registry / tribenest / 0.6.1

tribenest@0.6.1

tribenest — local dev CLI + MCP server for TribeNest code websites

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

CopyleftLicenseWildcardDependency

scanned 1 file(s), 90.7 KB of source, external domains: 127.0.0.1, admin.tribenest.co, api.tribenest.co

Source & flagged code

2 flagged

dist/index.jsView file

Lines 1-29javascript

1#!/usr/bin/env node

3// src/index.ts

4import { Command } from "commander";

6// src/commands/login.ts

7import { createInterface } from "readline";

8import { hostname } from "os";

9import { createServer } from "http";

10import { spawn } from "child_process";

11import { randomBytes } from "crypto";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L9

13// src/lib/api.ts

14async function request(opts, method, path, body, query) {

15 const url = new URL(path.replace(/^\//, ""), opts.apiUrl.replace(/\/?$/, "/"));

16 if (query) {

17 for (const [k, v] of Object.entries(query)) if (v != null) url.searchParams.set(k, v);

18 }

19 const res = await fetch(url, {

20 method,

21 headers: {

22 ...body ? { "Content-Type": "application/json" } : {},

23 ...opts.token ? { Authorization: `Bearer ${opts.token}` } : {}

24 },

25 body: body ? JSON.stringify(body) : void 0

26 });

27 const text2 = await res.text();

28 const data = text2 ? safeJson(text2) : void 0;

29 if (!res.ok) {

Lines 885-925javascript

885 console.log("Resetting functional pages (/i/) to the current starter\u2026");

886 const { overwritten, removed, forge } = await endpoints.resetInternalPages(o, project.versionId, project.profileId);

887 const nextBaseline = { ...project.files };

888 for (const path of

Source & flagged code

2 flagged · loading source

dist/index.jsView file

9import { createServer } from "http"; L10: import { spawn } from "child_process"; L11: import { randomBytes } from "crypto";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L9

905// src/commands/upgrade.ts L906: import { spawnSync as spawnSync5 } from "child_process"; L907: async function upgrade() { ... L920: throw new Error( L921: "Upgrade failed. Try running it manually:\n npm install -g tribenest@latest\n(you may need sudo, or fix your global npm prefix if it's not writable)." L922: );

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L905

Findings

3 High4 Medium6 Low

HighChild Processdist/index.js

HighShell

HighRuntime Package Installdist/index.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumWildcard Dependency

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowCopyleft License

Source & flagged code

2 flagged

dist/index.jsView file

Lines 1-29javascript

1#!/usr/bin/env node

3// src/index.ts

4import { Command } from "commander";

6// src/commands/login.ts

7import { createInterface } from "readline";

8import { hostname } from "os";

9import { createServer } from "http";

10import { spawn } from "child_process";

11import { randomBytes } from "crypto";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L9

13// src/lib/api.ts

14async function request(opts, method, path, body, query) {

15 const url = new URL(path.replace(/^\//, ""), opts.apiUrl.replace(/\/?$/, "/"));

16 if (query) {

17 for (const [k, v] of Object.entries(query)) if (v != null) url.searchParams.set(k, v);

18 }

19 const res = await fetch(url, {

20 method,

21 headers: {

22 ...body ? { "Content-Type": "application/json" } : {},

23 ...opts.token ? { Authorization: `Bearer ${opts.token}` } : {}

24 },

25 body: body ? JSON.stringify(body) : void 0

26 });

27 const text2 = await res.text();

28 const data = text2 ? safeJson(text2) : void 0;

29 if (!res.ok) {

Lines 885-925javascript

885 console.log("Resetting functional pages (/i/) to the current starter\u2026");

886 const { overwritten, removed, forge } = await endpoints.resetInternalPages(o, project.versionId, project.profileId);

887 const nextBaseline = { ...project.files };

888 for (const path of