registry / @antjs.org/colony / 0.0.1

@antjs.org/colony@0.0.1

Deploy Ant apps to ants.page (console.antjs.org)

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 8 file(s), 27.6 KB of source, external domains: console.antjs.org

Source & flagged code

2 flagged

dist/auth.jsView file

Lines 24-64javascript

24 };

25 return ownKeys(o);

26 };

27 return function (mod) {

28 if (mod && mod.__esModule) return mod;

29 var result =

Source & flagged code

2 flagged · loading source

dist/auth.jsView file

44const path = __importStar(require("node:path")); L45: const node_child_process_1 = require("node:child_process"); L46: const utils_1 = require("./utils");

High

Child Process

Package source references child process execution.

dist/auth.jsView on unpkg · L44

dist/commands.jsView file

33if (result.error?.code === 'ENOENT') L34: result = (0, node_child_process_1.spawnSync)('npx', ['--yes', 'antland', 'install'], { stdio: 'inherit' }); L35: if (result.error || result.status !== 0)

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/commands.jsView on unpkg · L33

Findings

2 High3 Medium4 Low

HighChild Processdist/auth.js

HighRuntime Package Installdist/commands.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

dist/commands.jsView file

Lines 13-53javascript

13const utils_1 = require("./utils");

14function ensureDeps() {

15 if (!(0, node_fs_1.existsSync)('package.json'))

16 return;

17 let manifest;

18 try {

19 manifest = JSON.parse((0, node_fs_1.readFileSync)('package.json', 'utf-8'));

20 }

21 catch (error) {

22 throw new Error(`could not read package.json: ${error instanceof Error ? error.message : String(error)}`);

23 }

24 if (typeof manifest !== 'object' || manifest === null || Array.isArray(manifest))

25 throw new Error('package.json must contain an object.');

26 const deps = manifest.dependencies;

27 if (deps !== undefined && (typeof deps !== 'object' || deps === null || Array.isArray(deps)))

28 throw new Error('package.json `dependencies` must contain an object.');

29 if (!deps || Object.keys(deps).length === 0 || (0, node_fs_1.existsSync)('node_modules'))

30 return;

31 console.log((0, utils_1.styleText)('dim', 'Installing deps from ants.land (antland install)…'));

32 let result = (0, node_child_process_1.spawnSync)('antland', ['install'], { stdio: 'inherit' });

33 if (result.error?.code === 'ENOENT')

34 result = (0, node_child_process_1.spawnSync)('npx', ['--yes', 'antland', 'install'], { stdio: 'inherit' });

35 if (result.error || result.status !== 0)

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/commands.jsView on unpkg · L33

36 throw new Error('could not vendor deps — run `antland install` manually, then `colony deploy`.');

37}

38async function deploy() {

39 const cfg = (0, config_1.loadColonyToml)();

40 ensureDeps();

41 console.log(`Building ${(0, utils_1.styleText)('cyan', cfg.name)} ${(0, utils_1.styleText)('dim', `(${cfg.main})`)}…`);

42 const bytes = await (0, build_1.bundle)(cfg.main);

43 const script = new TextDecoder().decode(bytes);

44 const hash = (0, utils_1.sha256hex)(bytes);

45 const migrations = {};

46 for (const b of cfg.bindings) {

47 if (b.kind === 'sql' && b.migrationsDir) {

48 const m = (0, build_1.collectMigrations)(b.migrationsDir);

49 if (m.length)

50 migrations[b.binding] = m;

51 }

52 }

53 let assets = [];