registry / @backtest-kit/cli / 15.4.0

@backtest-kit/cli@15.4.0

Zero-boilerplate CLI runner for backtest-kit strategies. Run backtests, paper trading, and live bots with candle cache warming, web dashboard, and Telegram notifications — no setup code required.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 12 file(s), 398 KB of source, external domains: raw.githubusercontent.com

Source & flagged code

6 flagged

build/index.cjsView file

Lines 1-33javascript

1#!/usr/bin/env node

2'use strict';

4var BacktestKit = require('backtest-kit');

5var functoolsKit = require('functools-kit');

6var fs = require(

Source & flagged code

6 flagged · loading source

build/index.cjsView file

13var util = require('util'); L14: var child_process = require('child_process'); L15: var BacktestKitUi = require('@backtest-kit/ui');

High

Child Process

Package source references child process execution.

build/index.cjsView on unpkg · L13

13Cross-file remote execution chain: build/index.cjs spawns build/index.mjs; helper contains network access plus dynamic code execution. L13: var util = require('util'); L14: var child_process = require('child_process'); L15: var BacktestKitUi = require('@backtest-kit/ui'); ... L154: message: functoolsKit.getErrorMessage(error), L155: data: functoolsKit.errorData(error), L156: }, null, 2); ... L407: const __filename$3 = url.fileURLToPath((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tag... L408: const __dirname$3 = path.dirname(__filename$3); L409: let _is_launched = false; ... L940: let allData = ""; L941: ps.stdout.on("data", (data) => { L942: allData += data.toString("ascii");

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

build/index.cjsView on unpkg · L13

4528const npm = process.platform === "win32" ? "npm.cmd" : "npm"; L4529: const child = child_process.spawn(npm, ["install"], { cwd, stdio: "inherit", shell: true }); L4530: child.on("close", (code) => { L4531: if (code !== 0) { L4532: reject(new Error(`npm install exited with code ${code}`)); L4533: return;

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

build/index.cjsView on unpkg · L4528

2970try { L2971: eval(self.params.babel.transpile(code, path)); L2972: }

Low

Eval

Package source references a known benign dynamic code generation pattern.

build/index.cjsView on unpkg · L2970

build/index.mjsView file

4496const npm = process.platform === "win32" ? "npm.cmd" : "npm"; L4497: const child = spawn(npm, ["install"], { cwd, stdio: "inherit", shell: true }); L4498: child.on("close", (code) => {

High

Shell

Package source references shell execution.

build/index.mjsView on unpkg · L4496

template/project/config/symbol.config.tsView file

1const { str } = require("functools-kit"); L2:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

template/project/config/symbol.config.tsView on unpkg · L1

Findings

4 High4 Medium5 Low

HighChild Processbuild/index.cjs

HighShellbuild/index.mjs

HighCross File Remote Execution Contextbuild/index.cjs

HighRuntime Package Installbuild/index.cjs

MediumDynamic Requiretemplate/project/config/symbol.config.ts

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvalbuild/index.cjs

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Lines 2950-2990javascript

2950/**

2951 * This file is used to define any aliases for imports in the client code. This is useful for mocking modules during testing or for providing alternative implementations of certain modules.

2952 * For example, if we want to mock the "pinets" module during testing, we can add an entry to the IMPORT_ALIAS object that points to our mock implementation. Then, when the client code tries to import "pinets", it will receive our mock implementation instead of the actual "pinets" module.

2953 * This allows us to isolate the client code from external dependencies and test it more effectively.

2954 * Note that the keys in the IMPORT_ALIAS object should match the module names used in the client code, and the values should be the corresponding mock implementations or alternative modules.

2955 * @example

2956 * // To mock the "pinets" module, we can add the following entry to the IMPORT_ALIAS object:

2957 * Object.assign(IMPORT_ALIAS, {

2958 * "pinets": require("pinets/dist/pinets.min.browser.js"),

2959 * });

2960 */

2961const IMPORT_ALIAS = {};

2962

2963const USE_ESMODULE_DEFAULT = false;

2964const IMPORT_PATHS_EXCLUDE = new Set(["dump", "logs", "modules", "config", "node_modules"]);

2965const TRANSPILE_FN = functoolsKit.memoize(([path]) => `${path}`, (path, code, self, require) => {

2966 const __filename = self.__filename;

2967 const __dirname = self.__dirname;

2968 const module = { exports: {} };

2969 const exports = module.exports;

2970 try {

2971 eval(self.params.babel.transpile(code, path));

2972 }

Low

Eval

Package source references a known benign dynamic code generation pattern.

build/index.cjsView on unpkg · L2970

2973 catch (error) {

2974 console.log(`Error during transpilation error=\`${functoolsKit.getErrorMessage(error)}\` path=\`${path}\` __filename=\`${__filename}\` __dirname=\`${__dirname}\``);

2975 kill(-1);

2976 return;

2977 }

2978 return {

2979 require,

2980 __filename,

2981 __dirname,

2982 exports,

2983 module,

2984 };

2985});

2986const REQUIRE_ENTRY_FACTORY = (filePath, self, seen, errors) => {

2987 const baseRequire = CREATE_BASE_REQUIRE_FN(self, seen);

2988 try {

2989 return { exports: baseRequire(filePath) };

2990 }

Lines 4508-4548javascript

4508 console.log(` -> ${destPath}`);

4509 }

4510 }

4511}

4512function runScript(scriptPath, cwd) {

4513 return new Promise((resolve, reject) => {

4514 const node = process.execPath;

4515 const child = child_process.spawn(node, [scriptPath], { cwd, stdio: "inherit" });

4516 child.on("close", (code) => {

4517 if (code !== 0) {

4518 reject(new Error(`Script exited with code ${code}`));

4519 return;

4520 }

4521 resolve();

4522 });

4523 child.on("error", reject);

4524 });

4525}

4526function runNpmInstall$1(cwd) {

4527 return new Promise((resolve, reject) => {

4528 const npm = process.platform === "win32" ? "npm.cmd" : "npm";

4529 const child = child_process.spawn(npm, ["install"], { cwd, stdio: "inherit", shell: true });

4530 child.on("close", (code) => {

4531 if (code !== 0) {

4532 reject(new Error(`npm install exited with code ${code}`));

4533 return;

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

build/index.cjsView on unpkg · L4528

4534 }

4535 resolve();

4536 });

4537 child.on("error", reject);

4538 });

4539}

4540const main$3 = async () => {

4541 if (!getEntry((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('index.cjs', document.baseURI).href)))) {

4542 return;

4543 }

4544 const { values } = getArgs();

4545 if (!values.init) {

4546 return;

4547 }

4548 const projectName = values.output || "backtest-kit-project";

build/index.mjsView file

Lines 4476-4516javascript

4476 console.log(` -> ${destPath}`);

4477 }

4478 }

4479}

4480function runScript(scriptPath, cwd) {

4481 return new Promise((resolve, reject) => {

4482 const node = process.execPath;

4483 const child = spawn(node, [scriptPath], { cwd, stdio: "inherit" });

4484 child.on("close", (code) => {

4485 if (code !== 0) {

4486 reject(new Error(`Script exited with code ${code}`));

4487 return;

4488 }

4489 resolve();

4490 });

4491 child.on("error", reject);

4492 });

4493}

4494function runNpmInstall$1(cwd) {

4495 return new Promise((resolve, reject) => {

4496 const npm = process.platform === "win32" ? "npm.cmd" : "npm";

4497 const child = spawn(npm, ["install"], { cwd, stdio: "inherit", shell: true });

4498 child.on("close", (code) => {

High

Shell

Package source references shell execution.

build/index.mjsView on unpkg · L4496

4499 if (code !== 0) {

4500 reject(new Error(`npm install exited with code ${code}`));

4501 return;

4502 }

4503 resolve();

4504 });

4505 child.on("error", reject);

4506 });

4507}

4508const main$3 = async () => {

4509 if (!getEntry(import.meta.url)) {

4510 return;

4511 }

4512 const { values } = getArgs();

4513 if (!values.init) {

4514 return;

4515 }

4516 const projectName = values.output || "backtest-kit-project";