registry / subtrack / 8.1.0

subtrack@8.1.0

CLI tool to manage subscription services from the terminal

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 8 file(s), 435 KB of source, external domains: example.com, hooks.slack.com, open.er-api.com, raw.githubusercontent.com

Source & flagged code

2 flagged

dist/index.mjsView file

Lines 232-272javascript

232 try {

233 const newId = writeSubscription(newData);

234 logAudit("subscription.clone", {

235 targetType: "subscription",

236 targetId: newId,

237 details: `Cloned from #${id} "${sub.name}" → "${newName}"`

238 });

239 consola.success(`Cloned: "${sub.name}" → "${newName}" (id=${newId})`);

240 } catch (error) {

241 consola.error(`Failed to clone subscription: ${String(error)}`);

242 }

243}

244async function handleList(options) {

245 const list = options.tags ? tagsSubscription(options.tags.split(",").map((t) => t.trim())) : getSubscriptions({

246 sort: options.sort,

247 desc: options.desc,

248 limit: options.limit,

249 offset: options.offset,

250 includeArchived: options.includeArchived

251 });

252 if (options.json) {

253 process.stdout.write(JSON.stringify(list, null, 2) + "\n");

254 return;

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.mjsView on unpkg · L252

255 }

256 await spreadSubscription(list, options.currency, options.notes, options.method);

257 if (options.api) {

258 const now = /* @__PURE__ */ new Date();

259 const y = now.getFullYear();

260 const m = now.getMonth() + 1;

261 const from = `${y}-${String(m).padStart(2, "0")}-01`;

262 const to = `${y}-${String(m).padStart(2, "0")}-${String(now.getDate()).padStart(2, "0")}`;

263 const monthLabel = `${now.toLocaleString("en-US", { month: "long" })} ${y}`;

264 showApiUsage(getLlmUsageTotal(from, to), getLlmUsageTotalByProvider(from, to), monthLabel);

265 }

266}

267async function handleAdd(flags) {

268 const result = await resolveAddOptions(flags);

269 if (!result) return;

270 try {

271 logAudit("subscription.add", {

272 targetType: "subscription",

Lines 1199-1239javascript

1199 consola.log(` ${date} ${e.sub.name} ${formatPrice(e.sub.price, e.sub.currency)}/${e.sub.cycle}`);

1200 }

1201 return;

1202 }

Source & flagged code

2 flagged · loading source

dist/index.mjsView file

252if (options.json) { L253: process.stdout.write(JSON.stringify(list, null, 2) + "\n"); L254: return; ... L1242: try { L1243: const { execSync } = await import("node:child_process"); L1244: const sendmailPath = process.platform === "linux" ? "/usr/sbin/sendmail" : "/usr/bin/sendmail"; L1245: const msg = `From: subtrack <noreply@subtrack> ... L1263: if (!webhookUrl) { L1264: consola.warn("Slack notification configured but no slackWebhook set. Use: subtrack config set slackWebhook https://hooks.slack.com/services/..."); L1265: return; ... L1774: function writeCompressedBackup(destPath, encrypt) { L1775: const compressed = gzipSync(Buffer.from(getDb().export()));

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.mjsView on unpkg · L252

1219async function sendOsNotification(entries, days) { L1220: const { default: notifier } = await import("node-notifier"); L1221: const count = entries.length;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.mjsView on unpkg · L1219

Findings

1 High4 Medium4 Low

HighSandbox Evasion Gated Capabilitydist/index.mjs

MediumDynamic Requiredist/index.mjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

dist/index.mjsView file

Lines 232-272javascript

232 try {

233 const newId = writeSubscription(newData);

234 logAudit("subscription.clone", {

235 targetType: "subscription",

236 targetId: newId,

237 details: `Cloned from #${id} "${sub.name}" → "${newName}"`

238 });

239 consola.success(`Cloned: "${sub.name}" → "${newName}" (id=${newId})`);

240 } catch (error) {

241 consola.error(`Failed to clone subscription: ${String(error)}`);

242 }

243}

244async function handleList(options) {

245 const list = options.tags ? tagsSubscription(options.tags.split(",").map((t) => t.trim())) : getSubscriptions({

246 sort: options.sort,

247 desc: options.desc,

248 limit: options.limit,

249 offset: options.offset,

250 includeArchived: options.includeArchived

251 });

252 if (options.json) {

253 process.stdout.write(JSON.stringify(list, null, 2) + "\n");

254 return;

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.mjsView on unpkg · L252

255 }

256 await spreadSubscription(list, options.currency, options.notes, options.method);

257 if (options.api) {

258 const now = /* @__PURE__ */ new Date();

259 const y = now.getFullYear();

260 const m = now.getMonth() + 1;

261 const from = `${y}-${String(m).padStart(2, "0")}-01`;

262 const to = `${y}-${String(m).padStart(2, "0")}-${String(now.getDate()).padStart(2, "0")}`;

263 const monthLabel = `${now.toLocaleString("en-US", { month: "long" })} ${y}`;

264 showApiUsage(getLlmUsageTotal(from, to), getLlmUsageTotalByProvider(from, to), monthLabel);

265 }

266}

267async function handleAdd(flags) {

268 const result = await resolveAddOptions(flags);

269 if (!result) return;

270 try {

271 logAudit("subscription.add", {

272 targetType: "subscription",

Lines 1199-1239javascript

1199 consola.log(` ${date} ${e.sub.name} ${formatPrice(e.sub.price, e.sub.currency)}/${e.sub.cycle}`);

1200 }

1201 return;

1202 }