registry / starbridge-cli / 1.1.1

starbridge-cli@1.1.1

StarBridge CLI tool for autonomous deployments

AI Security Review

scanned 2d ago · by lpm-firewall-ai

The package is a user-invoked CLI that bootstraps and runs a StarBridge server by downloading source from GitHub and executing package-manager/build commands. This creates remote-code-execution supply-chain risk but no confirmed malicious payload in the inspected npm package.

Static reason

One or more suspicious static signals were detected.

Trigger

User runs starbridge start or starbridge setup; deploy/log commands contact the configured StarBridge API.

Impact

Remote GitHub content can be installed, built, and executed on the user's machine under explicit CLI commands.

Mechanism

runtime GitHub source download and local command execution

Rationale

This is not clean because the CLI executes remotely downloaded source and package-manager commands at runtime. It is not malicious under the policy because activation is explicit user command behavior, with no lifecycle hook abuse, credential exfiltration, destructive action, or foreign AI-agent control mutation found.

Evidence

package.jsondist/index.js~/.starbridge/server-source~/.starbridge/release.json~/.starbridge/server-source/.env~/.starbridge/config.json<server-source>/node_modules<server-source>/dev.db

Network endpoints4

api.github.com/repos/RickyFirmansyah27/star-brigde-agent/releases/latestgithub.com/RickyFirmansyah27/star-brigde-agent/archive/refs/heads/main.tar.gzlocalhost:3000127.0.0.1:<port>

Decision evidence

public snapshot

AI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

dist/index.js downloads GitHub release/main tarball for RickyFirmansyah27/star-brigde-agent into ~/.starbridge/server-source.
dist/index.js extracts the downloaded tarball, replacing the cached server source directory.
dist/index.js runs npm install, npm run setup, npx turbo build/dev, npx prisma/tsx, and node scripts/start.js in the downloaded/project server tree.
dist/index.js setup prompts for GitHub/Trigger secrets and writes them to the server .env file.

Evidence against

package.json has no preinstall/install/postinstall lifecycle hooks; bin is user-invoked starbridge CLI only.
No hardcoded credential theft or outbound exfiltration flow found; deploy/log requests use configured endpoint token for documented CLI actions.
Network use is GitHub source download plus localhost/configured StarBridge API calls aligned with an autonomous deployment CLI.
No foreign AI-agent control surface mutation, persistence, destructive filesystem behavior, eval/vm, or native binary loading found.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

MinifiedUrlStrings

Manifest

NoLicense

scanned 1 file(s), 15.5 KB of source, external domains: 127.0.0.1, api.github.com, github.com

Source & flagged code

4 flagged

dist/index.jsView file

Lines 1-19javascript

1#!/usr/bin/env node

2"use strict";var me=Object.create;var M=Object.defineProperty;var he=Object.getOwnPropertyDescriptor;var ye=Object.getOwnPropertyNames;var Se=Object.getPrototypeOf,be=Object.prototype.hasOwnProperty;var Ee=(t,e,o,s)=>{if(e&&typeof e=="object"||typeof e=="function")for(let n of ye(e))!be.call(t,n)&&n!==o&&M(t,n,{get:()=>e[n],enumerable:!(s=he(e,n))||s.enumerable});return t};var l=(t,e,o)=>(o=t!=null?me(Se(t)):{},Ee(e||!t||!t.__esModule?M(o,"default",{value:t,enumerable:!0}):o,t));var ge=require("commander"),pe=l(require("fs")),ue=l(require("path"));var E=require("child_process"),y=l(require("pa ...

3`),{padding:{top:1,bottom:1,left:2,right:2},borderColor:"cyan",borderStyle:"round"})}function g(t,e){return t==="running"?p.default.green(` \u25CF ${e}`):t==="error"?p.default.red(` \u2716 ${e}`):p.default.yellow(` \u25D0 ${e}`)}async function ee(t){console.clear();try{await N(g)}catch(r){console.error(g("error","Failed to fetch server source: "+(r instanceof Error?r.message:String(r)))),process.exit(1)}let e=D();console.log(""),_e(ve(e)),console.log(""),console.log(Ie(t,e)),console.log("");let o=h.existsSync(y.join(e,"scripts","start.js")),s=y.join(e,".env");if(h.existsSync(s)||(console.lo ...

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L1

4`))),o){let r=y.join(e,"dev.db");if(!h.existsSync(r)){console.log(g("pending","Database not found. Running auto-setup..."));try{(0,E.execSync)("npx prisma db push",{cwd:y.join(e,"packages","db"),stdio:"inherit"}),(0,E.execSync)("npx tsx seed.ts",{cwd:y.join(e,"packages","db"),stdio:

5`),{padding:{top:1,bottom:1,left:2,right:2},borderColor:"cyan",borderStyle:"round"}))}async function se(){try{await N(te)}catch(r){console.error(te("error","Failed to fetch server source: "+(r instanceof Error?r.message:String(r)))),process.exit(1)}let t=D(),e=G.join(t,".env"),o=xe(),s="SQLite (local)",n=t;console.clear(),De("1.0.1",o,s,n),console.log("");let d={};v.existsSync(e)&&(console.log(u.default.gray(` Existing configuration found. Loading values...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L1

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L1

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L3

6`)),v.readFileSync(e,"utf8").split(`

7`).forEach(c=>{if(c.startsWith("#")||!c.includes("="))return;let f=c.indexOf("=");if(f===-1)return;let w=c.substring(0,f).trim(),fe=c.substring(f+1).trim().replace(/^["']|["']$/g,"");d[w]=fe}));let i=await oe.default.prompt([{type:"input",name:"GITHUB_CLIENT_ID",message:"GitHub OAuth Client ID:",default:"",validate:r=>r.length>0||"Required"},{type:"password",name:"GITHUB_CLIENT_SECRET",message:"GitHub OAuth Client Secret:",default:"",mask:"*",validate:r=>r.length>0||"Required"},{type:"input",name:"DATABASE_URL",message:"SQLite Database Path:",default:"file:./dev.db"},{type:"input",name:"BASE_D ...

8`);v.writeFileSync(e,R,"utf8"),console.log(""),console.log(u.default.green(u.default.bold(" Configuration saved!"))),console.log(u.default.gray(" Path: "+e)),console.log(""),console.log(u.default.cyan(" Run ")+u.default.bold("starbridge start")+u.default.cyan(" to launch the server."))}var S=l(require("picocolors"));var U=l(require("fs")),F=l(require("path")),ae=l(require("os")),$e=F.default.join(ae.default.homedir(),".starbridge"),ie=F.default.join($e,"config.json");function ce(){try{if(U.default.existsSync(ie)){let t=U.default.readFileSync(ie,"utf8");return JSON.parse(t)}}catch(t){conso ...

9Triggering deployment for project: ${s}...`));try{let n=await fetch(`${o}/api/projects/${s}/deploy`,{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${e}`},body:JSON.stringify({branch:t.branch})});if(!n.ok){let i=await n.json().catch(()=>null);throw new Error(i?.error||`Server responded with ${n.status}`)}let d=await n.json();console.log(S.default.green(`

10\u2714 Deployment triggered successfully!`)),console.log(`Deployment ID: ${S.default.bold(d.deployment.id)}`),console.log(`Status: ${S.default.yellow(d.deployment.status)}`),d.warning&&console.log(S.default.yellow(`

11\u26A0 Warning: ${d.warning}`)),console.log(S.default.gray(`

12To view logs in real-time, run:`)),console.log(`starbridge logs ${d.deployment.id}`)}catch(n){console.error(S.default.red(`

13\u2716 Deployment failed: ${n.message}`)),process.exit(1)}}var I=l(require("picocolors"));async function de(t){let e=k(),o=A();e||(console.error(I.default.red("\u2716 You are not logged in. Run `starbridge login` first.")),process.exit(1)),console.log(I.default.cyan(`

14Connecting to deployment log stream for ${t}...`));try{let s=await fetch(`${o}/api/deployments/${t}/logs`,{method:"GET",headers:{Authorization:`Bearer ${e}`,Accept:"text/event-stream"}});if(!s.ok){let m=await s.json().catch(()=>null);throw new Error(m?.error||`Server responded with ${s.status}`)}if(!s.body)throw new Error("No response body returned from server.");console.log(I.default.green(`\u2714 Connected. Streaming logs:

15`));let n=s.body.getReader(),d=new TextDecoder("utf-8"),i="";for(;;){let{done:m,value:R}=await n.read();if(m)break;i+=d.decode(R,{stream:!0});let r=i.split(`

16`);i=r.pop()||"";for(let c of r){let f=c.trim();if(!(!f||f.startsWith(":"))&&f.startsWith("data:"))try{let w=JSON.parse(f.substring(5).trim());console.log(w.message)}catch{console.log(f.substring(5).trim())}}}console.log(I.default.cyan(`

17\u2714 Log stream closed.`))}catch(s){console.error(I.default.red(`

18\u2716 Failed to stream logs: ${s.message}`)),process.exit(1)}}function Ce(){try{return JSON.parse(pe.readFileSync(ue.join(__dirname,"..","package.json"),"utf8")).version||"1.0.0"}catch{return"1.0.0"}}var x=new ge.Command;x.name("starbridge").description("StarBridge \u2014 Autonomous Deployment Platform for Solo Devs & Startups").version(Ce());x.command("start").description("Start StarBridge server and open dashboard").option("-p, --port <number>","Port number","3000").option("--no-open","Do not open browser automatically").action(ee);x.command("setup").description("Interactive setup wizard fo ...

Long lines were clipped for display.

Source & flagged code

4 flagged · loading source

dist/index.jsView file

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L1

1#!/usr/bin/env node L2: "use strict";var me=Object.create;var M=Object.defineProperty;var he=Object.getOwnPropertyDescriptor;var ye=Object.getOwnPropertyNames;var Se=Object.getPrototypeOf,be=Object.protot... L3: `),{padding:{top:1,bottom:1,left:2,right:2},borderColor:"cyan",borderStyle:"round"})}function g(t,e){return t==="running"?p.default.green(` \u25CF ${e}`):t==="error"?p.default.red... L4: `))),o){let r=y.join(e,"dev.db");if(!h.existsSync(r)){console.log(g("pending","Database not found. Running auto-setup..."));try{(0,E.execSync)("npx prisma db push",{cwd:y.join(e,"p... L5: `),{padding:{top:1,bottom:1,left:2,right:2},borderColor:"cyan",borderStyle:"round"}))}async function se(){try{await N(te)}catch(r){console.error(te("error","Failed to fetch server ...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L1

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L1

3`),{padding:{top:1,bottom:1,left:2,right:2},borderColor:"cyan",borderStyle:"round"})}function g(t,e){return t==="running"?p.default.green(` \u25CF ${e}`):t==="error"?p.default.red... L4: `))),o){let r=y.join(e,"dev.db");if(!h.existsSync(r)){console.log(g("pending","Database not found. Running auto-setup..."));try{(0,E.execSync)("npx prisma db push",{cwd:y.join(e,"p... L5: `),{padding:{top:1,bottom:1,left:2,right:2},borderColor:"cyan",borderStyle:"round"}))}async function se(){try{await N(te)}catch(r){console.error(te("error","Failed to fetch server ...

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L3

Findings

4 High2 Medium4 Low

HighChild Processdist/index.js

HighSame File Env Network Executiondist/index.js

HighCommand Output Exfiltrationdist/index.js

HighRuntime Package Installdist/index.js

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowFilesystem

LowUrl Strings

LowNo License

Source & flagged code

4 flagged

dist/index.jsView file

Lines 1-19javascript

1#!/usr/bin/env node

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L1

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L1

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L1

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L3

6`)),v.readFileSync(e,"utf8").split(`

11\u26A0 Warning: ${d.warning}`)),console.log(S.default.gray(`

12To view logs in real-time, run:`)),console.log(`starbridge logs ${d.deployment.id}`)}catch(n){console.error(S.default.red(`

15`));let n=s.body.getReader(),d=new TextDecoder("utf-8"),i="";for(;;){let{done:m,value:R}=await n.read();if(m)break;i+=d.decode(R,{stream:!0});let r=i.split(`

17\u2714 Log stream closed.`))}catch(s){console.error(I.default.red(`

Long lines were clipped for display.