registry / sankofa-cli / 0.1.13

sankofa-cli@0.1.13

Sankofa CLI — one command to scaffold, ship, and verify Sankofa across Flutter, React Native, Web, iOS, and Android. Includes Sankofa Deploy (OTA patches), keys, doctor, release, and patch flows.

Static Scan Results

scanned 8m ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 54 file(s), 595 KB of source, external domains: adoptium.net, api.sankofa.dev, appstoreconnect.apple.com, cdn.jsdelivr.net, console.cloud.google.com, developer.android.com, download.sankofa.dev, github.com, play.google.com, registry.npmjs.org, sankofa.dev, support.sankofa.dev, www.apple.com, www.googleapis.com

Source & flagged code

3 flagged

dist/utils/nativeManifest.jsView file

Lines 1-21javascript

1import { execFileSync, execSync } from 'node:child_process';

2import fs from 'node:fs';

High

Child Process

Package source references child process execution.

dist/utils/nativeManifest.jsView on unpkg · L1

3import os from 'node:os';

4import path from 'node:path';

5export function buildDSymManifest(opts) {

6 const binaryPath = resolveDSymBinary(opts.dsymPath);

7 if (!binaryPath) {

8 throw new Error(`no Mach-O binary found under ${opts.dsymPath} — expected ${opts.dsymPath}/Contents/Resources/DWARF/<name>`);

9 }

10 const { uuid, arch } = readMachOIdentity(binaryPath, opts.arch);

11 const symbols = runNMSymbols(binaryPath, arch);

12 const wantLine = opts.withLineInfo !== false;

13 const stats = wantLine

14 ? augmentWithLineInfo(binaryPath, symbols, { machO: true, arch })

15 : { enabled: false, tool: null, covered: 0, total: symbols.length };

16 const manifest = {

17 version: 1,

18 debug_id: normaliseDebugId(uuid),

19 arch,

20 symbols,

21 };

dist/utils/bundler.jsView file

Lines 719-759javascript

719 }

720 execSync(`xcrun simctl spawn ${shellQuote(device)} defaults write ${shellQuote(appId)} sankofa_deploy_bundle_path -string ${shellQuote(seededBundlePath)}`);

721 execSync(`xcrun simctl spawn ${shellQuote(device)} defaults write ${shellQuote(appId)

tools/sankofa_extract.aotView file

•path = tools/sankofa_extract.aot kind = native_binary sizeBytes = 3157680 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

tools/sankofa_extract.aotView on unpkg

Source & flagged code

3 flagged · loading source

dist/utils/nativeManifest.jsView file

1import { execFileSync, execSync } from 'node:child_process'; L2: import fs from 'node:fs';

High

Child Process

Package source references child process execution.

dist/utils/nativeManifest.jsView on unpkg · L1

dist/utils/bundler.jsView file

739if (isExpo) { L740: execSync(`npx expo run:ios --configuration Release`, { stdio: 'inherit', env: buildEnv.env }); L741: }

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/utils/bundler.jsView on unpkg · L739

tools/sankofa_extract.aotView file

•path = tools/sankofa_extract.aot kind = native_binary sizeBytes = 3157680 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

tools/sankofa_extract.aotView on unpkg

Findings

3 High4 Medium5 Low

HighChild Processdist/utils/nativeManifest.js

HighShell

HighRuntime Package Installdist/utils/bundler.js

MediumNetwork

MediumEnvironment Vars

MediumShips Native Binarytools/sankofa_extract.aot

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

dist/utils/nativeManifest.jsView file

Lines 1-21javascript

1import { execFileSync, execSync } from 'node:child_process';

2import fs from 'node:fs';

High

Child Process

Package source references child process execution.

dist/utils/nativeManifest.jsView on unpkg · L1

3import os from 'node:os';

4import path from 'node:path';

5export function buildDSymManifest(opts) {

6 const binaryPath = resolveDSymBinary(opts.dsymPath);

7 if (!binaryPath) {

8 throw new Error(`no Mach-O binary found under ${opts.dsymPath} — expected ${opts.dsymPath}/Contents/Resources/DWARF/<name>`);

9 }

10 const { uuid, arch } = readMachOIdentity(binaryPath, opts.arch);

11 const symbols = runNMSymbols(binaryPath, arch);

12 const wantLine = opts.withLineInfo !== false;

13 const stats = wantLine

14 ? augmentWithLineInfo(binaryPath, symbols, { machO: true, arch })

15 : { enabled: false, tool: null, covered: 0, total: symbols.length };

16 const manifest = {

17 version: 1,

18 debug_id: normaliseDebugId(uuid),

19 arch,

20 symbols,

21 };

dist/utils/bundler.jsView file

Lines 719-759javascript

719 }

720 execSync(`xcrun simctl spawn ${shellQuote(device)} defaults write ${shellQuote(appId)} sankofa_deploy_bundle_path -string ${shellQuote(seededBundlePath)}`);

721 execSync(`xcrun simctl spawn ${shellQuote(device)} defaults write ${shellQuote(appId)

tools/sankofa_extract.aotView file

•path = tools/sankofa_extract.aot kind = native_binary sizeBytes = 3157680 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

tools/sankofa_extract.aotView on unpkg