registry / @apc-projects/elysia-cli / 0.1.2

@apc-projects/elysia-cli@0.1.2

Générateur de scaffolding pour projets ElysiaJS (modules, services, models, plugins).

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 8 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 15 file(s), 58.9 KB of source

Source & flagged code

3 flagged

src/utils/pm.tsView file

Lines 1-35typescript

1import { spawnSync } from "node:child_process";

2import { log, CliError } from "./logger.js";

High

Child Process

Package source references child process execution.

src/utils/pm.tsView on unpkg · L1

4/**

5 * Installe des dépendances dans le projet courant via `bun add`.

6 * Dédoublonne, ignore la liste vide, et remonte une erreur si l'install échoue.

7 */

8export function installDeps(pkgs: string[], opts: { dev?: boolean } = {}): void {

9 const unique = [...new Set(pkgs)].filter(Boolean);

10 if (!unique.length) return;

12 const devFlag = opts.dev ? ["-d"] : [];

13 log.info(`Installation : bun add ${devFlag.join(" ")} ${unique.join(" ")}`.trim());

14 const res = spawnSync("bun", ["add", ...devFlag, ...unique], {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/utils/pm.tsView on unpkg · L1

15 stdio: "inherit",

16 shell: true,

17 });

High

Shell

Package source references shell execution.

src/utils/pm.tsView on unpkg · L15

18 if (res.error) {

19 throw new CliError("Impossible de lancer `bun add` (Bun est-il installé ?).");

20 }

21 if (res.status !== 0) {

22 throw new CliError("`bun add` a échoué.");

23 }

24}

26/**

27 * Exécute une commande best-effort : logue, ne jette pas si elle échoue

28 * (utile pour les migrations qui nécessitent une base de données joignable).

29 * Retourne `true` si la commande a réussi.

30 */

31export function run(label: string, cmd: string, args: string[]): boolean {

32 log.info(`${label} : ${cmd} ${args.join(" ")}`);

33 const res = spawnSync(cmd, args, { stdio: "inherit", shell: true });

34 if (res.error || res.status !== 0) {

35 log.warn(`Échec de "${label}" — à relancer manuellement.`);

Source & flagged code

3 flagged · loading source

src/utils/pm.tsView file

1import { spawnSync } from "node:child_process"; L2: import { log, CliError } from "./logger.js";

High

Child Process

Package source references child process execution.

src/utils/pm.tsView on unpkg · L1

15stdio: "inherit", L16: shell: true, L17: });

High

Shell

Package source references shell execution.

src/utils/pm.tsView on unpkg · L15

1import { spawnSync } from "node:child_process"; L2: import { log, CliError } from "./logger.js"; ... L12: const devFlag = opts.dev ? ["-d"] : []; L13: log.info(`Installation : bun add ${devFlag.join(" ")} ${unique.join(" ")}`.trim()); L14: const res = spawnSync("bun", ["add", ...devFlag, ...unique], {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/utils/pm.tsView on unpkg · L1

Findings

3 High2 Medium3 Low

HighChild Processsrc/utils/pm.ts

HighShellsrc/utils/pm.ts

HighRuntime Package Installsrc/utils/pm.ts

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

Source & flagged code

3 flagged

src/utils/pm.tsView file

Lines 1-35typescript

1import { spawnSync } from "node:child_process";

2import { log, CliError } from "./logger.js";

High

Child Process

Package source references child process execution.

src/utils/pm.tsView on unpkg · L1

4/**

5 * Installe des dépendances dans le projet courant via `bun add`.

6 * Dédoublonne, ignore la liste vide, et remonte une erreur si l'install échoue.

7 */

8export function installDeps(pkgs: string[], opts: { dev?: boolean } = {}): void {

9 const unique = [...new Set(pkgs)].filter(Boolean);

10 if (!unique.length) return;

12 const devFlag = opts.dev ? ["-d"] : [];

13 log.info(`Installation : bun add ${devFlag.join(" ")} ${unique.join(" ")}`.trim());

14 const res = spawnSync("bun", ["add", ...devFlag, ...unique], {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/utils/pm.tsView on unpkg · L1

15 stdio: "inherit",

16 shell: true,

17 });

High

Shell

Package source references shell execution.

src/utils/pm.tsView on unpkg · L15

18 if (res.error) {

19 throw new CliError("Impossible de lancer `bun add` (Bun est-il installé ?).");

20 }

21 if (res.status !== 0) {

22 throw new CliError("`bun add` a échoué.");

23 }

24}

26/**

27 * Exécute une commande best-effort : logue, ne jette pas si elle échoue

28 * (utile pour les migrations qui nécessitent une base de données joignable).

29 * Retourne `true` si la commande a réussi.

30 */

31export function run(label: string, cmd: string, args: string[]): boolean {

32 log.info(`${label} : ${cmd} ${args.join(" ")}`);

33 const res = spawnSync(cmd, args, { stdio: "inherit", shell: true });

34 if (res.error || res.status !== 0) {

35 log.warn(`Échec de "${label}" — à relancer manuellement.`);