registry / tmex-cli / 0.16.4

tmex-cli@0.16.4

Node.js-compatible CLI for initializing, diagnosing, upgrading, and uninstalling tmex deployment.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 20 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareTelemetryUrlStrings

Manifest

NoLicenseWildcardDependency

scanned 74 file(s), 5.13 MB of source, external domains: 127.0.0.1, api.openai.com, api.vercel.com, base-ui.com, brew.sh, bun.sh, chevrotain.io, en.wikipedia.org, example.com, github.com, jquery.org, langium.org, lodash.com, openjsf.org, react.dev, tldrlegal.com, underscorejs.org, vercel.com, www.apple.com, www.w3.org

Oversized source lightweight scan

dist/runtime/server.js4.14 MB file, sampled 256 KB

FilesystemNetworkChildProcessEnvironmentVarsCryptoHighEntropyStringsUrlStringsapi.vercel.combrew.shvercel.com

Source & flagged code

8 flagged

resources/fe-dist/assets/en_US-BihUhDmr.jsView file

Lines 1-2javascript

1const e=JSON.parse('{"common":{"loading":"Loading...","save":"Save","saving":"Saving...","cancel":"Cancel","add":"Add","delete":"Delete","edit":"Edit","confirm":"Confirm","close":"Close","expand":"Expand","collapse":"Collapse","refresh":"Refresh","test":"Test","send":"Send","success":"Success","error":"Error","warning":"Warning","info":"Info","yes":"Yes","no":"No","enabled":"Enabled","disabled":"Disabled","pending":"Pending","authorized":"Authorized","unknown":"Unknown","empty":"Empty","none":"None","default":"Default","optional":"Optional","required":"Required","pwaInstallTitle":"Install as a ...

Critical

Critical Secret

Package contains a critical-looking secret pattern.

resources/fe-dist/assets/en_US-BihUhDmr.jsView on unpkg · L1

Critical

Secret Pattern

OpenSSH private key in resources/fe-dist/assets/en_US-BihUhDmr.js

resources/fe-dist/assets/en_US-BihUhDmr.jsView on unpkg · L1

Long lines were clipped for display.

dist/runtime/cpufeatures-dxrn1j88.nodeView file

•path = dist/runtime/cpufeatures-dxrn1j88.node kind = native_binary sizeBytes = 61424 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/runtime/cpufeatures-dxrn1j88.nodeView on unpkg

dist/runtime/assets/ghostty-vt.wasmView file

•path = dist/runtime/assets/ghostty-vt.wasm kind = wasm_module sizeBytes = 554837 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/runtime/assets/ghostty-vt.wasmView on unpkg

resources/fe-dist/fonts/generated/jetbrains-mono/jetbrains-mono-bold.woff2View file

•path = resources/fe-dist/fonts/generated/jetbrains-mono/jetbrains-mono-bold.woff2 kind = high_entropy_blob sizeBytes = 1046588 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

resources/fe-dist/fonts/generated/jetbrains-mono/jetbrains-mono-bold.woff2View on unpkg

dist/runtime/server.jsView file

•path = dist/runtime/server.js kind = oversized_source_file sizeBytes = 4345373 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/runtime/server.jsView on unpkg

resources/fe-dist/assets/zh_CN-CPdvelFW.jsView file

Lines 1-2javascript

1const e=JSON.parse('{"common":{"loading":"加载中...","save":"保存","saving":"保存中...","cancel":"取消","add":"添加","delete":"删除","edit":"修改","confirm":"确认","close":"关闭","expand":"展开","collapse":"收起","refresh":"刷新","test":"测试","send":"发送","success":"成功","error":"错误","warning":"警告","info":"信息","yes":"是","no":"否","enabled":"已启用","disabled":"已禁用","pending":"待授权","authorized":"已授权","unknown":"未知","empty":"空","none":"无","default":"默认","optional":"可选","required":"必填","pwaInstallTitle":"安装为应用","pwaInstallHintIOSSafari":"iOS Safari 不会自动弹出安装提示。请点击「分享」，再选择「添加到主屏幕」。","pwaInstallHintIOSChrome":"iOS Chrome 不会自动弹出安装提示 ...

Critical

Secret Pattern

OpenSSH private key in resources/fe-dist/assets/zh_CN-CPdvelFW.js

resources/fe-dist/assets/zh_CN-CPdvelFW.jsView on unpkg · L1

Long lines were clipped for display.

resources/fe-dist/assets/ja_JP-f5sXmz8W.jsView file

Lines 1-2javascript

1const e=JSON.parse('{"common":{"loading":"読み込み中...","save":"保存","saving":"保存中...","cancel":"キャンセル","add":"追加","delete":"削除","edit":"編集","confirm":"確認","close":"閉じる","expand":"展開","collapse":"折りたたむ","refresh":"更新","test":"テスト","send":"送信","success":"成功","error":"エラー","warning":"警告","info":"情報","yes":"はい","no":"いいえ","enabled":"有効","disabled":"無効","pending":"保留中","authorized":"承認済み","unknown":"不明","empty":"空","none":"なし","default":"デフォルト","optional":"任意","required":"必須","pwaInstallTitle":"アプリとしてインストール","pwaInstallHintIOSSafari":"iOS Safari では自動的にインストールプロンプトが表示されません。共有ボタンをタップし、「ホーム画面に追加」を選択してください。 ...

Critical

Secret Pattern

OpenSSH private key in resources/fe-dist/assets/ja_JP-f5sXmz8W.js

resources/fe-dist/assets/ja_JP-f5sXmz8W.jsView on unpkg · L1

Long lines were clipped for display.

Source & flagged code

8 flagged · loading source

resources/fe-dist/assets/en_US-BihUhDmr.jsView file

1patternName = private_key_openssh severity = critical line = 1 matchedText = const e=...on};

Critical

Critical Secret

Package contains a critical-looking secret pattern.

resources/fe-dist/assets/en_US-BihUhDmr.jsView on unpkg · L1

1patternName = private_key_openssh severity = critical line = 1 matchedText = const e=...on};

Critical

Secret Pattern

OpenSSH private key in resources/fe-dist/assets/en_US-BihUhDmr.js

resources/fe-dist/assets/en_US-BihUhDmr.jsView on unpkg · L1

dist/runtime/cpufeatures-dxrn1j88.nodeView file

•path = dist/runtime/cpufeatures-dxrn1j88.node kind = native_binary sizeBytes = 61424 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/runtime/cpufeatures-dxrn1j88.nodeView on unpkg

dist/runtime/assets/ghostty-vt.wasmView file

•path = dist/runtime/assets/ghostty-vt.wasm kind = wasm_module sizeBytes = 554837 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/runtime/assets/ghostty-vt.wasmView on unpkg

resources/fe-dist/fonts/generated/jetbrains-mono/jetbrains-mono-bold.woff2View file

•path = resources/fe-dist/fonts/generated/jetbrains-mono/jetbrains-mono-bold.woff2 kind = high_entropy_blob sizeBytes = 1046588 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

resources/fe-dist/fonts/generated/jetbrains-mono/jetbrains-mono-bold.woff2View on unpkg

dist/runtime/server.jsView file

•path = dist/runtime/server.js kind = oversized_source_file sizeBytes = 4345373 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/runtime/server.jsView on unpkg

resources/fe-dist/assets/zh_CN-CPdvelFW.jsView file

1patternName = private_key_openssh severity = critical line = 1 matchedText = const e=...on};

Critical

Secret Pattern

OpenSSH private key in resources/fe-dist/assets/zh_CN-CPdvelFW.js

resources/fe-dist/assets/zh_CN-CPdvelFW.jsView on unpkg · L1

resources/fe-dist/assets/ja_JP-f5sXmz8W.jsView file

1patternName = private_key_openssh severity = critical line = 1 matchedText = const e=...on};

Critical

Secret Pattern

OpenSSH private key in resources/fe-dist/assets/ja_JP-f5sXmz8W.js

resources/fe-dist/assets/ja_JP-f5sXmz8W.jsView on unpkg · L1

Findings

4 Critical2 High7 Medium7 Low

CriticalCritical Secretresources/fe-dist/assets/en_US-BihUhDmr.js

CriticalSecret Patternresources/fe-dist/assets/en_US-BihUhDmr.js

CriticalSecret Patternresources/fe-dist/assets/zh_CN-CPdvelFW.js

CriticalSecret Patternresources/fe-dist/assets/ja_JP-f5sXmz8W.js

HighShips High Entropy Blobresources/fe-dist/fonts/generated/jetbrains-mono/jetbrains-mono-bold.woff2

HighOversized Source Filedist/runtime/server.js

MediumNetwork

MediumEnvironment Vars

MediumProtestware

MediumShips Native Binarydist/runtime/cpufeatures-dxrn1j88.node

MediumShips Wasm Moduledist/runtime/assets/ghostty-vt.wasm

MediumStructural Risk Force Deep Review

MediumWildcard Dependency

LowScripts Present

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

LowNo License

Source & flagged code

8 flagged

resources/fe-dist/assets/en_US-BihUhDmr.jsView file

Lines 1-2javascript

Critical

Critical Secret

Package contains a critical-looking secret pattern.

resources/fe-dist/assets/en_US-BihUhDmr.jsView on unpkg · L1

Critical

Secret Pattern

OpenSSH private key in resources/fe-dist/assets/en_US-BihUhDmr.js

resources/fe-dist/assets/en_US-BihUhDmr.jsView on unpkg · L1

Long lines were clipped for display.

dist/runtime/cpufeatures-dxrn1j88.nodeView file

•path = dist/runtime/cpufeatures-dxrn1j88.node kind = native_binary sizeBytes = 61424 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/runtime/cpufeatures-dxrn1j88.nodeView on unpkg

dist/runtime/assets/ghostty-vt.wasmView file

•path = dist/runtime/assets/ghostty-vt.wasm kind = wasm_module sizeBytes = 554837 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/runtime/assets/ghostty-vt.wasmView on unpkg

resources/fe-dist/fonts/generated/jetbrains-mono/jetbrains-mono-bold.woff2View file

•path = resources/fe-dist/fonts/generated/jetbrains-mono/jetbrains-mono-bold.woff2 kind = high_entropy_blob sizeBytes = 1046588 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

resources/fe-dist/fonts/generated/jetbrains-mono/jetbrains-mono-bold.woff2View on unpkg

dist/runtime/server.jsView file

•path = dist/runtime/server.js kind = oversized_source_file sizeBytes = 4345373 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/runtime/server.jsView on unpkg

resources/fe-dist/assets/zh_CN-CPdvelFW.jsView file

Lines 1-2javascript

Critical

Secret Pattern

OpenSSH private key in resources/fe-dist/assets/zh_CN-CPdvelFW.js

resources/fe-dist/assets/zh_CN-CPdvelFW.jsView on unpkg · L1

Long lines were clipped for display.

resources/fe-dist/assets/ja_JP-f5sXmz8W.jsView file

Lines 1-2javascript

Critical

Secret Pattern

OpenSSH private key in resources/fe-dist/assets/ja_JP-f5sXmz8W.js

resources/fe-dist/assets/ja_JP-f5sXmz8W.jsView on unpkg · L1

Long lines were clipped for display.