registry / @axyl-tcb/create-template / 1.4.1

@axyl-tcb/create-template@1.4.1

Axyl TCB Cloud Function 프로젝트 스캐폴딩 CLI (npm create @axyl-tcb/template)

Static Scan Results

scanned 12d ago · by rust-scanner

Static analysis flagged 7 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessFilesystemShell

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 26 file(s), 64.2 KB of source

Source & flagged code

2 flagged

template/scripts/deploy.jsView file

Lines 1-34javascript

1'use strict';

3/**

4 * TCB 배포 스크립트

5 *

6 * .env 파일에서 환경변수를 읽어 cloudbaserc.json 의 envVariables 에 임시 주입 후 배포합니다.

7 * 배포 완료(또는 실패) 후 cloudbaserc.json 을 원본으로 복원합니다.

8 *

9 * 사용법:

10 * npm run deploy → 전체 배포 (확인 프롬프트 있음)

11 * npm run deploy -- grantItem → 특정 함수만 배포

12 */

14const { readFileSync, writeFileSync, existsSync } = require('fs');

15const { execSync } = require('child_process');

16const readline = require('readline');

High

Child Process

Package source references child process execution.

template/scripts/deploy.jsView on unpkg · L14

18// ── .env 파싱 ──────────────────────────────────────────────────────────────

20function parseEnv(content) {

21 const result = {};

22 for (const line of content.split('\n')) {

23 const trimmed = line.trim();

24 if (!trimmed || trimmed.startsWith('#')) continue;

25 const idx = trimmed.indexOf('=');

26 if (idx === -1) continue;

27 const key = trimmed.slice(0, idx).trim();

28 result[key] = trimmed.slice(idx + 1).trim().replace(/^["']|["']$/g, '');

29 }

30 return result;

31}

33// ── 검증 ───────────────────────────────────────────────────────────────────

lib/scaffold.jsView file

Lines 307-336javascript

307 // README.md 프로젝트명 교체 (h1 제목 + 프로젝트 구조 트리)

308 const readmePath = path.join(targetDir, 'README.md');

309 if (fs.existsSync(readmePath)) {

310 let readme = fs.readFileSync(readmePath, 'utf8');

311 readme = readme.replace

Source & flagged code

2 flagged · loading source

template/scripts/deploy.jsView file

14const { readFileSync, writeFileSync, existsSync } = require('fs'); L15: const { execSync } = require('child_process'); L16: const readline = require('readline');

High

Child Process

Package source references child process execution.

template/scripts/deploy.jsView on unpkg · L14

lib/scaffold.jsView file

327// funding 안내가 뜨면 신입이 불필요하게 놀라므로 억제한다(별도로 안내·문서화함). L328: execSync('npm install --no-audit --no-fund', { cwd: targetDir, stdio: 'inherit' }); L329: return true;

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

lib/scaffold.jsView on unpkg · L327

Findings

3 High1 Medium3 Low

HighChild Processtemplate/scripts/deploy.js

HighShell

HighRuntime Package Installlib/scaffold.js

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

Source & flagged code

2 flagged

template/scripts/deploy.jsView file

Lines 1-34javascript

1'use strict';

3/**

4 * TCB 배포 스크립트

5 *

6 * .env 파일에서 환경변수를 읽어 cloudbaserc.json 의 envVariables 에 임시 주입 후 배포합니다.

7 * 배포 완료(또는 실패) 후 cloudbaserc.json 을 원본으로 복원합니다.

8 *

9 * 사용법:

10 * npm run deploy → 전체 배포 (확인 프롬프트 있음)

11 * npm run deploy -- grantItem → 특정 함수만 배포

12 */

14const { readFileSync, writeFileSync, existsSync } = require('fs');

15const { execSync } = require('child_process');

16const readline = require('readline');

High

Child Process

Package source references child process execution.

template/scripts/deploy.jsView on unpkg · L14

20function parseEnv(content) {

21 const result = {};

22 for (const line of content.split('\n')) {

23 const trimmed = line.trim();

24 if (!trimmed || trimmed.startsWith('#')) continue;

25 const idx = trimmed.indexOf('=');

26 if (idx === -1) continue;

27 const key = trimmed.slice(0, idx).trim();

28 result[key] = trimmed.slice(idx + 1).trim().replace(/^["']|["']$/g, '');

29 }

30 return result;

31}

lib/scaffold.jsView file

Lines 307-336javascript

307 // README.md 프로젝트명 교체 (h1 제목 + 프로젝트 구조 트리)

308 const readmePath = path.join(targetDir, 'README.md');

309 if (fs.existsSync(readmePath)) {

310 let readme = fs.readFileSync(readmePath, 'utf8');

311 readme = readme.replace