registry / @adep/cli / 0.1.1

@adep/cli@0.1.1

`adep` 命令行工具包位：登录 / 初始化 / 本地调试 / 部署 / 数据库维护 / 云存储 / 静态托管 / 微前端组件（widget），实现见任务单 CLI-001 ~ CLI-003 与 FE-002；子路径 `@adep/cli/vite` 提供云函数 vite 插件（CLI-014）

Static Scan Results

scanned 27d ago · by rust-scanner

Static analysis completed at 93.0% confidence. No malicious behavior was detected; 10 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 3 file(s), 388 KB of source, external domains: 127.0.0.1, adep.jajabjbj.top, registry.npmjs.org

Source & flagged code

3 flagged

dist/index.jsView file

Lines 22-62javascript

22 "use strict";

23 }

24});

26// packages/cli/src/credentials.ts

27import { mkdir, open, readFile, rm, stat } from "node:fs/promises";

28import { dirname } from "node:path";

29async function saveCredentials(paths, credentials) {

30 await mkdir(dirname(paths.credentialsFile), { recursive: true });

31 const handle = await open(paths.credentialsFile, "w", 384);

32 try {

33 await handle.writeFile(JSON.stringify(credentials, null, 2));

34 } finally {

35 await handle.close();

36 }

37 await chmodStrict(paths.credentialsFile);

38}

39async function chmodStrict(file) {

40 const info = await stat(file);

41 const mode = info.mode & 511;

42 if (mode !== 384) {

43 const { chmod } = await import("node:fs/promises");

44 await chmod(file, 384);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L42

45 }

46}

47async function loadCredentials(paths) {

48 try {

49 const raw = await readFile(paths.credentialsFile, "utf8");

50 const parsed = JSON.parse(raw);

51 if (typeof parsed["server"] !== "string" || typeof parsed["email"] !== "string" || typeof parsed["encodedToken"] !== "string") {

52 return null;

53 }

54 return {

55 server: parsed["server"],

56 email: parsed["email"],

57 encodedToken: parsed["encodedToken"]

58 };

59 } catch {

60 return null;

61 }

62}

•matchType = previous_version_dangerous_delta matchedPackage = @adep/cli@0.0.4 matchedIdentity = npm:QGFkZXAvY2xp:0.0.4 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg

dist/worker-entry.jsView file

Lines 225-265javascript

225 const bareCache = /* @__PURE__ */ new Map();

226 const entryExports = loadModule(entry, files, sandboxGlobals, cache, resolveBare, bareCache);

227 const

Source & flagged code

3 flagged · loading source

dist/index.jsView file

@adep/cli@0.1.1

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code