registry / starbridge-cli / 1.2.13

starbridge-cli@1.2.13

StarBridge CLI tool for autonomous deployments

Static Scan Results

scanned 1d ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

NoLicense

scanned 1 file(s), 15.7 KB of source, external domains: 127.0.0.1, github.com

Source & flagged code

4 flagged

dist/index.jsView file

Lines 1-22javascript

1#!/usr/bin/env node

2"use strict";var he=Object.create;var J=Object.defineProperty;var Se=Object.getOwnPropertyDescriptor;var ye=Object.getOwnPropertyNames;var Ee=Object.getPrototypeOf,be=Object.prototype.hasOwnProperty;var ve=(o,e,t,r)=>{if(e&&typeof e=="object"||typeof e=="function")for(let n of ye(e))!be.call(o,n)&&n!==t&&J(o,n,{get:()=>e[n],enumerable:!(r=Se(e,n))||r.enumerable});return o};var c=(o,e,t)=>(t=o!=null?he(Ee(o)):{},ve(e||!o||!o.__esModule?J(t,"default",{value:o,enumerable:!0}):t,o));var de=require("commander"),ge=c(require("fs")),fe=c(require("path"));var R=require("child_process"),E=c(require("pa ...

3 ${i instanceof Error?i.message:String(i)}

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L1

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L1

4 You can also use --tarball <path> to install from a local file.`)}finally{try{s.rmSync(p,{recursive:!0,force:!0})}catch{}}}function De(o){try{let e=E.join(o,"package.json");return JSON.parse(h.readFileSync(e,"utf8")).version||"1.0.0"}catch{return"1.0.0"}}function $e(o){let e=E.join(o,".env");if(h.existsSync(e)){let t=h.readFileSync(e,"utf8");if(t.includes("TURSO_URL"))return"Turso (Edge SQLite)";if(t.includes("DATABASE_URL"))return"SQLite (local)"}return"SQLite (local)"}function Ce(o){let e=E.join(o,".env");return h.existsSync(e)&&h.readFileSync(e,"utf8").includes("NODE_ENV=production")?"inf ...

5`),{padding:{top:1,bottom:1,left:2,right:2},borderColor:"cyan",borderStyle:"round"})}function d(o,e){return o==="running"?g.default.green(` \u25CF ${e}`):o==="error"?g.default.red(` \u2716 ${e}`):

7`)){let $=me.trim();if(!$||$.startsWith("#"))continue;let P=$.indexOf("=");P!==-1&&(D[$.slice(0,P).trim()]=$.slice(P+1).trim().replace(/^["']|["']$/g,""))}let L=E.join(e,"dev.db");D.DATABASE_URL=`file:${L}`;let ue=E.join(e,"packages","db");(0,R.execSync)(`npx --yes prisma@7 db push --schema=prisma/schema.prisma --url="${D.DATABASE_URL}"`,{cwd:ue,stdio:"inherit"}),console.log(d("running","Database setup complete!"))}catch{console.log(d("error","Database setup failed. Please check logs above.")),process.exit(1)}}console.log(""),console.log(d("pending","Starting all services..."));let a=(0,R.spaw ...

8`),{padding:{top:1,bottom:1,left:2,right:2},borderColor:"cyan",borderStyle:"round"}))}async function se(o){try{await O(oe,o?.tarball)}catch(a){console.error(oe("error","Failed to fetch server source: "+(a instanceof Error?a.message:String(a)))),process.exit(1

9`)),T.readFileSync(t,"utf8").split(`

10`).forEach(m=>{if(m.startsWith("#")||!m.includes("="))return;let y=m.indexOf("=");if(y===-1)return;let D=m.substring(0,y).trim(),L=m.substring

11`);T.writeFileSync(t,f,"utf8"),console.log(""),console.log(u.default.green(u.default.bold(" Configuration saved!"))),console.log(u.default.gray(" Path: "+t)),console.log(""),console.log(u.default.cyan(" Run ")+u.default.bold("starbridge start")+u.default.cyan(" to launch the server."))}var b=c(require("picocolors"));var M=c(require("fs")),H=c(require("path")),ae=c(require("os")),Ne=H.default.join(ae.default.homedir(),".starbridge"),ie=H.default.join(Ne,"config.json");function ce(){try{if(M.default.existsSync(ie)){let o=M.default.readFileSync(ie,"utf8");return JSON.parse(o)}}catch(o){conso ...

12Triggering deployment for project: ${r}...`));try{let n=await fetch(`${t}/api/projects/${r}/deploy`,{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${e}`},body:JSON.stringify({branch:o.branch})});if(!n.ok){let l=await n.json().catch(()=>null);throw new Error(l?.error||`Server responded with ${n

13\u2714 Deployment triggered successfully!`)),console.log(`Deployment ID: ${b.default.bold(p.deployment.id)}`),console.log(`Status: ${b.default.yellow(p.deployment.status)}`),p.warning&&console.log(b.default.yellow(`

14\u26A0 Warning: ${p.warning}`)),console.log(b.default.gray(`

15To view logs in real-time, run:`)),console.log(`starbridge logs ${p.deployment.id}`)}catch(n){console.error(b.default.red(`

16\u2716 Deployment failed: ${n.message}`)),process.exit(1)}}var x=c(require("picocolors"));async function pe(o){let e=B(),t=N();e||(console.error(x.default.red("\u2716 You are not logged in. Run `starbridge login` first.")),process.exit(1)),console.log(x.default.cyan(`

17Connecting to deployment log stream for ${o}...`));try{let r=await fetch(`${t}/api/deployments/${o}/logs`,{method:"GET",headers:{Authorization:`Bearer ${e}`,Accept:"text/event-stream"}});if(!r.ok){let i=await r.json().catch(()=>null);throw new Error(i?.error||`Server responded with ${r.

18`));let n=r.body.getReader(),p=new TextDecoder("utf-8"),l="";for(;;){let{done:i,value:v}=await n.read();if(i)break;l+=p.decode(v,{stream:!0});let f=l.split(`

19`);l=f.pop()||"";for(let a of f){let m=a.trim();if(!(!m||m.startsWith(":"))&&m.startsWith("data:"))try{let y=JSON.parse(m.substring(5).trim());console.log(y.message)}catch{console.log(m.substring(5).trim())}}}console.

20\u2714 Log stream closed.`))}catch(r){console.error(x.default.red(`

21\u2716 Failed to stream logs: ${r.message}`)),process.exit(1)}}function Be(){try{return JSON.parse(ge.readFileSync(fe.join(__dirname,"..","package.json"),"utf8")).version||"1.0.0"}catch{return"1.0.0"}}var I=new de.Command;I.name("starbridge").description("StarBridge \u2014 Autonomous Deployment Platform for Solo Devs & Startups").version(Be());I.command("start").description("Start StarBridge server and open dashboard").

Long lines were clipped for display.

Source & flagged code

4 flagged · loading source

dist/index.jsView file

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L1

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L1

1#!/usr/bin/env node L2: "use strict";var he=Object.create;var J=Object.defineProperty;var Se=Object.getOwnPropertyDescriptor;var ye=Object.getOwnPropertyNames;var Ee=Object.getPrototypeOf,be=Object.protot... L3: ${i instanceof Error?i.message:String(i)} ... L6: `))),t){let f=E.join(e,"dev.db");if(!h.existsSync(f)){console.log(d("pending","Database not found. Running auto-setup..."));try{let y=E.join(e,".env"),D={...process.env};if(h.exist... L7: `)){let $=me.trim();if(!$||$.startsWith("#"))continue;let P=$.indexOf("=");P!==-1&&(D[$.slice(0,P).trim()]=$.slice(P+1).trim().replace(/^["']|["']$/g,""))}let L=E.join(e,"dev.db");... L8: `),{padding:{top:1,bottom:1,left:2,right:2},borderColor:"cyan",borderStyle:"round"}))}async function se(o){try{await O(oe,o?.tarball)}catch(a){console.error(oe("error","Failed to f...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L1

6`))),t){let f=E.join(e,"dev.db");if(!h.existsSync(f)){console.log(d("pending","Database not found. Running auto-setup..."));try{let y=E.join(e,".env"),D={...process.env};if(h.exist... L7: `)){let $=me.trim();if(!$||$.startsWith("#"))continue;let P=$.indexOf("=");P!==-1&&(D[$.slice(0,P).trim()]=$.slice(P+1).trim().replace(/^["']|["']$/g,""))}let L=E.join(e,"dev.db");... L8: `),{padding:{top:1,bottom:1,left:2,right:2},borderColor:"cyan",borderStyle:"round"}))}async function se(o){try{await O(oe,o?.tarball)}catch(a){console.error(oe("error","Failed to f...

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L6

Findings

4 High3 Medium5 Low

HighChild Processdist/index.js

HighSame File Env Network Executiondist/index.js

HighCommand Output Exfiltrationdist/index.js

HighRuntime Package Installdist/index.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

4 flagged

dist/index.jsView file

Lines 1-22javascript

1#!/usr/bin/env node

3 ${i instanceof Error?i.message:String(i)}

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L1

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L1

5`),{padding:{top:1,bottom:1,left:2,right:2},borderColor:"cyan",borderStyle:"round"})}function d(o,e){return o==="running"?g.default.green(` \u25CF ${e}`):o==="error"?g.default.red(` \u2716 ${e}`):

9`)),T.readFileSync(t,"utf8").split(`

10`).forEach(m=>{if(m.startsWith("#")||!m.includes("="))return;let y=m.indexOf("=");if(y===-1)return;let D=m.substring(0,y).trim(),L=m.substring

14\u26A0 Warning: ${p.warning}`)),console.log(b.default.gray(`

15To view logs in real-time, run:`)),console.log(`starbridge logs ${p.deployment.id}`)}catch(n){console.error(b.default.red(`

18`));let n=r.body.getReader(),p=new TextDecoder("utf-8"),l="";for(;;){let{done:i,value:v}=await n.read();if(i)break;l+=p.decode(v,{stream:!0});let f=l.split(`

20\u2714 Log stream closed.`))}catch(r){console.error(x.default.red(`

Long lines were clipped for display.