...input, project_id: input.project_id ?? this.projectId });

99 }

100 getInstallState(appKey) {

101 return this.parent.apps.getInstallState(this.projectId, appKey);

102 }

103}

104class ScopedAi {

105 parent;

106 projectId;

107 constructor(parent, projectId) {

108 this.parent = parent;

109 this.projectId = projectId;

110 }

sdk/dist/namespaces/credentials.jsView file

Lines 8-48javascript

9export class ProjectKeysCache {

10 client;

11 constructor(client) {

12 this.client = client;

13 }

14 async list() {

lib/dev.mjsView file

Lines 89-129javascript

89 });

90 }

91 if (!process.env.RUN402_SERVICE_KEY) {

92 fail({

93 code: "BAD_USAGE",

94 message: "Missing RUN402_SERVICE_KEY.",

95 hint: "Add it to .env.local. Get the service key from 'run402 projects list' or your Run402 dashboard.",

96 });

97 }

lib/ci.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = run402@3.7.0 matchedIdentity = npm:cnVuNDAy:3.7.0 similarity = 0.358 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/ci.mjsView on unpkg

Source & flagged code

4 flagged · loading source

sdk/dist/scoped.jsView file

90} L91: fork(opts) { L92: return this.parent.apps.fork(opts);

High

Child Process

Package source references child process execution.

sdk/dist/scoped.jsView on unpkg · L90

sdk/dist/namespaces/credentials.jsView file

28} L29: async import(projectId, opts) { L30: if (!this.client.credentials.saveProject) {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

sdk/dist/namespaces/credentials.jsView on unpkg · L28

lib/dev.mjsView file

109// Astro's normal output. L110: const child = spawn("npx", ["astro", "dev", "--port", port, "--host", host], { L111: stdio: "inherit",

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

lib/dev.mjsView on unpkg · L109

lib/ci.mjsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/ci.mjsView on unpkg

Findings

1 Critical3 High4 Medium4 Low

CriticalPrevious Version Dangerous Deltalib/ci.mjs

HighChild Processsdk/dist/scoped.js

HighShell

HighRuntime Package Installlib/dev.mjs

MediumDynamic Requiresdk/dist/namespaces/credentials.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

sdk/dist/scoped.jsView file

Lines 70-110javascript

70 projectId;

71 constructor(parent, projectId) {

72 this.parent = parent;

73 this.projectId = projectId;

74 }

75 publish(opts) {

76 return this.parent.apps.publish(this.projectId, opts);

77 }

78 listVersions() {

79 return this.parent.apps.listVersions(this.projectId);

80 }

81 updateVersion(versionId, opts) {

82 return this.parent.apps.updateVersion(this.projectId, versionId, opts);

83 }

84 deleteVersion(versionId) {

85 return this.parent.apps.deleteVersion(this.projectId, versionId);

86 }

87 // Pass-through.

88 browse(tags) {

89 return this.parent.apps.browse(tags);

90 }

91 fork(opts) {

92 return this.parent.apps.fork(opts);

High

Child Process

Package source references child process execution.

sdk/dist/scoped.jsView on unpkg · L90

93 }

94 getApp(versionId) {

95 return this.parent.apps.getApp(versionId);

96 }

97 upsertInstallState(input) {

98 return this.parent.apps.upsertInstallState({ ...input, project_id: input.project_id ?? this.projectId });

99 }

100 getInstallState(appKey) {

101 return this.parent.apps.getInstallState(this.projectId, appKey);

102 }

103}

104class ScopedAi {

105 parent;

106 projectId;

107 constructor(parent, projectId) {

108 this.parent = parent;

109 this.projectId = projectId;

110 }

sdk/dist/namespaces/credentials.jsView file

Lines 8-48javascript

9export class ProjectKeysCache {

10 client;

11 constructor(client) {

12 this.client = client;

13 }

14 async list() {

lib/dev.mjsView file

Lines 89-129javascript

89 });

90 }

91 if (!process.env.RUN402_SERVICE_KEY) {

92 fail({

93 code: "BAD_USAGE",

94 message: "Missing RUN402_SERVICE_KEY.",

95 hint: "Add it to .env.local. Get the service key from 'run402 projects list' or your Run402 dashboard.",

96 });

97 }

lib/ci.mjsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/ci.mjsView on unpkg