registry / vertu-cli / 2.1.15

vertu-cli@2.1.15

⚠ Under review

Vertu CLI - domain shortcuts and bundled agent skills for Cursor / Claude Code / Trae.

Static Scan Results

scanned 5h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystem

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 0 file(s), 256 KB of source, external domains: jimmy.warting.se

Oversized source lightweight scan

dist/vertu-cli.cjs2.22 MB file, sampled 256 KB

FilesystemChildProcessEnvironmentVarsHighEntropyStringsUrlStringsjimmy.warting.se

Source & flagged code

5 flagged

dist/vertu-cli.cjsView file

28121function install() { L28122: globalThis.fetch = module2.exports.fetch; L28123: globalThis.Headers = module2.exports.Headers; ... L28125: globalThis.Request = module2.exports.Request; L28126: globalThis.FormData = module2.exports.FormData; L28127: globalThis.WebSocket = module2.exports.WebSocket; L28128: globalThis.CloseEvent = module2.exports.CloseEvent;

Critical

Builtin Api Tampering Exfiltration

Source mutates builtin networking, serialization, module-loading, or filesystem APIs while forwarding data to an external endpoint.

dist/vertu-cli.cjsView on unpkg · L28121

47739Trigger-reachable chain: manifest.bin -> dist/vertu-cli.cjs L47739: const shell = opts.shell ?? merged.shell ?? "bash"; L47740: if (shell === "powershell") { L47741: const esc = (s) => s.replace(/'/g, "''"); ... L47747: } L47748: process.stdout.write(formatAgentEnvExports(serviceUrl, appId, appKey, login)); L47749: }); ... L47753: // src/core/im-client.ts L47754: var import_undici5 = __toESM(require_undici(), 1); L47755: function headers() {

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/vertu-cli.cjsView on unpkg · L47739

1155var EventEmitter = require("events").EventEmitter; L1156: var childProcess = require("child_process"); L1157: var path3 = require("path");

High

Child Process

Package source references child process execution.

dist/vertu-cli.cjsView on unpkg · L1155

47739const shell = opts.shell ?? merged.shell ?? "bash"; L47740: if (shell === "powershell") { L47741: const esc = (s) => s.replace(/'/g, "''"); ... L47747: } L47748: process.stdout.write(formatAgentEnvExports(serviceUrl, appId, appKey, login)); L47749: }); ... L47753: // src/core/im-client.ts L47754: var import_undici5 = __toESM(require_undici(), 1); L47755: function headers() {

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/vertu-cli.cjsView on unpkg · L47739

scripts/install-onboard-skill.shView file

•path = scripts/install-onboard-skill.sh kind = build_helper sizeBytes = 2218 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/install-onboard-skill.shView on unpkg

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code