registry / sortlist-max-cli / 1.5.0

sortlist-max-cli@1.5.0

Max CLI - Command line interface for the Max lead intelligence API. Discover leads, manage subscriptions, and automate workflows from the terminal or AI agents.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 36.3 KB of source, external domains: acme.com, api.yourmax.ai, example.com, github.com, www.linkedin.com, yourmax.ai

Source & flagged code

3 flagged

dist/index.jsView file

Lines 16-100javascript

16};

17var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(

18 // If the importer is in node compatibility mode or this is not an ESM

19 // file that has been converted to a CommonJS file using a Babel-

20 // compatible transform (i.e. "__esModule" has not been set), then set

21 // "default" to the CommonJS "module.exports" for node compatibility.

22 isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,

23 mod

24));

26// src/index.ts

27var import_yargs = __toESM(require("yargs"));

28var import_helpers = require("yargs/helpers");

30// src/api.ts

31var import_node_fetch2 = __toESM(require("node-fetch"));

33// src/config.ts

34var import_fs = require("fs");

35var import_os = require("os");

36var import_path = require("path");

37var CONFIG_DIR = (0, import_path.join)((0, import_os.homedir)(), ".signals");

38var CONFIG_FILE = (0, import_path.join)(CONFIG_DIR, "config.json");

39function getConfigPath() {

40 return CONFIG_FILE;

41}

42function saveConfig(config) {

43 if (!(0, import_fs.existsSync)(CONFIG_DIR)) {

44 (0, import_fs.mkdirSync)(CONFIG_DIR, { recursive: true, mode: 448 });

45 }

46 (0, import_fs.writeFileSync)(CONFIG_FILE, JSON.stringify(config, null, 2) + "\n", { mode: 384 });

47}

48function loadSavedConfig() {

49 if (!(0, import_fs.existsSync)(CONFIG_FILE)) return null;

50 try {

51 const data = JSON.parse((0, import_fs.readFileSync)(CONFIG_FILE, "utf-8"));

52 const config = {};

53 if (typeof data.apiKey === "string") config.apiKey = data.apiKey;

54 if (typeof data.accessToken === "string") config.accessToken = data.accessToken;

55 if (typeof data.refreshToken === "string") config.refreshToken = data.refreshToken;

56 if (typeof data.expiresAt === "number") config.expiresAt = data.expiresAt;

57 if (typeof data.tokenType === "string") config.tokenType = data.tokenType;

58 if (config.apiKey || config.accessToken) return config;

59 } catch {

60 }

61 return null;

62}

63function clearConfig() {

64 if ((0, import_fs.existsSync)(CONFIG_FILE)) {

65 (0, import_fs.unlinkSync)(CONFIG_FILE);

66 return true;

67 }

68 return false;

69}

70function getConfig() {

71 const envKey = process.env.SIGNALS_API_KEY;

72 if (envKey) return { apiKey: envKey };

73 const saved = loadSavedConfig();

74 if (saved) return saved;

75 console.error("Error: Not authenticated.");

76 console.error('Run "max login" to connect, or set SIGNALS_API_KEY in your environment.');

77 process.exit(1);

78}

80// src/oauth.ts

81var import_child_process = require("child_process");

82var import_node_fetch = __toESM(require("node-fetch"));

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L36

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L80

83var DEVICE_CODE_GRANT = "urn:ietf:params:oauth:grant-type:device_code";

84function oauthBaseUrl() {

85 return (process.env.SIGNALS_OAUTH_URL || "https://yourmax.ai").replace(/\/$/, "");

86}

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L70

87function clientId() {

88 return process.env.SIGNALS_CLI_CLIENT_ID || "signals-cli";

89}

90async function parseJson(response) {

91 const text = await response.text();

92 try {

93 return text ? JSON.parse(text) : {};

94 } catch {

95 return { error: "invalid_response", error_description: text };

96 }

97}

98function toTokenSet(json) {

99 return {

100 accessToken: json.access_token,

Source & flagged code

3 flagged · loading source

dist/index.jsView file

80// src/oauth.ts L81: var import_child_process = require("child_process"); L82: var import_node_fetch = __toESM(require("node-fetch"));

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L80

70function getConfig() { L71: const envKey = process.env.SIGNALS_API_KEY; L72: if (envKey) return { apiKey: envKey }; ... L80: // src/oauth.ts L81: var import_child_process = require("child_process"); L82: var import_node_fetch = __toESM(require("node-fetch")); ... L84: function oauthBaseUrl() { L85: return (process.env.SIGNALS_OAUTH_URL || "https://yourmax.ai").replace(/\/$/, ""); L86: }

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L70

36var import_path = require("path"); L37: var CONFIG_DIR = (0, import_path.join)((0, import_os.homedir)(), ".signals"); L38: var CONFIG_FILE = (0, import_path.join)(CONFIG_DIR, "config.json"); ... L50: try { L51: const data = JSON.parse((0, import_fs.readFileSync)(CONFIG_FILE, "utf-8")); L52: const config = {}; ... L70: function getConfig() { L71: const envKey = process.env.SIGNALS_API_KEY; L72: if (envKey) return { apiKey: envKey }; ... L80: // src/oauth.ts L81: var import_child_process = require("child_process"); L82: var import_node_fetch = __toESM(require("node-fetch"));

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L36

Findings

3 High3 Medium5 Low

HighChild Processdist/index.js

HighSame File Env Network Executiondist/index.js

HighSandbox Evasion Gated Capabilitydist/index.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

dist/index.jsView file

Lines 16-100javascript

16};

17var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(

18 // If the importer is in node compatibility mode or this is not an ESM

19 // file that has been converted to a CommonJS file using a Babel-

20 // compatible transform (i.e. "__esModule" has not been set), then set

21 // "default" to the CommonJS "module.exports" for node compatibility.

22 isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,

23 mod

24));

26// src/index.ts

27var import_yargs = __toESM(require("yargs"));

28var import_helpers = require("yargs/helpers");

30// src/api.ts

31var import_node_fetch2 = __toESM(require("node-fetch"));

33// src/config.ts

34var import_fs = require("fs");

35var import_os = require("os");

36var import_path = require("path");

37var CONFIG_DIR = (0, import_path.join)((0, import_os.homedir)(), ".signals");

38var CONFIG_FILE = (0, import_path.join)(CONFIG_DIR, "config.json");

39function getConfigPath() {

40 return CONFIG_FILE;

41}

42function saveConfig(config) {

43 if (!(0, import_fs.existsSync)(CONFIG_DIR)) {

44 (0, import_fs.mkdirSync)(CONFIG_DIR, { recursive: true, mode: 448 });

45 }

46 (0, import_fs.writeFileSync)(CONFIG_FILE, JSON.stringify(config, null, 2) + "\n", { mode: 384 });

47}

48function loadSavedConfig() {

49 if (!(0, import_fs.existsSync)(CONFIG_FILE)) return null;

50 try {

51 const data = JSON.parse((0, import_fs.readFileSync)(CONFIG_FILE, "utf-8"));

52 const config = {};

53 if (typeof data.apiKey === "string") config.apiKey = data.apiKey;

54 if (typeof data.accessToken === "string") config.accessToken = data.accessToken;

55 if (typeof data.refreshToken === "string") config.refreshToken = data.refreshToken;

56 if (typeof data.expiresAt === "number") config.expiresAt = data.expiresAt;

57 if (typeof data.tokenType === "string") config.tokenType = data.tokenType;

58 if (config.apiKey || config.accessToken) return config;

59 } catch {

60 }

61 return null;

62}

63function clearConfig() {

64 if ((0, import_fs.existsSync)(CONFIG_FILE)) {

65 (0, import_fs.unlinkSync)(CONFIG_FILE);

66 return true;

67 }

68 return false;

69}

70function getConfig() {

71 const envKey = process.env.SIGNALS_API_KEY;

72 if (envKey) return { apiKey: envKey };

73 const saved = loadSavedConfig();

74 if (saved) return saved;

75 console.error("Error: Not authenticated.");

76 console.error('Run "max login" to connect, or set SIGNALS_API_KEY in your environment.');

77 process.exit(1);

78}

80// src/oauth.ts

81var import_child_process = require("child_process");

82var import_node_fetch = __toESM(require("node-fetch"));

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L36

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L80

83var DEVICE_CODE_GRANT = "urn:ietf:params:oauth:grant-type:device_code";

84function oauthBaseUrl() {

85 return (process.env.SIGNALS_OAUTH_URL || "https://yourmax.ai").replace(/\/$/, "");

86}

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L70

87function clientId() {

88 return process.env.SIGNALS_CLI_CLIENT_ID || "signals-cli";

89}

90async function parseJson(response) {

91 const text = await response.text();

92 try {

93 return text ? JSON.parse(text) : {};

94 } catch {

95 return { error: "invalid_response", error_description: text };

96 }

97}

98function toTokenSet(json) {

99 return {

100 accessToken: json.access_token,