Scan report

tabrindle / envinfo

View on GitHub (opens in a new tab)
JavaScript
793 stars
Scanned 24 Sep 2026, 09:46

Report Rescan

Vulnerability Medium

Could an attacker exploit mistakes in this code?

46 risk score

Real issues worth reviewing before you rely on this code.

High: 2
Medium: 21
Low: 0

Sources: Bandit, Semgrep, pip-audit

Malicious pattern Low

Does this code look like it is trying to cause harm?

3 risk score

Minor issues. Worth a glance, unlikely to be urgent.

High: 0
Medium: 0
Low: 24

Sources: YARA, ClamAV, GuardDog, dependency checker

Findings overview

47 total findings

Likely real: 15
Uncertain: 11
Likely noise: 21

The risk classifier rates every finding for how likely it is to be a real issue. Likely noise still counts, just much less.

What we found, in plain English

This repository has a medium vulnerability score of 46, which indicates that some code patterns are insecure and could be exploited by an attacker if they know how to use them. The most significant issues involve potential command injection through child_process calls and regular expression denial-of-service risks in package handling functions. While the scan also identified several low-priority findings related to loose version constraints and system information collection, these appear to be standard security practices rather than signs of malicious intent. Overall, the code contains exploitable vulnerabilities that need attention before it can be considered safe for production use.

Written by a local language model from the findings below. The risk scores come from the classifier, not from this summary.

Detections by engine

Semgrep 23

Pattern-based code analysis · Vulnerability
Dependency checker 21

CVEs, typosquats and risky installs · Supply chain
GuardDog 3

Supply-chain attack heuristics · Malicious pattern

Score over time

Overall score each time this repository was scanned.

Findings

Highest severity first. Select a finding to see the code and what it means.

Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/src/utils.js line 12

Likely real
Yes, 86% confidence

Detected calls to child_process from a function argument `cmd`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed.
```
cmd,
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/src/utils.js line 162

Likely real
Yes, 85% confidence

Detected calls to child_process from a function argument `cmd`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed.
```
.execSync(cmd, {
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/src/packages.js line 256

Likely real
Yes, 100% confidence

RegExp() called with a `packages` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled input, consider performing input validation or use a regex checking/sanitization library such as https://www.npmjs.com/package/recheck to verify that the regex does not appear vulnerable to ReDoS.
```
const globRegex = new RegExp(
        '^' +
          packageGlob
            .replace(/[.+^${}()|[\]\\]/g, '\\$&')
            .replace(/\*/g, '.*')
            .replace(/\?/g, '.') +
          '$'
      );
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/release-please.yml line 25

Likely real
Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
```
uses: actions/checkout@v4
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/node.js.yml line 16

Likely real
Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
```
- uses: actions/checkout@v4
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/node.js.yml line 18

Likely real
Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
```
uses: actions/setup-node@v4
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/node.js.yml line 32

Likely real
Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
```
- uses: actions/checkout@v4
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/node.js.yml line 34

Likely real
Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
```
uses: actions/setup-node@v4
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/node.js.yml line 44

Likely real
Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
```
- uses: actions/checkout@v4
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/node.js.yml line 46

Likely real
Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
```
uses: actions/setup-node@v4
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/release-please.yml line 19

Likely real
Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
```
uses: googleapis/release-please-action@v4
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/release-please.yml line 29

Likely real
Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
```
uses: actions/setup-node@v4
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/src/helpers/sdks.js line 45

Likely real
Uncertain, 37% confidence

Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first.
```
const metaPath = path.join(ndkDir, 'source.properties');
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/src/packages.js line 56

Likely real
Uncertain, 37% confidence

Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first.
```
path.join('node_modules', dep, 'package.json')
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/src/utils.js line 215

Likely real
Uncertain, 37% confidence

Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first.
```
return requireJson(path.join(process.cwd(), 'node_modules', name, 'package.json'));
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/src/utils.js line 219

Likely real
Uncertain, 37% confidence

Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first.
```
return requireJson(path.join(process.cwd(), filePath));
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/src/utils.js line 231

Likely real
Uncertain, 37% confidence

Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first.
```
if (packageGlob) return glob(path.join('node_modules', packageGlob, 'package.json'), cb);
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/src/helpers/browsers.js line 64

Likely real
Uncertain, 37% confidence

Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first.
```
return fs.readdirSync(path.join(base, 'Google/Chrome/Application'));
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/src/packages.js line 166

Likely real
Uncertain, 37% confidence

Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first.
```
packageGlob || '{*,@*/*}',
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/src/utils.js line 45

Likely real
Uncertain, 37% confidence

Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first.
```
(absPath = path.join(process.env.ProgramFiles, `${relExeFilePath}`)),
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/src/utils.js line 50

Likely real
Uncertain, 37% confidence

Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first.
```
(absPath = path.join(process.env['ProgramFiles(x86)'], `${relExeFilePath}`)),
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/src/utils.js line 181

Likely real
Uncertain, 37% confidence

Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first.
```
generatePlistBuddyCommand(path.join(appPath, 'Contents', 'Info.plist'), [
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/src/packages.js line 163

Likely real
Uncertain, 36% confidence

Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first.
```
prefix,
```
Engine
GuardDog · Supply-chain attack heuristics

Counts towards
Malicious pattern

File
/src/helpers/system.js line 62

Likely real
Yes, 93% confidence

Detects active collection of system information (hostname, platform, architecture, user) [threat-runtime-system-info]
```
return version.then(v => {
      info = info || osName(os.platform(), os.release());
      if (v) info += ` ${v}`;
      return ['OS', info];
```
Engine
GuardDog · Supply-chain attack heuristics

Counts towards
Malicious pattern

File
/src/helpers/system.js line 23

Likely real
Yes, 93% confidence

Detects active collection of system information (hostname, platform, architecture, user) [threat-runtime-system-info]
```
const cpus = os.cpus();
      info = '(' + cpus.length + ') ' + os.arch() + ' ' + cpus[0].model;
    } catch (err) {
      utils.log('trace', 'getCPUInfoCatch', err);
```
Engine
GuardDog · Supply-chain attack heuristics

Counts towards
Malicious pattern

File
/src/helpers/system.js line 53

Likely real
Yes, 93% confidence

Detects active collection of system information (hostname, platform, architecture, user) [threat-runtime-system-info]
```
} else if (utils.isWindows) {
      version = Promise.resolve(os.release());
      const release = os.release().split('.');
      if (release[0] === '10' && release[1] === '0' && release[2] >= 22000) {
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 8% confidence

Loose version constraint: 'yamlify-object^0.5.1' — attacker could push malicious update
```
yamlify-object:^0.5.1
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'husky^4.2.5' — attacker could push malicious update
```
husky:^4.2.5
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: '@babel/core^7.2.2' — attacker could push malicious update
```
@babel/core:^7.2.2
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: '@babel/plugin-proposal-optional-chaining^7.2.0' — attacker could push malicious update
```
@babel/plugin-proposal-optional-chaining:^7.2.0
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: '@babel/polyfill^7.2.5' — attacker could push malicious update
```
@babel/polyfill:^7.2.5
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: '@babel/preset-env^7.3.1' — attacker could push malicious update
```
@babel/preset-env:^7.3.1
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: '@commitlint/cli^8.3.5' — attacker could push malicious update
```
@commitlint/cli:^8.3.5
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: '@commitlint/config-conventional^8.3.4' — attacker could push malicious update
```
@commitlint/config-conventional:^8.3.4
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'all-contributors-cli^4.11.1' — attacker could push malicious update
```
all-contributors-cli:^4.11.1
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'babel-loader^8.0.5' — attacker could push malicious update
```
babel-loader:^8.0.5
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'github-release-cli^0.4.1' — attacker could push malicious update
```
github-release-cli:^0.4.1
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'glob^7.1.6' — attacker could push malicious update
```
glob:^7.1.6
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'jest^22.4.3' — attacker could push malicious update
```
jest:^22.4.3
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'minimist^1.2.5' — attacker could push malicious update
```
minimist:^1.2.5
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'os-name^3.1.0' — attacker could push malicious update
```
os-name:^3.1.0
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'oxlint^1.68.0' — attacker could push malicious update
```
oxlint:^1.68.0
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'pkg^4.5.1' — attacker could push malicious update
```
pkg:^4.5.1
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'prettier^1.19.1' — attacker could push malicious update
```
prettier:^1.19.1
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'webpack^5.90.1' — attacker could push malicious update
```
webpack:^5.90.1
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'webpack-cli^5.1.4' — attacker could push malicious update
```
webpack-cli:^5.1.4
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'which^1.2.14' — attacker could push malicious update
```
which:^1.2.14
```