registry / starbridge-cli / 1.2.1

starbridge-cli@1.2.1

StarBridge CLI tool for autonomous deployments

Static Scan Results

scanned 2d ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

MinifiedUrlStrings

Manifest

NoLicense

scanned 1 file(s), 14.5 KB of source, external domains: 127.0.0.1

Source & flagged code

6 flagged

dist/index.jsView file

Lines 1-19javascript

1#!/usr/bin/env node

2"use strict";var de=Object.create;var L=Object.defineProperty;var ge=Object.getOwnPropertyDescriptor;var ue=Object.getOwnPropertyNames;var fe=Object.getPrototypeOf,me=Object.prototype.hasOwnProperty;var Se=(e,o,t,n)=>{if(o&&typeof o=="object"||typeof o=="function")for(let s of ue(o))!me.call(e,s)&&s!==t&&L(e,s,{get:()=>o[s],enumerable:!(n=ge(o,s))||n.enumerable});return e};var i=(e,o,t)=>(t=e!=null?de(fe(e)):{},Se(o||!e||!e.__esModule?L(t,"default",{value:e,enumerable:!0}):t,e));var ie=require("commander"),ae=i(require("fs")),ce=i(require("path"));var v=require("child_process"),h=i(require("pa ...

3`),{padding:{top:1,bottom:1,left:2,right:2},borderColor:"cyan",borderStyle:"round"})}function l(e,o){return e==="running"?p.default.green(` \u25CF ${o}`):e==="error"?p.default.red(` \u2716 ${o}`):p.default.yellow(` \u25D0 ${o}`)}async function Y(e){console.clear();try{await $(l)}catch(d){console.error(l("error","Failed to fetch server source: "+(d instanceof Error?d.message:String(d)))),process.exit(1)}let o=D();console.log(""),Te(be(o)),console.log(""),console.log(xe(e,o)),console.log("");let t=y.existsSync(h.join(o,"start.js")),n=h.join(o,".env");if(y.existsSync(n)||(console.log(p.default ...

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L1

4`))),t){let d=h.join(o,"dev.db");if(!y.existsSync(d)){console.log(l("pending","Database not found. Running auto-setup..."));try{(0,v.execSync)("npx prisma db push",{cwd:h.join(o,"packages","db"),stdio:"inherit"}),(0,v.execSync)("npx tsx seed.ts",{cwd:h.join(o,"packages","db"),stdio:"inherit"}),console.log

5`),{padding:{top:1,bottom:1,left:2,right:2},borderColor:"cyan",borderStyle:"round"}))}async function ee(e){try{await $(q,e?.tarball)}catch(r){console.error(q("error","Failed to fetch server source: "+(r instanceof Error?r.message:String(r)))),process.exit(1)}let o=D(),t=k.join(o,".env"),n=we(),s="SQLite (local)",c=o;console.clear(),Ie("1.0.1",n,s,c),console.log("");let u={};R.existsSync(t)&&(console.log(g.default.gray(` Existing configuration found. Loading values...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L1

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L1

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L3

6`)),R.readFileSync(t,"utf8").split(`

7`).forEach(f=>{if(f.startsWith("#")||!f.includes("="))return;let b=f.indexOf("=");if(b===-1)return;let le=f.substring(0,b).trim(),pe=f.substring(b+1).trim().replace(/^["']|["']$/g,"");u[le]=pe}));let m=await Q.default.prompt([{type:"input",name:"GITHUB_CLIENT_ID",message:"GitHub OAuth Client ID:",default:"",validate:r=>r.length>0||"Required"},{type:"password",name:"GITHUB_CLIENT_SECRET",message:"GitHub OAuth Client Secret:",default:"",mask:"*",validate:r=>r.length>0||"Required"},{type:"input",name:"DATABASE_URL",message:"SQLite Database Path:",default:"file:./dev.db"},{type:"input",name:"BASE_ ...

8`);R.writeFileSync(t,d,"utf8"),console.log(""),console.log(g.default.green(g.default.bold(" Configuration saved!"))),console.log(g.default.gray(" Path: "+t)),console.log(""),console.log(g.default.cyan(" Run ")+g.default.bold("starbridge start")+g.default.cyan(" to launch the server."))}var E=i(require("picocolors"));var P=i(require("fs")),G=i(require("path")),te=i(require("os")),_e=G.default.join(te.default.homedir(),".starbridge"),oe=G.default.join(_e,"config.json");function ne(){try{if(P.default.existsSync(oe)){let e=P.default.readFileSync(oe,"utf8");return JSON.parse(e)}}catch(e){conso ...

9Triggering deployment for project: ${n}...`));try{let s=await fetch(`${t}/api/projects/${n}/deploy`,{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${o}`},body:JSON.stringify({branch:e.branch})});if(!s.ok){let u=await s.json().catch(()=>null);throw new Error(u?.error||`Server responded with ${s.status}`)}let c=await s.json();console.log(E.default.green(`

10\u2714 Deployment triggered successfully!`)),console.log(`Deployment ID: ${E.default.bold(c.deployment.id)}`),console.log(`Status: ${E.default.yellow(c.deployment.status)}`),c.warning&&console.log(E.default.yellow(`

11\u26A0 Warning: ${c.warning}`)),console.log(E.default.gray(`

12To view logs in real-time, run:`)),console.log(`starbridge logs ${c.deployment.id}`)}catch(s){console.error(E.default.red(`

13\u2716 Deployment failed: ${s.message}`)),process.exit(1)}}var I=i(require("picocolors"));async function se(e){let o=O(),t=N();o||(console.error(I.default.red("\u2716 You are not logged in. Run `starbridge login` first.")),process.exit(1)),console.log(I.default.cyan(`

14Connecting to deployment log stream for ${e}...`));try{let n=await fetch(`${t}/api/deployments/${e}/logs`,{method:"GET",headers:{Authorization:`Bearer ${o}`,Accept:"text/event-stream"}});if(!n.ok){let m=await n.json().catch(()=>null);throw new Error(m?.error||`Server responded with ${n.status}`)}if(!n.body)throw new Error("No response body returned from server.");console.log(I.default.green(`\u2714 Connected. Streaming logs:

15`));let s=n.body.getReader(),c=new TextDecoder("utf-8"),u="";for(;;){let{done:m,value:w}=await s.read();if(m)break;u+=c.decode(w,{stream:!0});let d=u.split(`

16`);u=d.pop()||"";for(let r of d){let f=r.trim();if(!(!f||f.startsWith(":"))&&f.startsWith("data:"))try{let b=JSON.parse(f.substring(5).trim());console.log(b.message)}catch{console.log(f.substring(5).trim())}}}console.log(I.default.cyan(`

17\u2714 Log stream closed.`))}catch(n){console.error(I.default.red(`

18\u2716 Failed to stream logs: ${n.message}`)),process.exit(1)}}function De(){try{return JSON.parse(ae.readFileSync(ce.join(__dirname,"..","package.json"),"utf8")).version||"1.0.0"}catch{return"1.0.0"}}var _=new ie.Command;_.name("starbridge").description("StarBridge \u2014 Autonomous Deployment Platform for Solo Devs & Startups").version(De());_.command("start").description("Start StarBridge server and open dashboard").option("-p, --port <number>","Port number","3000").option("--no-open","Do not open browser automatically").action(Y);_.command("setup").description("Interactive setup wizard for ...

Long lines were clipped for display.

assets/starbridge-server.tar.gzView file

•path = assets/starbridge-server.tar.gz kind = high_entropy_blob sizeBytes = 23673711 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

assets/starbridge-server.tar.gzView on unpkg

•path = assets/starbridge-server.tar.gz kind = compressed_blob sizeBytes = 23673711 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

assets/starbridge-server.tar.gzView on unpkg

Source & flagged code

6 flagged · loading source

dist/index.jsView file

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L1

1#!/usr/bin/env node L2: "use strict";var de=Object.create;var L=Object.defineProperty;var ge=Object.getOwnPropertyDescriptor;var ue=Object.getOwnPropertyNames;var fe=Object.getPrototypeOf,me=Object.protot... L3: `),{padding:{top:1,bottom:1,left:2,right:2},borderColor:"cyan",borderStyle:"round"})}function l(e,o){return e==="running"?p.default.green(` \u25CF ${o}`):e==="error"?p.default.red... L4: `))),t){let d=h.join(o,"dev.db");if(!y.existsSync(d)){console.log(l("pending","Database not found. Running auto-setup..."));try{(0,v.execSync)("npx prisma db push",{cwd:h.join(o,"p... L5: `),{padding:{top:1,bottom:1,left:2,right:2},borderColor:"cyan",borderStyle:"round"}))}async function ee(e){try{await $(q,e?.tarball)}catch(r){console.error(q("error","Failed to fet...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L1

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L1

3`),{padding:{top:1,bottom:1,left:2,right:2},borderColor:"cyan",borderStyle:"round"})}function l(e,o){return e==="running"?p.default.green(` \u25CF ${o}`):e==="error"?p.default.red... L4: `))),t){let d=h.join(o,"dev.db");if(!y.existsSync(d)){console.log(l("pending","Database not found. Running auto-setup..."));try{(0,v.execSync)("npx prisma db push",{cwd:h.join(o,"p... L5: `),{padding:{top:1,bottom:1,left:2,right:2},borderColor:"cyan",borderStyle:"round"}))}async function ee(e){try{await $(q,e?.tarball)}catch(r){console.error(q("error","Failed to fet...

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L3

assets/starbridge-server.tar.gzView file

•path = assets/starbridge-server.tar.gz kind = high_entropy_blob sizeBytes = 23673711 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

assets/starbridge-server.tar.gzView on unpkg

•path = assets/starbridge-server.tar.gz kind = compressed_blob sizeBytes = 23673711 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

assets/starbridge-server.tar.gzView on unpkg

Findings

5 High4 Medium4 Low

HighChild Processdist/index.js

HighSame File Env Network Executiondist/index.js

HighCommand Output Exfiltrationdist/index.js

HighRuntime Package Installdist/index.js

HighShips High Entropy Blobassets/starbridge-server.tar.gz

MediumNetwork

MediumEnvironment Vars

MediumShips Compressed Blobassets/starbridge-server.tar.gz

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowUrl Strings

LowNo License

Source & flagged code

6 flagged

dist/index.jsView file

Lines 1-19javascript

1#!/usr/bin/env node

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L1

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L1

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L1

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L3

6`)),R.readFileSync(t,"utf8").split(`

11\u26A0 Warning: ${c.warning}`)),console.log(E.default.gray(`

12To view logs in real-time, run:`)),console.log(`starbridge logs ${c.deployment.id}`)}catch(s){console.error(E.default.red(`

15`));let s=n.body.getReader(),c=new TextDecoder("utf-8"),u="";for(;;){let{done:m,value:w}=await s.read();if(m)break;u+=c.decode(w,{stream:!0});let d=u.split(`

17\u2714 Log stream closed.`))}catch(n){console.error(I.default.red(`

Long lines were clipped for display.

assets/starbridge-server.tar.gzView file

•path = assets/starbridge-server.tar.gz kind = high_entropy_blob sizeBytes = 23673711 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

assets/starbridge-server.tar.gzView on unpkg

•path = assets/starbridge-server.tar.gz kind = compressed_blob sizeBytes = 23673711 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

assets/starbridge-server.tar.gzView on unpkg