registry / @basementuniverse/kanbn / 1.0.1

@basementuniverse/kanbn@1.0.1

A CLI Kanban application

Static Scan Results

scanned 17h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsEvalFilesystemShell

Supply chain

HighEntropyStrings

Manifest

GitDependency

scanned 30 file(s), 238 KB of source

Source & flagged code

4 flagged

skills/kanbn-plan/scripts/validate-kanbn.mjsView file

Lines 1-68javascript

1#!/usr/bin/env node

3import fs from 'fs';

4import path from 'path';

5import process from 'process';

6import { spawnSync } from 'child_process';

High

Child Process

Package source references child process execution.

skills/kanbn-plan/scripts/validate-kanbn.mjsView on unpkg · L5

8function usage() {

9 console.error('Usage: node skills/kanbn-plan/scripts/validate-kanbn.mjs [project-root]');

10}

12function resolveProjectRoot(argv) {

13 if (argv.length > 1) {

14 usage();

15 process.exit(1);

16 }

18 return path.resolve(argv[0] || process.cwd());

19}

21function ensureKanbnFiles(projectRoot) {

22 const indexPath = path.join(projectRoot, '.kanbn', 'index.md');

23 const tasksPath = path.join(projectRoot, '.kanbn', 'tasks');

25 if (!fs.existsSync(indexPath)) {

28 }

30 if (!fs.existsSync(tasksPath)) {

31 console.error(`No Kanbn tasks directory found at ${tasksPath}`);

32 process.exit(1);

33 }

34}

36function getCandidates(projectRoot) {

37 const candidates = [];

38 const localBin = path.join(projectRoot, 'node_modules', '.bin', 'kanbn');

40 if (process.env.KANBN_BIN) {

41 candidates.push({ command: process.env.KANBN_BIN, args: [], label: process.env.KANBN_BIN });

42 }

44 if (fs.existsSync(localBin)) {

45 candidates.push({ command: localBin, args: [], label: localBin });

46 }

48 candidates.push({ command: 'kanbn', args: [], label: 'kanbn' });

49 candidates.push({ command: 'npx', args: ['-y', '@basementuniverse/kanbn'], label: 'npx -y @basementuniverse/kanbn' });

51 return candidates;

52}

54function runValidate(projectRoot) {

55 const candidates = getCandidates(projectRoot);

56 let lastError = null;

58 for (const candidate of candidates) {

59 const result = spawnSync(

60 candidate.command,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

skills/kanbn-plan/scripts/validate-kanbn.mjsView on unpkg · L48

61 [...candidate.args, 'validate', '--json'],

62 {

63 cwd: projectRoot,

64 encoding: 'utf8'

65 }

66 );

68 if (result.error && result.error.code === 'ENOENT') {

src/board.jsView file

Lines 29-69javascript

29 // Prepare task data for interpolation

30 const taskData = {

31 name: task.name,

32 description: task.name,

33 created: 'created' in task.metadata ? formatDate(task.metadata.created, dateFormat) :

index.jsView file

Lines 1-21javascript

1const minimist = require('minimist');

2const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

index.jsView on unpkg · L1

3const

Source & flagged code

4 flagged · loading source

skills/kanbn-plan/scripts/validate-kanbn.mjsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code