registry / sankofa-cli / 0.1.20

sankofa-cli@0.1.20

Sankofa CLI — one command to scaffold, ship, and verify Sankofa across Flutter, React Native, Web, iOS, and Android. Includes Sankofa Deploy (OTA patches), keys, doctor, release, and patch flows.

AI Security Review

scanned 4h ago · by lpm-firewall-ai

The package provides an OTA/dynamic-module capability that can execute a module supplied by URI or bytes in a Sankofa-enabled downstream Flutter app. CLI setup and patch operations are explicitly user-invoked; no unconsented install-time attack was found.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs `sankofa init --deploy` or patch/release workflows; downstream app later loads a dynamic module.

Impact

A compromised or maliciously controlled update/module source could run code in enrolled downstream apps or tooling contexts.

Mechanism

OTA dynamic-module loading plus downloaded executable tooling.

Rationale

The shipped dynamic-module and executable-tooling paths are dangerous dual-use capabilities, warranting a warning. Their activation is package-aligned and explicit, and no covert malicious chain was confirmed.

Evidence

package.jsondist/index.jsdist/commands/init.jsdist/utils/flutterPatchDiff.jsdist/utils/flutterAutoDiffCompile.jstools/dynamic_modules/lib/dynamic_modules.dart.sankofa.jsonsankofa.yaml.sankofa/dynamic_modules~/.sankofa~/.sankofa/flutter

Network endpoints3

api.sankofa.dev

sankofa-cli@0.1.20

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code