registry / @actuate-media/cli / 0.13.0

@actuate-media/cli@0.13.0

CLI for Actuate CMS — migrations, codegen, imports, exports, and upgrades

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 54 file(s), 297 KB of source, external domains: actuatecms.dev, api.vercel.com, example.com, registry.npmjs.org, updates.actuatecms.com, vercel.com, your-site.com

Source & flagged code

3 flagged

dist/commands/db-status.jsView file

Lines 1-21javascript

1import { execSync } from 'node:child_process';

2import { readFile, access } from 'node:fs/promises';

High

Child Process

Package source references child process execution.

dist/commands/db-status.jsView on unpkg · L1

3import { resolve } from 'node:path';

4import ora from 'ora';

5import chalk from 'chalk';

6import { logger } from '../utils/logger.js';

7import { REQUIRED_CMS_MODELS } from '../deployment/diagnostics.js';

8const CMS_SCHEMA_MARKER = '// ── Actuate CMS models';

9async function fileExists(filePath) {

10 try {

11 await access(filePath);

12 return true;

13 }

14 catch {

15 return false;

16 }

17}

18export function registerDbStatusCommand(program) {

19 program

20 .command('db:status')

21 .description('Check which Actuate CMS models are present in your Prisma schema')

Lines 60-100javascript

60 }

61 else {

62 console.log(` ${chalk.red('✗')} ${model} ${chalk.dim('— missing')}`);

63 missing++;

64 }

65 }

66 console.log();

dist/utils/database.jsView file

Lines 1-41javascript

1import { createRequire } from 'node:module';

2import path from 'node:path';

3import { pathToFileURL } from 'node:url';

4import { findLibPrismaHelper, resolveProjectPrismaClientModule } from './prisma-client-path.js';

5/**

6 * Shared helper for CLI commands that need a live connection to the consumer

Source & flagged code

3 flagged · loading source

dist/commands/db-status.jsView file

1import { execSync } from 'node:child_process'; L2: import { readFile, access } from 'node:fs/promises';

High

Child Process

Package source references child process execution.

dist/commands/db-status.jsView on unpkg · L1

80spinner.start('Checking database connection...'); L81: execSync('npx prisma db execute --stdin --schema ' + JSON.stringify(schemaPath), { L82: input: 'SELECT 1;',

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/commands/db-status.jsView on unpkg · L80

dist/utils/database.jsView file

21export async function connectProjectDatabase() { L22: const { getDB, initDB, isDBInitialized } = await import('@actuate-media/cms-core'); L23: if (isDBInitialized()) {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/utils/database.jsView on unpkg · L21

Findings

3 High4 Medium4 Low

HighChild Processdist/commands/db-status.js

HighShell

HighRuntime Package Installdist/commands/db-status.js

MediumDynamic Requiredist/utils/database.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

dist/commands/db-status.jsView file

Lines 1-21javascript

1import { execSync } from 'node:child_process';

2import { readFile, access } from 'node:fs/promises';

High

Child Process

Package source references child process execution.

dist/commands/db-status.jsView on unpkg · L1

3import { resolve } from 'node:path';

4import ora from 'ora';

5import chalk from 'chalk';

6import { logger } from '../utils/logger.js';

7import { REQUIRED_CMS_MODELS } from '../deployment/diagnostics.js';

8const CMS_SCHEMA_MARKER = '// ── Actuate CMS models';

9async function fileExists(filePath) {

10 try {

11 await access(filePath);

12 return true;

13 }

14 catch {

15 return false;

16 }

17}

18export function registerDbStatusCommand(program) {

19 program

20 .command('db:status')

21 .description('Check which Actuate CMS models are present in your Prisma schema')

Lines 60-100javascript

60 }

61 else {

62 console.log(` ${chalk.red('✗')} ${model} ${chalk.dim('— missing')}`);

63 missing++;

64 }

65 }

66 console.log();

dist/utils/database.jsView file

Lines 1-41javascript

1import { createRequire } from 'node:module';

2import path from 'node:path';

3import { pathToFileURL } from 'node:url';

4import { findLibPrismaHelper, resolveProjectPrismaClientModule } from './prisma-client-path.js';

5/**

6 * Shared helper for CLI commands that need a live connection to the consumer