registry / zevairouter-cli / 1.0.100

zevairouter-cli@1.0.100

ZevaiRouter CLI - Start and manage ZevaiRouter server

Static Scan Results

scanned 17h ago · by rust-scanner

Static analysis flagged 25 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNativeBindingsNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 46 file(s), 673 KB of source, external domains: 127.0.0.1, api.example.com, gist.githubusercontent.com, registry.npmjs.org, www.apple.com

Source & flagged code

16 flagged

package.jsonView file

Lines 1-41json

2 "name": "zevairouter-cli",

3 "version": "1.0.100",

4 "description": "ZevaiRouter CLI - Start and manage ZevaiRouter server",

5 "bin": {

6 "zevai": "./cli.js"

7 },

8 "files": [

9 "cli.js",

10 "src",

11 "hooks",

12 "app",

13 "README.md",

14 "LICENSE"

15 ],

16 "scripts": {

17 "dev": "nodemon -I --watch cli.js --watch src --watch hooks --ext js,json cli.js",

18 "build": "node scripts/build-cli.js",

19 "pack:cli": "npm run build && npm pack --pack-destination ../..",

20 "publish:cli": "npm run build && npm publish",

21 "postinstall": "node hooks/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L21

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L21

22 "prepublishOnly": "npm run build"

23 },

24 "dependencies": {

25 "enquirer": "^2.4.1",

26 "node-forge": "^1.3.3",

27 "node-machine-id": "^1.1.12",

28 "react": "19.2.4",

29 "react-dom": "19.2.4"

30 },

31 "comment_sqlite": "sql.js + better-sqlite3 are NOT bundled here. They are installed into ~/.zevai/runtime/node_modules by hooks/postinstall.js (and re-checked at runtime by cli.js). This avoids Windows EBUSY errors when updating the global CLI, since native .node files no longer live under the locked install dir.",

32 "comment_systray": "systray2 is NOT bundled here. It is lazy-installed into ~/.zevai/runtime/node_modules by hooks/postinstall.js on macOS/Linux only. Windows uses PowerShell NotifyIcon (zero binary). This avoids shipping unsigned Go binaries that trigger antivirus false positives (Kaspersky). We use the systray2 fork because the legacy systray@1.0.5 ships a 2017 x86_64 binary that fails on modern macOS dyld.",

33 "engines": {

34 "node": ">=22.5.0"

35 },

36 "keywords": [

37 "zevairouter",

38 "zevai",

39 "cli",

40 "proxy",

41 "ai",

app/.next-cli-build/server/chunks/2540.jsView file

Lines 1-1javascript

1"use strict";exports.id=2540,exports.ids=[2540],exports.modules={37221:(a,b,c)=>{let

app/cli/hooks/camoufoxRuntime.jsView file

Lines 1-33javascript

1// Ensure camoufox-js (optional stealth Firefox engine) is installed AND its

2// browser binary is downloaded + kept in sync with the JS package.

3//

4// Failure mode we fix for end users (Mac + Ubuntu/Linux + Windows):

5// camoufox-js emits fingerprint keys (e.g. audio:seed) that an *old* cached

6// Camoufox binary rejects → "Unknown property audio:seed in config".

7//

8// Strategy:

9// 1) Install camoufox-js into ~/.zevai/runtime when missing

10// 2) On every process first-use: if binary missing OR package version changed

cli.jsView file

Lines 1-22javascript

1#!/usr/bin/env node

3const { spawn, exec, execSync } = require("child_process");

4const path = require("path");

app/server.jsView file

Lines 1-21javascript

1const path = require('path')

Medium

Dynamic Require

Package source references dynamic require/import behavior.

app/server.jsView on unpkg · L1

3const dir = path.join(__dirname)

app/src/mitm/server.jsView file

Lines 4-44javascript

4${c}`;qt.writeFileSync(n,v)}catch{}},file:n}}$n.exports={log:wu,err:Ru,dumpRequest:Uu,createResponseDumper:Pu,clearDumpDir:Lu}});var Y=F((sh,jn)=>{jn.exports={options:{usePureJavaScript:!1}}});var Jn=F((oh,Xn)=>{var Ba={};Xn.exports=Ba;var Wn={};Ba.encode=function(e,t,a){if(typeof t!="string")throw new TypeError('"alphabet" must be a string.');if(a!==void 0&&typeof a!="number")throw new TypeError('"maxline" must be a number.');var r="";if(!(e instanceof Uint8Array))r=Ou(e,t);else{var n=0,s=t.length,i=t.charAt(0),o=[0];for(n=0;n<e.length;++n){for(var u=0,l=e[n];u<o.length;++u)l+=o[u]<<8,o[u]=l% ...

5`)}return r};Ba.decode=function(e,t){if(typeof e!="string")throw

app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app…View file

•path = [redacted].py kind = build_helper sizeBytes = 4604 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

app/.next-cli-build/static/media/ba9851c3c22cd980-s.woff2View file

•path = app/.next-cli-[redacted]-s.woff2 kind = high_entropy_blob sizeBytes = 25844 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

app/.next-cli-build/static/media/ba9851c3c22cd980-s.woff2View on unpkg

app/cli/app/cli/app/cli/app/cli/app/.next/standalone/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/ap…View file

•path = [redacted]/.[redacted].py kind = payload_in_excluded_dir sizeBytes = 4604 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

app/.next-cli-build/server/chunks/8971.jsView file

1patternName = private_key_rsa severity = critical line = 1 matchedText = "use str...}}};

Critical

Secret Pattern

RSA private key in app/.next-cli-build/server/chunks/8971.js

app/.next-cli-build/server/chunks/8971.jsView on unpkg · L1

Source & flagged code

16 flagged · loading source

package.json

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code