registry / @backtest-kit/sidekick / 15.3.0

@backtest-kit/sidekick@15.3.0

The easiest way to create a new Backtest Kit trading bot project. Like create-react-app, but for algorithmic trading with LLM integration and technical analysis.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemShell

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 36 file(s), 46.3 KB of source, external domains: 127.0.0.1

Source & flagged code

4 flagged

scripts/init.mjsView file

Lines 1-25javascript

1#!/usr/bin/env node

3import { promises as fs } from 'fs';

4import path from 'path';

5import { fileURLToPath } from 'url';

6import { spawn } from 'child_process';

7import pc from 'picocolors';

High

Child Process

Package source references child process execution.

scripts/init.mjsView on unpkg · L5

8import { glob } from 'glob';

9import Mustache from 'mustache';

10import logSymbols from 'log-symbols';

12const __filename = fileURLToPath(import.meta.url);

13const __dirname = path.dirname(__filename);

15const log = {

16 info: (msg) => console.log(`${pc.cyan(logSymbols.info)} ${msg}`),

17 success: (msg) => console.log(`${pc.green(logSymbols.success)} ${msg}`),

18 error: (msg) => console.log(`${pc.red(logSymbols.error)} ${msg}`),

19 warn: (msg) => console.log(`${pc.yellow(logSymbols.warning)} ${msg}`),

20};

22/**

23 * Copy files using glob patterns

24 */

25async function copyFiles(srcDir, destDir, pattern = '**/*') {

Lines 52-95javascript

52 */

53async function isDirEmpty(dirPath) {

54 try {

55 const files = await fs.readdir(dirPath);

56 return files.length === 0;

57 } catch (error) {

content/docker/ollama/watch.shView file

•path = content/docker/ollama/watch.sh kind = build_helper sizeBytes = 45 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

content/docker/ollama/watch.shView on unpkg

Source & flagged code

4 flagged · loading source

scripts/init.mjsView file

5import { fileURLToPath } from 'url'; L6: import { spawn } from 'child_process'; L7: import pc from 'picocolors';

High

Child Process

Package source references child process execution.

scripts/init.mjsView on unpkg · L5

75stdio: 'inherit', L76: shell: true, L77: });

High

Shell

Package source references shell execution.

scripts/init.mjsView on unpkg · L75

72const npm = process.platform === 'win32' ? 'npm.cmd' : 'npm'; L73: const install = spawn(npm, ['install'], { L74: cwd: projectPath, ... L80: if (code !== 0) { L81: reject(new Error(`npm install exited with code ${code}`)); L82: return;

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/init.mjsView on unpkg · L72

content/docker/ollama/watch.shView file

•path = content/docker/ollama/watch.sh kind = build_helper sizeBytes = 45 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

content/docker/ollama/watch.shView on unpkg

Findings

3 High3 Medium3 Low

HighChild Processscripts/init.mjs

HighShellscripts/init.mjs

HighRuntime Package Installscripts/init.mjs

MediumEnvironment Vars

MediumShips Build Helpercontent/docker/ollama/watch.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowUrl Strings

Source & flagged code

4 flagged

scripts/init.mjsView file

Lines 1-25javascript

1#!/usr/bin/env node

3import { promises as fs } from 'fs';

4import path from 'path';

5import { fileURLToPath } from 'url';

6import { spawn } from 'child_process';

7import pc from 'picocolors';

High

Child Process

Package source references child process execution.

scripts/init.mjsView on unpkg · L5

8import { glob } from 'glob';

9import Mustache from 'mustache';

10import logSymbols from 'log-symbols';

12const __filename = fileURLToPath(import.meta.url);

13const __dirname = path.dirname(__filename);

15const log = {

16 info: (msg) => console.log(`${pc.cyan(logSymbols.info)} ${msg}`),

17 success: (msg) => console.log(`${pc.green(logSymbols.success)} ${msg}`),

18 error: (msg) => console.log(`${pc.red(logSymbols.error)} ${msg}`),

19 warn: (msg) => console.log(`${pc.yellow(logSymbols.warning)} ${msg}`),

20};

22/**

23 * Copy files using glob patterns

24 */

25async function copyFiles(srcDir, destDir, pattern = '**/*') {

Lines 52-95javascript

52 */

53async function isDirEmpty(dirPath) {

54 try {

55 const files = await fs.readdir(dirPath);

56 return files.length === 0;

57 } catch (error) {

content/docker/ollama/watch.shView file

•path = content/docker/ollama/watch.sh kind = build_helper sizeBytes = 45 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

content/docker/ollama/watch.shView on unpkg