registry / uncloud-cli / 0.5.0

uncloud-cli@0.5.0

Deploy apps, provision Postgres, and drive the whole uncloud control plane from your terminal — or from Claude Code.

Static Scan Results

scanned 7d ago · by rust-scanner

Static analysis flagged 5 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessFilesystem

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 1.50 KB of source, external domains: uncloud-cli.vercel.app

Source & flagged code

2 flagged

bin/uncloud.jsView file

Lines 1-30javascript

1#!/usr/bin/env node

2/**

3 * Thin launcher: pick the binary for this platform and hand the process over.

4 *

5 * The Go binaries ship inside the package rather than being fetched in a

6 * postinstall, so `npm i -g @uncloud/cli` works behind a proxy, in a locked-down

7 * CI runner, and from an npm cache with no network at all.

8 */

9"use strict";

11const { spawnSync } = require("child_process");

12const path = require("path");

13const fs = require("fs");

15const platform = process.platform; // darwin | linux

16const arch = process.arch === "x64" ? "amd64" : process.arch; // arm64 passes through

18const binary = path.join(__dirname, "..", "vendor", `${platform}-${arch}`, "uncloud");

20if (!fs.existsSync(binary)) {

21 console.error(

22 `uncloud: no bundled binary for ${platform}/${process.arch}.\n` +

23 `Install directly instead:\n\n` +

24 ` curl -fsSL https://uncloud-cli.vercel.app/install.sh | sh\n`

25 );

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/uncloud.jsView on unpkg · L10

26 process.exit(1);

27}

29// npm does not always preserve the executable bit through a pack/unpack cycle.

30try {

vendor/darwin-amd64/uncloudView file

•path = vendor/darwin-amd64/uncloud kind = native_binary sizeBytes = 6769888 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

vendor/darwin-amd64/uncloudView on unpkg

Source & flagged code

2 flagged · loading source

bin/uncloud.jsView file

10L11: const { spawnSync } = require("child_process"); L12: const path = require("path"); ... L14: L15: const platform = process.platform; // darwin | linux L16: const arch = process.arch === "x64" ? "amd64" : process.arch; // arm64 passes through L17: L18: const binary = path.join(__dirname, "..", "vendor", `${platform}-${arch}`, "uncloud"); L19: ... L23: `Install directly instead:\n\n` + L24: ` curl -fsSL https://uncloud-cli.vercel.app/install.sh | sh\n` L25: );

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code