registry / @akanjs/cli / 2.3.8

@akanjs/cli@2.3.8

[Docs](https://akanjs.com/docs) | [npm](https://www.npmjs.com/package/@akanjs/cli) | [Runtime](https://www.npmjs.com/package/akanjs)

Static Scan Results

scanned 9d ago · by rust-scanner

Static analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNativeBindingsNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 107 file(s), 1.15 MB of source, external domains: 127.0.0.1, akanjs.com, cloud.akanjs.com, codespaces.new, github.com, registry.npmjs.org, www.npmjs.com

Source & flagged code

3 flagged

incrementalBuilder.proc.jsView file

Lines 19-59javascript

20// pkgs/@akanjs/devkit/cloud/globalConfig.ts

21import { mkdir } from "fs/promises";

22import dayjs from "dayjs";

24// pkgs/@akanjs/devkit/fileSys.ts

25import { stat } from "fs/promises";

26import { Logger } from "akanjs/common";

28class FileSys {

29 static logger = new Logger("FileSys");

30 static async fileExists(path) {

31 return await Bun.file(path).exists();

32 }

33 static async dirExists(path) {

34 return await stat(path).then((stat2) => stat2.isDirectory()).catch(() => false);

35 }

36 static async exists(path) {

37 return await stat(path).then(() => true).catch(() => false);

38 }

39 static async readText(path) {

40 return await Bun.file(path).text();

41 }

42 static async readJson(path) {

43 try {

44 return await Bun.file(path).json();

45 } catch (error) {

46 FileSys.logger.error(`Failed to read JSON file: ${path}`);

47 throw error;

48 }

49 }

50 static async delete(path) {

51 return await Bun.file(path).delete();

52 }

53 static async writeText(path, content) {

54 return await Bun.file(path).write(content);

55 }

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

incrementalBuilder.proc.jsView on unpkg · L39

56 static async writeJson(path, content) {

57 return await Bun.file(path).write(`${JSON.stringify(content, null, 2)}

58`);

59 }

Lines 644-684javascript

644 return this.#getMarkdownContent(content);

645 }

646 #getMarkdownContent(text) {

647 const searchText = "```markdown";

648 const firstIndex = text.indexOf("```markdown");

649 const lastIndex

Lines 917-957javascript

917ENV NODE_ENV=production

918ENV AKAN_PUBLIC_REPO_NAME=${this.baseDevEnv.repoName}

919ENV AKAN_PUBLIC_SERVE_DOMAIN=${this.baseDevEnv.serveDomain}

920ENV AKAN_PUBLIC_APP_NAME=${this.app.name}

921ENV AKAN_PUBLIC_ENV=${this.baseDevEnv.env}

922${this

Source & flagged code

3 flagged · loading source

incrementalBuilder.proc.jsView file

664spawn as spawn2 L665: } from "child_process"; L666: import { readFileSync as readFileSync3 } from "fs";

High

Child Process

Package source references child process execution.

incrementalBuilder.proc.jsView on unpkg · L664

39Cross-file remote execution chain: incrementalBuilder.proc.js spawns index.js; helper contains network access plus dynamic code execution. L39: static async readText(path) { L40: return await Bun.file(path).text(); L41: } ... L53: static async writeText(path, content) { L54: return await Bun.file(path).write(content); L55: } ... L73: class GlobalConfig { L74: static akanCloudHost = process.env.USE_AKANJS_PKGS === "true" ? `http://localhost:${process.env.CLOUD_HOST_PORT ?? 8283}` : "https://cloud.akanjs.com"; L75: static async#getAkanGlobalConfig() { ... L664: spawn as spawn2 L665: } from "child_process"; L666: import { readFileSync as readFileSync3 } from "fs";

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

incrementalBuilder.proc.jsView on unpkg · L39

937const [configImp, baseDevEnv, libs, rootPackageJson] = await Promise.all([ L938: import(`${app.cwdPath}/akan.config.ts`).then((mod) => mod.default), L939: WorkspaceExecutor.getBaseDevEnv(path.join(app.workspace.workspaceRoot, ".env")),

Medium

Dynamic Require

Package source references dynamic require/import behavior.

incrementalBuilder.proc.jsView on unpkg · L937

Findings

3 High3 Medium3 Low

HighChild ProcessincrementalBuilder.proc.js

HighShell

HighCross File Remote Execution ContextincrementalBuilder.proc.js

MediumDynamic RequireincrementalBuilder.proc.js

MediumNetwork

MediumEnvironment Vars

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

incrementalBuilder.proc.jsView file

Lines 19-59javascript

20// pkgs/@akanjs/devkit/cloud/globalConfig.ts

21import { mkdir } from "fs/promises";

22import dayjs from "dayjs";

24// pkgs/@akanjs/devkit/fileSys.ts

25import { stat } from "fs/promises";

26import { Logger } from "akanjs/common";

28class FileSys {

29 static logger = new Logger("FileSys");

30 static async fileExists(path) {

31 return await Bun.file(path).exists();

32 }

33 static async dirExists(path) {

34 return await stat(path).then((stat2) => stat2.isDirectory()).catch(() => false);

35 }

36 static async exists(path) {

37 return await stat(path).then(() => true).catch(() => false);

38 }

39 static async readText(path) {

40 return await Bun.file(path).text();

41 }

42 static async readJson(path) {

43 try {

44 return await Bun.file(path).json();

45 } catch (error) {

46 FileSys.logger.error(`Failed to read JSON file: ${path}`);

47 throw error;

48 }

49 }

50 static async delete(path) {

51 return await Bun.file(path).delete();

52 }

53 static async writeText(path, content) {

54 return await Bun.file(path).write(content);

55 }

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

incrementalBuilder.proc.jsView on unpkg · L39

56 static async writeJson(path, content) {

57 return await Bun.file(path).write(`${JSON.stringify(content, null, 2)}

58`);

59 }

Lines 644-684javascript

644 return this.#getMarkdownContent(content);

645 }

646 #getMarkdownContent(text) {

647 const searchText = "```markdown";

648 const firstIndex = text.indexOf("```markdown");

649 const lastIndex

Lines 917-957javascript

917ENV NODE_ENV=production

918ENV AKAN_PUBLIC_REPO_NAME=${this.baseDevEnv.repoName}

919ENV AKAN_PUBLIC_SERVE_DOMAIN=${this.baseDevEnv.serveDomain}

920ENV AKAN_PUBLIC_APP_NAME=${this.app.name}

921ENV AKAN_PUBLIC_ENV=${this.baseDevEnv.env}

922${this