registry / starbridge-cli / 1.2.4

starbridge-cli@1.2.4

StarBridge CLI tool for autonomous deployments

Static Scan Results

scanned 2d ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

NoLicense

scanned 1 file(s), 14.8 KB of source, external domains: 127.0.0.1

Source & flagged code

6 flagged

dist/index.jsView file

Lines 1-20javascript

1#!/usr/bin/env node

2"use strict";var me=Object.create;var H=Object.defineProperty;var Se=Object.getOwnPropertyDescriptor;var ye=Object.getOwnPropertyNames;var he=Object.getPrototypeOf,Ee=Object.prototype.hasOwnProperty;var ve=(o,e,t,n)=>{if(e&&typeof e=="object"||typeof e=="function")for(let s of ye(e))!Ee.call(o,s)&&s!==t&&H(o,s,{get:()=>e[s],enumerable:!(n=Se(e,s))||n.enumerable});return o};var i=(o,e,t)=>(t=o!=null?me(he(o)):{},ve(e||!o||!o.__esModule?H(t,"default",{value:o,enumerable:!0}):t,o));var pe=require("commander"),de=i(require("fs")),ge=i(require("path"));var b=require("child_process"),E=i(require("pa ...

3`),{padding:{top:1,bottom:1,left:2,right:2},borderColor:"cyan",borderStyle:"round"})}function l(o,e){return o==="running"?p.default.green(` \u25CF ${e}`):o==="error"?p.default.red(` \u2716 ${e}`):p.default.yellow(` \u25D0 ${e}`)}async function Z(o){console.clear();try{await A(l)}catch(d){console.error(l("error","Failed to fetch server source: "+(d instanceof Error?d.message:String(d)))),process.exit(1)}let e=C();console.log(""),_e(xe(e)),console.log(""),console.log(De(o,e)),console.log("");let t=S.existsSync(E.join(e,"start.js")),n=E.join(e,".env");if(S.existsSync(n)||(console.log(p.default ...

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L1

5`)){let $=ue.trim();if(!$||$.startsWith("#"))continue;let P=$.indexOf("=");P!==-1&&(D[$.slice(0,P).trim()]=$.slice(P+1).trim

6`),{padding:{top:1,bottom:1,left:2,right:2},borderColor:"cyan",borderStyle:"round"}))}async function re(o){try{await A(ee,o?.tarball)}catch(r){console.error(ee("error","Failed to fetch server source: "+(r instanceof Error?r.message:String(r)))),process.exit(1)}let e=C(),t=F.join(e,".env"),n=$e(),s="SQLite (local)",c=e;console.clear(),Ce("1.0.1",n,s,c),console.log("");let f={};R.existsSync(t)&&(console.log(g.default.gray(` Existing configuration found. Loading values...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L1

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L4

7`)),R.readFileSync(t,"utf8").split(`

8`).forEach(u=>{if(u.startsWith("#")||!u.includes("="))return;let y=u.indexOf("=");if(y===-1)return;let D=u.substring(0,y).trim(),k=u.substring(y+1).trim().replace(/^["']|["']$/g,"");f[D]=k}));let m=await oe.default.prompt([{type:"input",name:"GITHUB_CLIENT_ID",message:"GitHub OAuth Client ID:",default:"",validate:r=>r.length>0||"Required"},{type:"password",name:"GITHUB_CLIENT_SECRET",message:"GitHub OAuth Client Secret:",default:"",mask:"*",validate:r=>r.length>0||"Required"},{type:"input",name:"DATABASE_URL",message:"SQLite Database Path:",default:"file:./dev.db"},{type:"input",name:"BASE_DOM ...

9`);R.writeFileSync(t,d,"utf8"),console.log(""),console.log(g.default.green(g.default.bold(" Configuration saved!"))),console.log(g.default.gray(" Path: "+t)),console.log(""),console.log(g.default.cyan(" Run ")+g.default.bold("starbridge start")+g.default.cyan(" to launch the server."))}var

10Triggering deployment for project: ${n}...`));try{let s=await fetch(`${t}/api/projects/${n}/deploy`,{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${e}`},body:JSON.stringify({branch:o.branch})});if(!s.ok){let f=await s.json().catch(()=>null);throw new Error(f?.error||`Server responded with ${s.status}`)}let c=await s.json();console.log(v.default.green(`

11\u2714 Deployment triggered successfully!`)),console.log(`Deployment ID: ${v.default.bold(c.deployment.id)}`),console.log(`Status: ${v.default.yellow(c.deployment.status)}`),c.warning&&console.log(v.default.yellow(`

12\u26A0 Warning: ${c.warning}`)),console.log(v.default.gray(`

13To view logs in real-time, run:`)),console.log(`starbridge logs ${c.deployment.id}`)}catch(s){console.error(v.default.red(`

14\u2716 Deployment failed: ${s.message}`)),process.exit(1)}}var I=i(require("picocolors"));async function le(o){let e=B(),t=N();e||(console.error(I.default.red("\u2716 You are not logged in. Run `starbridge login` first.")),process.exit(1)),console.log(I.default.cyan(`

15Connecting to deployment log stream for ${o}...`));try{let n=await fetch(`${t}/api/deployments/${o}/logs`,{method:"GET",headers:{Authorization:`Bearer ${e}`,Accept:"text/event-stream"}});if(!n.ok){let m=await n.json().catch(()=>null);throw new Error(m?.error||`Server responded with ${n.status}`)}if(!n.body)throw new Error("No response body returned from server.");console.log(I.default.green(`\u2714 Connected. Streaming logs:

16`));let s=n.body.getReader(),c=new TextDecoder("utf-8"),f="";for(;;){let{done:m,value:w}=await s.read();if(m)break;f+=c.decode(w,{stream:!0});let d=f.split(`

17`);f=d.pop()||"";for(let r of d){let u=r.trim();if(!(!u||u.startsWith(":"))&&u.startsWith("data:"))try{let y=JSON.parse(u.substring(5).trim());console.log(y.message)}catch{console.log(u.substring(5).trim())}}}console.log(I.default.cyan(`

18\u2714 Log stream closed.`))}catch(n){console.error(I.default.red(`

19\u2716 Failed to stream logs: ${n.message}`)),process.exit(1)}}function Ae(){try{return JSON.parse(de.readFileSync(ge.join(__dirname,"..","package.json"),"utf8")).version||"1.0.0"}catch{return"1.0.0"}}var _=new pe.Command;_.name("starbridge").description("StarBridge \u2014 Autonomous Deployment Platform for Solo Devs & Startups").version(Ae());_.command("start").description("Start StarBridge server and open dashboard").option("-p, --port <number>","Port number","3000").option("--no-open","Do not open browser automatically").action(Z);_.command("setup").description("Interactive setup wizard for ...

Long lines were clipped for display.

assets/server.tar.gzView file

•path = assets/server.tar.gz kind = high_entropy_blob sizeBytes = 23676039 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

assets/server.tar.gzView on unpkg

•path = assets/server.tar.gz kind = compressed_blob sizeBytes = 23676039 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

assets/server.tar.gzView on unpkg

Source & flagged code

6 flagged · loading source

dist/index.jsView file

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L1

1#!/usr/bin/env node L2: "use strict";var me=Object.create;var H=Object.defineProperty;var Se=Object.getOwnPropertyDescriptor;var ye=Object.getOwnPropertyNames;var he=Object.getPrototypeOf,Ee=Object.protot... L3: `),{padding:{top:1,bottom:1,left:2,right:2},borderColor:"cyan",borderStyle:"round"})}function l(o,e){return o==="running"?p.default.green(` \u25CF ${e}`):o==="error"?p.default.red... L4: `))),t){let d=E.join(e,"dev.db");if(!S.existsSync(d)){console.log(l("pending","Database not found. Running auto-setup..."));try{let y=E.join(e,".env"),D={...process.env};if(S.exist... L5: `)){let $=ue.trim();if(!$||$.startsWith("#"))continue;let P=$.indexOf("=");P!==-1&&(D[$.slice(0,P).trim()]=$.slice(P+1).trim().replace(/^["']|["']$/g,""))}let k=E.join(e,"dev.db");...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L1

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L1

4`))),t){let d=E.join(e,"dev.db");if(!S.existsSync(d)){console.log(l("pending","Database not found. Running auto-setup..."));try{let y=E.join(e,".env"),D={...process.env};if(S.exist... L5: `)){let $=ue.trim();if(!$||$.startsWith("#"))continue;let P=$.indexOf("=");P!==-1&&(D[$.slice(0,P).trim()]=$.slice(P+1).trim().replace(/^["']|["']$/g,""))}let k=E.join(e,"dev.db");... L6: `),{padding:{top:1,bottom:1,left:2,right:2},borderColor:"cyan",borderStyle:"round"}))}async function re(o){try{await A(ee,o?.tarball)}catch(r){console.error(ee("error","Failed to f...

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L4

assets/server.tar.gzView file

•path = assets/server.tar.gz kind = high_entropy_blob sizeBytes = 23676039 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

assets/server.tar.gzView on unpkg

•path = assets/server.tar.gz kind = compressed_blob sizeBytes = 23676039 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

assets/server.tar.gzView on unpkg

Findings

5 High4 Medium5 Low

HighChild Processdist/index.js

HighSame File Env Network Executiondist/index.js

HighCommand Output Exfiltrationdist/index.js

HighRuntime Package Installdist/index.js

HighShips High Entropy Blobassets/server.tar.gz

MediumNetwork

MediumEnvironment Vars

MediumShips Compressed Blobassets/server.tar.gz

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

6 flagged

dist/index.jsView file

Lines 1-20javascript

1#!/usr/bin/env node

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L1

5`)){let $=ue.trim();if(!$||$.startsWith("#"))continue;let P=$.indexOf("=");P!==-1&&(D[$.slice(0,P).trim()]=$.slice(P+1).trim

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L1

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L4

7`)),R.readFileSync(t,"utf8").split(`

12\u26A0 Warning: ${c.warning}`)),console.log(v.default.gray(`

13To view logs in real-time, run:`)),console.log(`starbridge logs ${c.deployment.id}`)}catch(s){console.error(v.default.red(`

16`));let s=n.body.getReader(),c=new TextDecoder("utf-8"),f="";for(;;){let{done:m,value:w}=await s.read();if(m)break;f+=c.decode(w,{stream:!0});let d=f.split(`

18\u2714 Log stream closed.`))}catch(n){console.error(I.default.red(`

Long lines were clipped for display.

assets/server.tar.gzView file

•path = assets/server.tar.gz kind = high_entropy_blob sizeBytes = 23676039 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

assets/server.tar.gzView on unpkg

•path = assets/server.tar.gz kind = compressed_blob sizeBytes = 23676039 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

assets/server.tar.gzView on unpkg