registry / @aws/ml-container-creator / 1.0.4

@aws/ml-container-creator@1.0.4

Build and deploy custom ML containers on AWS SageMaker with minimal configuration.

Static Scan Results

scanned 15d ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 121 file(s), 1.39 MB of source, external domains: aws.amazon.com, awscli.amazonaws.com, console.aws.amazon.com, docs.aws.amazon.com, docs.vllm.ai, github.com, hub.docker.com, huggingface.co, json-schema.org, ngc.nvidia.com, nvidia.github.io, onnxruntime.ai, raw.githubusercontent.com, sgl-project.github.io

Source & flagged code

5 flagged

src/lib/e2e-bootstrap.jsView file

Lines 1-35javascript

2// SPDX-License-Identifier: Apache-2.0

4/**

5 * E2E Bootstrap Integration

6 *

7 * Handles the `bootstrap --ci --e2e` flow:

8 * 1. Loads the e2e catalog

9 * 2. Runs quota validation for the CI tier and emits warnings

10 * 3. Deploys the config/bootstrap-e2e-stack.json CloudFormation stack

11 * 4. Stores e2e config (bucket, SNS ARN, CodeBuild project name) in bootstrap config

12 *

13 * Requirements: 3.3, 3.4

14 */

16import { execSync } from 'node:child_process';

17import { readFileSync } from 'node:fs';

High

Child Process

Package source references child process execution.

src/lib/e2e-bootstrap.jsView on unpkg · L15

18import path from 'node:path';

19import { fileURLToPath } from 'node:url';

20import { validateQuotas } from './e2e-quota-validator.js';

21import { validateCatalog } from './e2e-catalog-validator.js';

22import BootstrapConfig from './bootstrap-config.js';

24const __filename = fileURLToPath(import.meta.url);

25const __dirname = path.dirname(__filename);

27const E2E_STACK_NAME = 'mlcc-bootstrap-e2e';

28const E2E_STACK_TEMPLATE_PATH = path.resolve(__dirname, '../../config/bootstrap-e2e-stack.json');

29const DEFAULT_CATALOG_PATH = path.resolve(__dirname, '../../scripts/e2e-catalog.json');

31/**

32 * Bootstrap E2E infrastructure.

33 *

34 * Loads the catalog, validates quotas for the CI tier, deploys the

35 * CloudFormation stack, and stores e2e config in the bootstrap profile.

src/lib/bootstrap-command-handler.jsView file

Lines 224-264javascript

224 let createS3Buckets = false;

225 if (nonInteractive && (options['skip-s3'] || options.skipS3)) {

226 console.log(' ⏭️ Skipping S3 bucket creation (--skip-s3)');

227 } else if (nonInteractive) {

228 createS3Buckets =

templates/test/test_local_image.shView file

•path = templates/test/test_local_image.sh kind = payload_in_excluded_dir sizeBytes = 2118 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

templates/test/test_local_image.shView on unpkg

•path = templates/test/test_local_image.sh kind = build_helper sizeBytes = 2118 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/test/test_local_image.shView on unpkg

Source & flagged code

5 flagged · loading source

src/lib/e2e-bootstrap.jsView file

15L16: import { execSync } from 'node:child_process'; L17: import { readFileSync } from 'node:fs';

High

Child Process

Package source references child process execution.

src/lib/e2e-bootstrap.jsView on unpkg · L15

src/lib/bootstrap-command-handler.jsView file

244try { L245: const existingStacks = this._execAws( L246: `cloudformation list-stacks --stack-status-filter CREATE_COMPLETE UPDATE_COMPLETE UPDATE_ROLLBACK_COMPLETE --query "StackSummaries[?starts_with(StackName,'${STACK_NAME_PREFIX}-')]....

High

Shell

Package source references shell execution.

src/lib/bootstrap-command-handler.jsView on unpkg · L244

416try { L417: execSync( L418: `npx cdk bootstrap aws://${profileData.accountId}/${profileData.awsRegion}`, L419: {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/lib/bootstrap-command-handler.jsView on unpkg · L416

templates/test/test_local_image.shView file

•path = templates/test/test_local_image.sh kind = payload_in_excluded_dir sizeBytes = 2118 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

templates/test/test_local_image.shView on unpkg

•path = templates/test/test_local_image.sh kind = build_helper sizeBytes = 2118 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/test/test_local_image.shView on unpkg

Findings

4 High4 Medium5 Low

HighChild Processsrc/lib/e2e-bootstrap.js

HighShellsrc/lib/bootstrap-command-handler.js

HighRuntime Package Installsrc/lib/bootstrap-command-handler.js

HighPayload In Excluded Dirtemplates/test/test_local_image.sh

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helpertemplates/test/test_local_image.sh

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

5 flagged

src/lib/e2e-bootstrap.jsView file

Lines 1-35javascript

2// SPDX-License-Identifier: Apache-2.0

4/**

5 * E2E Bootstrap Integration

6 *

7 * Handles the `bootstrap --ci --e2e` flow:

8 * 1. Loads the e2e catalog

9 * 2. Runs quota validation for the CI tier and emits warnings

10 * 3. Deploys the config/bootstrap-e2e-stack.json CloudFormation stack

11 * 4. Stores e2e config (bucket, SNS ARN, CodeBuild project name) in bootstrap config

12 *

13 * Requirements: 3.3, 3.4

14 */

16import { execSync } from 'node:child_process';

17import { readFileSync } from 'node:fs';

High

Child Process

Package source references child process execution.

src/lib/e2e-bootstrap.jsView on unpkg · L15

18import path from 'node:path';

19import { fileURLToPath } from 'node:url';

20import { validateQuotas } from './e2e-quota-validator.js';

21import { validateCatalog } from './e2e-catalog-validator.js';

22import BootstrapConfig from './bootstrap-config.js';

24const __filename = fileURLToPath(import.meta.url);

25const __dirname = path.dirname(__filename);

27const E2E_STACK_NAME = 'mlcc-bootstrap-e2e';

28const E2E_STACK_TEMPLATE_PATH = path.resolve(__dirname, '../../config/bootstrap-e2e-stack.json');

29const DEFAULT_CATALOG_PATH = path.resolve(__dirname, '../../scripts/e2e-catalog.json');

31/**

32 * Bootstrap E2E infrastructure.

33 *

34 * Loads the catalog, validates quotas for the CI tier, deploys the

35 * CloudFormation stack, and stores e2e config in the bootstrap profile.

src/lib/bootstrap-command-handler.jsView file

Lines 224-264javascript

224 let createS3Buckets = false;

225 if (nonInteractive && (options['skip-s3'] || options.skipS3)) {

226 console.log(' ⏭️ Skipping S3 bucket creation (--skip-s3)');

227 } else if (nonInteractive) {

228 createS3Buckets =

templates/test/test_local_image.shView file

•path = templates/test/test_local_image.sh kind = payload_in_excluded_dir sizeBytes = 2118 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

templates/test/test_local_image.shView on unpkg

•path = templates/test/test_local_image.sh kind = build_helper sizeBytes = 2118 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/test/test_local_image.shView on unpkg

Lines 396-436javascript

396 console.log(`❌ CI infrastructure already deployed in region ${ciConflict.config.awsRegion} (profile: ${ciConflict.name}).`);

397 console.log(' CI can only be deployed in one region per account.');

398 provisionCi = false;

399 }

400 }

401

402 if (provisionCi) {

403 // Persist CI intent immediately so that `bootstrap update --ci` can

404 // retry if the CDK deploy fails. Don't wait for success.

405 profileData.ciInfraProvisioned = true;

406 profileData.ciTableName = profileData.ciTableName || 'mlcc-ci-table';

407

408 // Ensure CDK is bootstrapped in this account/region

409 const cdkBootstrapped = this._resourceExists(

410 `ssm get-parameter --name /cdk-bootstrap/hnb659fds/version --region ${profileData.awsRegion}`,

411 profileData.awsProfile

412 );

413

414 if (!cdkBootstrapped) {

415 console.log(' 📦 CDK has not been bootstrapped in this account/region — bootstrapping now...');

416 try {

417 execSync(

418 `npx cdk bootstrap aws://${profileData.accountId}/${profileData.awsRegion}`,

419 {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/lib/bootstrap-command-handler.jsView on unpkg · L416

420 encoding: 'utf8',

421 stdio: 'inherit',

422 env: {

423 ...process.env,

424 AWS_PROFILE: profileData.awsProfile

425 }

426 }

427 );

428 console.log(' ✅ CDK bootstrap complete');

429 } catch (cdkErr) {

430 console.log(` ❌ CDK bootstrap failed: ${cdkErr.message}`);

431 console.log(` Run manually: npx cdk bootstrap aws://${profileData.accountId}/${profileData.awsRegion} --profile ${profileData.awsProfile}`);

432 throw cdkErr;

433 }

434 }

435

436 // Check if CI stack already exists — deploy or update