registry / usher-cli / 2.15.5

usher-cli@2.15.5

A command line app to usher other command line applications

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystem

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 34 file(s), 64.5 KB of source

Source & flagged code

6 flagged

src/v2/tasks/shell.jsView file

Lines 1-24javascript

1'use strict';

3const Promise = require('bluebird');

4const _ = require('lodash');

5const { exec } = require('child_process');

6const split = require('split');

High

Child Process

Package source references child process execution.

src/v2/tasks/shell.jsView on unpkg · L4

8const ACCEPTED_OPTIONS = [

9 'cwd',

10 'env',

11 'shell',

12 'timeout',

13 'maxBuffer',

14 'killSignal',

15 'uid',

16 'gid'

17];

19function reduceEnvArrayToObject(envs) {

20 if (!_.isArray(envs)) {

21 return envs;

22 }

24 return _.reduce(envs, (acc, e) => {

src/v2/commands/setup.jsView file

Lines 38-78javascript

38 includeIsArray: (config) => {

39 if (config.include && !_.isArray(config.include)) {

40 throw new InvalidConfigError("include must be an array");

41 }

42 },

43 includesHaveProperties: (

publish.shView file

•path = publish.sh kind = build_helper sizeBytes = 67 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

publish.shView on unpkg

src/v2/core/state.test.jsView file

Lines 13-98javascript

13 test: 'correct!',

14 other: 'thing'

15 };

16 const nest = [

17 {

18 embryo1: 'mark'

19 },

20 {

21 embryo2: {

Source & flagged code

6 flagged · loading source

src/v2/tasks/shell.jsView file

4const _ = require('lodash'); L5: const { exec } = require('child_process'); L6: const split = require('split');

High

Child Process

Package source references child process execution.

src/v2/tasks/shell.jsView on unpkg · L4

src/v2/commands/setup.jsView file

58(retry) => { L59: return exec(`npm install ${moduleName} --prefix ${installDir()} --allow-git=all`).catch( L60: retry

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/v2/commands/setup.jsView on unpkg · L58

publish.shView file

•path = publish.sh kind = build_helper sizeBytes = 67 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

publish.shView on unpkg

src/v2/core/state.test.jsView file

33patternName = generic_password severity = medium line = 33 matchedText = password...%>',

Medium

Secret Pattern

Hardcoded password in src/v2/core/state.test.js

src/v2/core/state.test.jsView on unpkg · L33

37patternName = generic_password severity = medium line = 37 matchedText = password...rd',

Medium

Secret Pattern

Hardcoded password in src/v2/core/state.test.js

src/v2/core/state.test.jsView on unpkg · L37

78patternName = generic_password severity = medium line = 78 matchedText = password...rd',

Medium

Secret Pattern

Hardcoded password in src/v2/core/state.test.js

src/v2/core/state.test.jsView on unpkg · L78

Findings

2 High6 Medium2 Low

HighChild Processsrc/v2/tasks/shell.js

HighRuntime Package Installsrc/v2/commands/setup.js

MediumEnvironment Vars

MediumShips Build Helperpublish.sh

MediumStructural Risk Force Deep Review

MediumSecret Patternsrc/v2/core/state.test.js

LowScripts Present

LowFilesystem

Source & flagged code

6 flagged

src/v2/tasks/shell.jsView file

Lines 1-24javascript

1'use strict';

3const Promise = require('bluebird');

4const _ = require('lodash');

5const { exec } = require('child_process');

6const split = require('split');

High

Child Process

Package source references child process execution.

src/v2/tasks/shell.jsView on unpkg · L4

8const ACCEPTED_OPTIONS = [

9 'cwd',

10 'env',

11 'shell',

12 'timeout',

13 'maxBuffer',

14 'killSignal',

15 'uid',

16 'gid'

17];

19function reduceEnvArrayToObject(envs) {

20 if (!_.isArray(envs)) {

21 return envs;

22 }

24 return _.reduce(envs, (acc, e) => {

src/v2/commands/setup.jsView file

Lines 38-78javascript

38 includeIsArray: (config) => {

39 if (config.include && !_.isArray(config.include)) {

40 throw new InvalidConfigError("include must be an array");

41 }

42 },

43 includesHaveProperties: (

publish.shView file

•path = publish.sh kind = build_helper sizeBytes = 67 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

publish.shView on unpkg

src/v2/core/state.test.jsView file

Lines 13-98javascript

13 test: 'correct!',

14 other: 'thing'

15 };

16 const nest = [

17 {

18 embryo1: 'mark'

19 },

20 {

21 embryo2: {