registry / @aldenwangexis/yx-cli / 1.7.0

@aldenwangexis/yx-cli@1.7.0

Yunxiao command line client

Static Scan Results

scanned 5h ago · by rust-scanner

Static analysis flagged 7 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystem

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 5 file(s), 5.83 KB of source

Source & flagged code

3 flagged

bin/yx.jsView file

Lines 1-40javascript

1#!/usr/bin/env node

2"use strict";

4const { spawnSync } = require("node:child_process");

5const fs = require("node:fs");

High

Child Process

Package source references child process execution.

bin/yx.jsView on unpkg · L3

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/yx.jsView on unpkg · L3

6const path = require("node:path");

7const { platformPackageFor } = require("../scripts/packages");

9const pkg = require("../package.json");

10const platformPackage = platformPackageFor(process.platform, process.arch);

11let packageRoot;

13try {

14 packageRoot = path.dirname(require.resolve(`${platformPackage.name}/package.json`));

15} catch (error) {

16 const localPackageRoot = path.join(__dirname, "..", "..", platformPackage.directory);

17 if (fs.existsSync(path.join(localPackageRoot, "package.json"))) {

18 packageRoot = localPackageRoot;

19 } else {

20 console.error(`yx npm wrapper could not find platform package ${platformPackage.name}.`);

21 console.error("Try reinstalling: npm install -g @aldenwangexis/yx-cli");

22 process.exit(1);

23 }

24}

26const binaryPath = path.join(packageRoot, "bin", platformPackage.binary);

28if (!fs.existsSync(binaryPath)) {

29 console.error(`yx npm wrapper could not find installed binary at ${binaryPath}`);

30 console.error("Try reinstalling: npm install -g @aldenwangexis/yx-cli");

31 process.exit(1);

32}

34const result = spawnSync(binaryPath, process.argv.slice(2), {

35 stdio: "inherit",

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/yx.jsView on unpkg · L20

36 env: {

37 ...process.env,

38 YX_INSTALL_CHANNEL: "npm",

39 YX_NPM_PACKAGE: pkg.name,

40 YX_NPM_PLATFORM_PACKAGE: platformPackage.name,

Source & flagged code

3 flagged · loading source

bin/yx.jsView file

3L4: const { spawnSync } = require("node:child_process"); L5: const fs = require("node:fs");

High

Child Process

Package source references child process execution.

bin/yx.jsView on unpkg · L3

20console.error(`yx npm wrapper could not find platform package ${platformPackage.name}.`); L21: console.error("Try reinstalling: npm install -g @aldenwangexis/yx-cli"); L22: process.exit(1); ... L33: L34: const result = spawnSync(binaryPath, process.argv.slice(2), { L35: stdio: "inherit",

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/yx.jsView on unpkg · L20

3L4: const { spawnSync } = require("node:child_process"); L5: const fs = require("node:fs");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/yx.jsView on unpkg · L3

Findings

2 High3 Medium2 Low

HighChild Processbin/yx.js

HighRuntime Package Installbin/yx.js

MediumDynamic Requirebin/yx.js

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

Source & flagged code

3 flagged

bin/yx.jsView file

Lines 1-40javascript

1#!/usr/bin/env node

2"use strict";

4const { spawnSync } = require("node:child_process");

5const fs = require("node:fs");

High

Child Process

Package source references child process execution.

bin/yx.jsView on unpkg · L3

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/yx.jsView on unpkg · L3

6const path = require("node:path");

7const { platformPackageFor } = require("../scripts/packages");

9const pkg = require("../package.json");

10const platformPackage = platformPackageFor(process.platform, process.arch);

11let packageRoot;

13try {

14 packageRoot = path.dirname(require.resolve(`${platformPackage.name}/package.json`));

15} catch (error) {

16 const localPackageRoot = path.join(__dirname, "..", "..", platformPackage.directory);

17 if (fs.existsSync(path.join(localPackageRoot, "package.json"))) {

18 packageRoot = localPackageRoot;

19 } else {

20 console.error(`yx npm wrapper could not find platform package ${platformPackage.name}.`);

21 console.error("Try reinstalling: npm install -g @aldenwangexis/yx-cli");

22 process.exit(1);

23 }

24}

26const binaryPath = path.join(packageRoot, "bin", platformPackage.binary);

28if (!fs.existsSync(binaryPath)) {

29 console.error(`yx npm wrapper could not find installed binary at ${binaryPath}`);

30 console.error("Try reinstalling: npm install -g @aldenwangexis/yx-cli");

31 process.exit(1);

32}

34const result = spawnSync(binaryPath, process.argv.slice(2), {

35 stdio: "inherit",

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/yx.jsView on unpkg · L20

36 env: {

37 ...process.env,

38 YX_INSTALL_CHANNEL: "npm",

39 YX_NPM_PACKAGE: pkg.name,

40 YX_NPM_PLATFORM_PACKAGE: platformPackage.name,