registry / subtrack / 8.0.5

subtrack@8.0.5

CLI tool to manage subscription services from the terminal

Static Scan Results

scanned 2d ago · by rust-scanner

Static analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 8 file(s), 425 KB of source, external domains: example.com, hooks.slack.com, open.er-api.com, raw.githubusercontent.com

Source & flagged code

2 flagged

dist/index.mjsView file

Lines 332-372javascript

332 const data = list.map((sub) => ({

333 id: sub.id,

334 name: sub.name,

335 price: sub.price,

336 currency: sub.currency,

337 cycle: sub.cycle,

338 status: sub.status,

339 tags: sub.tags,

340 billingDay: sub.billingDay,

341 notes: sub.notes,

342 paymentMethod: sub.paymentMethod,

343 contractStart: sub.contractStart,

344 contractEnd: sub.contractEnd,

345 autoRenewal: sub.autoRenewal,

346 vendorName: sub.vendorName,

347 vendorUrl: sub.vendorUrl,

348 planTier: sub.planTier,

349 discountAmount: sub.discountAmount,

350 discountType: sub.discountType,

351 createdAt: sub.createdAt

352 }));

353 process.stdout.write(JSON.stringify(data, null, 2) + "\n");

354 return;

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.mjsView on unpkg · L352

355 }

356 await spreadSubscription(list, options.currency, options.notes, options.method, options.showContract, options.showVendor);

357 if (options.api) {

358 const now = /* @__PURE__ */ new Date();

359 const y = now.getFullYear();

360 const m = now.getMonth() + 1;

361 const from = `${y}-${String(m).padStart(2, "0")}-01`;

362 const to = `${y}-${String(m).padStart(2, "0")}-${String(now.getDate()).padStart(2, "0")}`;

363 const monthLabel = `${now.toLocaleString("en-US", { month: "long" })} ${y}`;

364 showApiUsage(getLlmUsageTotal(from, to), getLlmUsageTotalByProvider(from, to), monthLabel);

365 }

366}

367async function handleAdd(flags) {

368 const result = await resolveAddOptions(flags);

369 if (!result) return;

370 try {

371 writeSubscription(result);

372 consola.success(`Added subscription: ${result.name}`);

Lines 1345-1385javascript

1345 consola.log(` ${date} ${e.sub.name} ${formatPrice(e.sub.price, e.sub.currency)}/${e.sub.cycle}`);

1346 }

1347 return;

1348 }

Source & flagged code

2 flagged · loading source

dist/index.mjsView file

352})); L353: process.stdout.write(JSON.stringify(data, null, 2) + "\n"); L354: return; ... L1388: try { L1389: const { execSync } = await import("node:child_process"); L1390: const sendmailPath = process.platform === "linux" ? "/usr/sbin/sendmail" : "/usr/bin/sendmail"; L1391: const msg = `From: subtrack <noreply@subtrack> ... L1409: if (!webhookUrl) { L1410: consola.warn("Slack notification configured but no slackWebhook set. Use: subtrack config set slackWebhook https://hooks.slack.com/services/..."); L1411: return; ... L1920: function writeCompressedBackup(destPath, encrypt) { L1921: const compressed = gzipSync(Buffer.from(getDb().export()));

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.mjsView on unpkg · L352

1365async function sendOsNotification(entries, days) { L1366: const { default: notifier } = await import("node-notifier"); L1367: const count = entries.length;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.mjsView on unpkg · L1365

Findings

1 High4 Medium4 Low

HighSandbox Evasion Gated Capabilitydist/index.mjs

MediumDynamic Requiredist/index.mjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

dist/index.mjsView file

Lines 332-372javascript

332 const data = list.map((sub) => ({

333 id: sub.id,

334 name: sub.name,

335 price: sub.price,

336 currency: sub.currency,

337 cycle: sub.cycle,

338 status: sub.status,

339 tags: sub.tags,

340 billingDay: sub.billingDay,

341 notes: sub.notes,

342 paymentMethod: sub.paymentMethod,

343 contractStart: sub.contractStart,

344 contractEnd: sub.contractEnd,

345 autoRenewal: sub.autoRenewal,

346 vendorName: sub.vendorName,

347 vendorUrl: sub.vendorUrl,

348 planTier: sub.planTier,

349 discountAmount: sub.discountAmount,

350 discountType: sub.discountType,

351 createdAt: sub.createdAt

352 }));

353 process.stdout.write(JSON.stringify(data, null, 2) + "\n");

354 return;

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.mjsView on unpkg · L352

355 }

356 await spreadSubscription(list, options.currency, options.notes, options.method, options.showContract, options.showVendor);

357 if (options.api) {

358 const now = /* @__PURE__ */ new Date();

359 const y = now.getFullYear();

360 const m = now.getMonth() + 1;

361 const from = `${y}-${String(m).padStart(2, "0")}-01`;

362 const to = `${y}-${String(m).padStart(2, "0")}-${String(now.getDate()).padStart(2, "0")}`;

363 const monthLabel = `${now.toLocaleString("en-US", { month: "long" })} ${y}`;

364 showApiUsage(getLlmUsageTotal(from, to), getLlmUsageTotalByProvider(from, to), monthLabel);

365 }

366}

367async function handleAdd(flags) {

368 const result = await resolveAddOptions(flags);

369 if (!result) return;

370 try {

371 writeSubscription(result);

372 consola.success(`Added subscription: ${result.name}`);

Lines 1345-1385javascript

1345 consola.log(` ${date} ${e.sub.name} ${formatPrice(e.sub.price, e.sub.currency)}/${e.sub.cycle}`);

1346 }

1347 return;

1348 }