registry / @backtest-kit/cli / 15.4.0

@backtest-kit/cli@15.4.0

Zero-boilerplate CLI runner for backtest-kit strategies. Run backtests, paper trading, and live bots with candle cache warming, web dashboard, and Telegram notifications — no setup code required.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 12 file(s), 398 KB of source, external domains: raw.githubusercontent.com

Source & flagged code

6 flagged

build/index.cjsView file

Lines 1-33javascript

1#!/usr/bin/env node

2'use strict';

4var BacktestKit = require('backtest-kit');

5var functoolsKit = require('functools-kit');

6var fs = require('fs');

7var stackTrace = require('stack-trace');

8var path = require('path');

9var fs$1 = require('fs/promises');

10var dotenv = require('dotenv');

11var diKit = require('di-kit');

12var url = require('url');

13var util = require('util');

14var child_process = require('child_process');

15var BacktestKitUi = require('@backtest-kit/ui');

High

Child Process

Package source references child process execution.

build/index.cjsView on unpkg · L13

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

build/index.cjsView on unpkg · L13

16var QuickChart = require('quickchart-js');

17var telegraf = require('telegraf');

18var imageSize = require('image-size');

19var resizeImg = require('resize-image-buffer');

20var stream = require('stream');

21var MarkdownIt = require('markdown-it');

22var sanitizeHtml = require('sanitize-html');

23var jsdom = require('jsdom');

24var Mustache = require('mustache');

25var standalone = require('@babel/standalone');

26var pluginUMD = require('@babel/plugin-transform-modules-umd');

27var Module = require('module');

28var BacktestKitGraph = require('@backtest-kit/graph');

29var BacktestKitOllama = require('@backtest-kit/ollama');

30var BacktestKitPinets = require('@backtest-kit/pinets');

31var BacktestKitSignals = require('@backtest-kit/signals');

32var open = require('open');

Lines 2950-2990javascript

2950/**

2951 * This file is used to define any aliases for imports in the client code. This is useful for mocking modules during testing or for providing alternative implementations of certain modules.

2952 * For example, if we want to mock the "pinets" module during testing, we can add an entry to the IMPORT_ALIAS object that points to our mock implementation. Then, when the client code tries to import "pinets", it will receive our mock implementation instead of the actual "pinets" module.

2953 * This allows us to isolate the client code from external dependencies and test it more effectively.

2954 * Note that the keys in the IMPORT_ALIAS object should match the module names used in the client code, and the values should be the corresponding mock implementations or alternative modules.

2955 * @example

2956 * // To mock the "pinets" module, we can add the following entry to the IMPORT_ALIAS object:

2957 * Object.assign(IMPORT_ALIAS, {

2958 * "pinets": require("pinets/dist/pinets.min.browser.js"),

2959 * });

Lines 4508-4548javascript

4508 console.log(` -> ${destPath}`);

4509 }

4510 }

4511}

4512function runScript(scriptPath, cwd) {

4513 return new Promise((resolve, reject) => {

4514 const

build/index.mjsView file

Lines 4476-4516javascript

4476 console.log(` -> ${destPath}`);

4477 }

4478 }

4479}

4480function runScript(scriptPath, cwd) {

4481 return new Promise((resolve, reject)

template/project/config/symbol.config.tsView file

Lines 1-21typescript

1const { str } = require("functools-kit");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

template/project/config/symbol.config.tsView on unpkg · L1

3const symbol_list = [

4 // Priority 50: Premium

5 {

6 icon: "/icon/btc.png"

Source & flagged code

6 flagged · loading source

build/index.cjsView file

13var util = require('util'); L14: var child_process = require('child_process'); L15: var BacktestKitUi = require('@backtest-kit/ui');

High

Child Process

Package source references child process execution.

build/index.cjsView on unpkg · L13

13Cross-file remote execution chain: build/index.cjs spawns build/index.mjs; helper contains network access plus dynamic code execution. L13: var util = require('util'); L14: var child_process = require('child_process'); L15: var BacktestKitUi = require('@backtest-kit/ui'); ... L154: message: functoolsKit.getErrorMessage(error), L155: data: functoolsKit.errorData(error), L156: }, null, 2); ... L407: const __filename$3 = url.fileURLToPath((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tag... L408: const __dirname$3 = path.dirname(__filename$3); L409: let _is_launched = false; ... L940: let allData = ""; L941: ps.stdout.on("data", (data) => { L942: allData += data.toString("ascii");

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

build/index.cjsView on unpkg · L13

4528const npm = process.platform === "win32" ? "npm.cmd" : "npm"; L4529: const child = child_process.spawn(npm, ["install"], { cwd, stdio: "inherit", shell: true }); L4530: child.on("close", (code) => { L4531: if (code !== 0) { L4532: reject(new Error(`npm install exited with code ${code}`)); L4533: return;

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

build/index.cjsView on unpkg · L4528

2970try { L2971: eval(self.params.babel.transpile(code, path)); L2972: }

Low

Eval

Package source references a known benign dynamic code generation pattern.

build/index.cjsView on unpkg · L2970

build/index.mjsView file

4496const npm = process.platform === "win32" ? "npm.cmd" : "npm"; L4497: const child = spawn(npm, ["install"], { cwd, stdio: "inherit", shell: true }); L4498: child.on("close", (code) => {

High

Shell

Package source references shell execution.

build/index.mjsView on unpkg · L4496

template/project/config/symbol.config.tsView file

1const { str } = require("functools-kit"); L2:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

template/project/config/symbol.config.tsView on unpkg · L1

Findings

4 High4 Medium5 Low

HighChild Processbuild/index.cjs

HighShellbuild/index.mjs

HighCross File Remote Execution Contextbuild/index.cjs

HighRuntime Package Installbuild/index.cjs

MediumDynamic Requiretemplate/project/config/symbol.config.ts

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvalbuild/index.cjs

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

6 flagged

build/index.cjsView file

Lines 1-33javascript

1#!/usr/bin/env node

2'use strict';

4var BacktestKit = require('backtest-kit');

5var functoolsKit = require('functools-kit');

6var fs = require('fs');

7var stackTrace = require('stack-trace');

8var path = require('path');

9var fs$1 = require('fs/promises');

10var dotenv = require('dotenv');

11var diKit = require('di-kit');

12var url = require('url');

13var util = require('util');

14var child_process = require('child_process');

15var BacktestKitUi = require('@backtest-kit/ui');

High

Child Process

Package source references child process execution.

build/index.cjsView on unpkg · L13

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

build/index.cjsView on unpkg · L13

16var QuickChart = require('quickchart-js');

17var telegraf = require('telegraf');

18var imageSize = require('image-size');

19var resizeImg = require('resize-image-buffer');

20var stream = require('stream');

21var MarkdownIt = require('markdown-it');

22var sanitizeHtml = require('sanitize-html');

23var jsdom = require('jsdom');

24var Mustache = require('mustache');

25var standalone = require('@babel/standalone');

26var pluginUMD = require('@babel/plugin-transform-modules-umd');

27var Module = require('module');

28var BacktestKitGraph = require('@backtest-kit/graph');

29var BacktestKitOllama = require('@backtest-kit/ollama');

30var BacktestKitPinets = require('@backtest-kit/pinets');

31var BacktestKitSignals = require('@backtest-kit/signals');

32var open = require('open');

Lines 2950-2990javascript

2950/**

2951 * This file is used to define any aliases for imports in the client code. This is useful for mocking modules during testing or for providing alternative implementations of certain modules.

2953 * This allows us to isolate the client code from external dependencies and test it more effectively.

2954 * Note that the keys in the IMPORT_ALIAS object should match the module names used in the client code, and the values should be the corresponding mock implementations or alternative modules.

2955 * @example

2956 * // To mock the "pinets" module, we can add the following entry to the IMPORT_ALIAS object:

2957 * Object.assign(IMPORT_ALIAS, {

2958 * "pinets": require("pinets/dist/pinets.min.browser.js"),

2959 * });

Lines 4508-4548javascript

4508 console.log(` -> ${destPath}`);

4509 }

4510 }

4511}

4512function runScript(scriptPath, cwd) {

4513 return new Promise((resolve, reject) => {

4514 const

build/index.mjsView file

Lines 4476-4516javascript

4476 console.log(` -> ${destPath}`);

4477 }

4478 }

4479}

4480function runScript(scriptPath, cwd) {

4481 return new Promise((resolve, reject)

template/project/config/symbol.config.tsView file

Lines 1-21typescript

1const { str } = require("functools-kit");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

template/project/config/symbol.config.tsView on unpkg · L1

3const symbol_list = [

4 // Priority 50: Premium

5 {

6 icon: "/icon/btc.png"