registry / sugaku-mail / 2.7.0

sugaku-mail@2.7.0

Gmail/Outlook/Yahoo/sugaku-club.com対応メールCLI

Static Scan Results

scanned 11h ago · by rust-scanner

Static analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 21.2 KB of source, external domains: npm.sugaku-club.com, registry.npmjs.org

Source & flagged code

3 flagged

bin/cli.jsView file

Lines 1-24javascript

1#!/usr/bin/env node

2'use strict';

3const { send, fetchInbox, fetchMessage, setup, testSmtp, config, load } = require('../lib/index');

4const readline = require('readline');

5const { execSync } = require('child_process');

6const https = require('https');

High

Child Process

Package source references child process execution.

bin/cli.jsView on unpkg · L4

7const args = process.argv.slice(2);

8const PKG_NAME = 'sugaku-mail';

9const PKG_VERSION = '2.7.0';

11const C = {

12 reset:'\x1b[0m', bold:'\x1b[1m', dim:'\x1b[2m',

13 cyan:'\x1b[36m', green:'\x1b[32m', red:'\x1b[31m',

14 yellow:'\x1b[33m', white:'\x1b[37m', magenta:'\x1b[35m',

15};

16const cc = (c,s) => c+s+C.reset;

17function cls() { process.stdout.write('\x1Bc'); }

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

bin/cli.jsView on unpkg · L4

19let rl;

20function makeRL() {

21 if(rl) try{rl.close();}catch{}

22 rl = readline.createInterface({input:process.stdin,output:process.stdout});

23 rl.on('SIGINT',()=>{console.log('\n\n さようなら 👋\n');process.exit(0);});

24 return rl;

Lines 70-110javascript

71async function checkAndUpdate() {

72 process.stdout.write(cc(C.dim,' 更新確認中…'));

73 const latest = await getLatestVersion();

74 process.stdout.

Source & flagged code

3 flagged · loading source

bin/cli.jsView file

4const readline = require('readline'); L5: const { execSync } = require('child_process'); L6: const https = require('https');

High

Child Process

Package source references child process execution.

bin/cli.jsView on unpkg · L4

4const readline = require('readline'); L5: const { execSync } = require('child_process'); L6: const https = require('https'); L7: const args = process.argv.slice(2); ... L16: const cc = (c,s) => c+s+C.reset; L17: function cls() { process.stdout.write('\x1Bc'); } L18:

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

bin/cli.jsView on unpkg · L4

90try{ L91: execSync('npm install -g '+PKG_NAME+'@'+latest,{stdio:'inherit'}); L92: ok('更新完了！ v'+latest+' — 再起動してください');

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/cli.jsView on unpkg · L90

Findings

4 High2 Medium3 Low

HighChild Processbin/cli.js

HighShell

HighCommand Output Exfiltrationbin/cli.js

HighRuntime Package Installbin/cli.js

MediumNetwork

MediumStructural Risk Force Deep Review

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings