registry / tfv / 6.1.4

tfv@6.1.4

Terraform & OpenTofu version manager

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 39 file(s), 80.7 KB of source, external domains: api.github.com, github.com, releases.hashicorp.com

Source & flagged code

2 flagged

package.jsonView file

Lines 1-31json

2 "name": "tfv",

3 "version": "6.1.4",

4 "publishConfig": {

5 "access": "public",

6 "provenance": true

7 },

8 "description": "Terraform & OpenTofu version manager",

9 "main": "index.js",

10 "scripts": {

11 "postinstall": "node lib/utils/postInstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L11

12 "test": "jest --testPathPatterns=test/"

13 },

14 "bin": {

15 "tfv": "index.js"

16 },

17 "keywords": [

18 "Terraform",

19 "OpenTofu",

20 "version",

21 "manager"

22 ],

23 "author": "Marcus Chukwuoma <marcus2cu@gmail.com> (https://github.com/marcdomain)",

24 "license": "MIT",

25 "repository": {

26 "type": "git",

27 "url": "https://github.com/marcdomain/tfv.git"

28 },

29 "dependencies": {

30 "adm-zip": "^0.6.0",

31 "yargs": "^17.2.1"

lib/utils/paths.jsView file

Lines 1-24javascript

1const { homedir, platform } = require('os');

2const { join } = require('path');

3const { mkdirSync, existsSync

Source & flagged code

2 flagged · loading source

package.jsonView file

•scripts.postinstall = node lib/utils/postInstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

lib/utils/paths.jsView file

4L5: const TFV_HOME = join(homedir(), '.tfv'); L6: ... L56: const SHELL_CONFIGS = [ L57: join(homedir(), '.zshrc'), L58: join(homedir(), '.bashrc'), ... L70: const checkPathConflict = (provider = 'terraform') => { L71: const { spawnSync } = require('child_process'); L72: const isWin = platform() === 'win32'; ... L79: L80: if (!result || result.status !== 0 || !result.stdout.trim()) { L81: return { ok: true }; // not found anywhere else — no conflict

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

lib/utils/paths.jsView on unpkg · L4

Findings

1 High4 Medium4 Low

HighInstall Time Lifecycle Scriptspackage.json

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencelib/utils/paths.js

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings