registry  /  starbridge-cli  /  1.2.19

starbridge-cli@1.2.19

StarBridge CLI tool for autonomous deployments

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
Supply chain
HighEntropyStringsMinifiedUrlStrings
Manifest
NoLicense
scanned 1 file(s), 18.9 KB of source, external domains: 127.0.0.1, github.com

Source & flagged code

4 flagged · loading source
dist/index.jsView file
1#!/usr/bin/env node L2: "use strict";var ve=Object.create;var W=Object.defineProperty;var Re=Object.getOwnPropertyDescriptor;var be=Object.getOwnPropertyNames;var we=Object.getPrototypeOf,Te=Object.protot... L3: ${i instanceof Error?i.message:String(i)}
High
Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L1
1#!/usr/bin/env node L2: "use strict";var ve=Object.create;var W=Object.defineProperty;var Re=Object.getOwnPropertyDescriptor;var be=Object.getOwnPropertyNames;var we=Object.getPrototypeOf,Te=Object.protot... L3: ${i instanceof Error?i.message:String(i)}
High
Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L1
1#!/usr/bin/env node L2: "use strict";var ve=Object.create;var W=Object.defineProperty;var Re=Object.getOwnPropertyDescriptor;var be=Object.getOwnPropertyNames;var we=Object.getPrototypeOf,Te=Object.protot... L3: ${i instanceof Error?i.message:String(i)} ... L5: `),{padding:{top:1,bottom:1,left:2,right:2},borderColor:"cyan",borderStyle:"round"})}function g(e,t){return e==="running"?u.default.green(` \u25CF ${t}`):e==="error"?u.default.red... L6: `))),n){try{L(t,g)}catch(m){console.log(g("error",`Production setup failed: ${m instanceof Error?m.message:String(m)}`)),process.exit(1)}console.log(""),console.log(g("pending","St... L7: `):e==="error"?f.default.red(`\r \u2716 ${t}
High
Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L1
5`),{padding:{top:1,bottom:1,left:2,right:2},borderColor:"cyan",borderStyle:"round"})}function g(e,t){return e==="running"?u.default.green(` \u25CF ${t}`):e==="error"?u.default.red... L6: `))),n){try{L(t,g)}catch(m){console.log(g("error",`Production setup failed: ${m instanceof Error?m.message:String(m)}`)),process.exit(1)}console.log(""),console.log(g("pending","St... L7: `):e==="error"?f.default.red(`\r \u2716 ${t}
High
Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L5

Findings

4 High3 Medium5 Low
HighChild Processdist/index.js
HighSame File Env Network Executiondist/index.js
HighCommand Output Exfiltrationdist/index.js
HighRuntime Package Installdist/index.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License