registry  /  scoutpost-cli  /  0.1.8

scoutpost-cli@0.1.8

Scout — the CLI for Scoutpost (scoutpost.ai), AI-powered local news monitoring. Ships the native deno-compiled `scout` binary via npm.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessFilesystemNetworkShell
Supply chain
UrlStrings
Manifest
NoLicense
scanned 4 file(s), 12.7 KB of source, external domains: github.com

Source & flagged code

4 flagged · loading source
package.jsonView file
•scripts.postinstall = node scripts/postinstall.js
High
Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg
•scripts.postinstall = node scripts/postinstall.js
Medium
Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg
bin/scout.jsView file
11L12: import { spawn } from "node:child_process"; L13: import { accessSync, chmodSync, constants, existsSync } from "node:fs";
High
Child Process

Package source references child process execution.

bin/scout.jsView on unpkg · L11
4// L5: // `npm i -g scoutpost-cli` puts this file on PATH as `scout` (via the package's L6: // `bin` field). It locates the native `deno compile` binary for the current ... L11: L12: import { spawn } from "node:child_process"; L13: import { accessSync, chmodSync, constants, existsSync } from "node:fs";
High
Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/scout.jsView on unpkg · L4

Findings

4 High3 Medium4 Low
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processbin/scout.js
HighShell
HighRuntime Package Installbin/scout.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowUrl Strings
LowNo License