registry / @beechcms/cli / 0.6.1

@beechcms/cli@0.6.1

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 69.4 KB of source, external domains: beechcms.dev

Source & flagged code

3 flagged

dist/index.jsView file

Lines 1-52javascript

1var __defProp = Object.defineProperty;

2var __getOwnPropNames = Object.getOwnPropertyNames;

3var __esm = (fn, res, err) => function __init() {

4 if (err) throw err[0];

5 try {

6 return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;

7 } catch (e) {

8 throw err = [e], e;

9 }

10};

11var __export = (target, all) => {

12 for (var name in all)

13 __defProp(target, name, { get: all[name], enumerable: true });

14};

16// src/lib/wrangler.ts

17import { spawnSync } from "node:child_process";

18import { writeFileSync, rmSync, existsSync, readFileSync } from "node:fs";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L16

19import { tmpdir } from "node:os";

20import { join, resolve } from "node:path";

21function buildArgs(options) {

22 const args = [];

23 if (options.configPath) args.push("--config", options.configPath);

24 if (options.local) args.push("--local");

25 else args.push("--remote");

26 return args;

27}

28function executeD1File(sql, options) {

29 const tmpFile = join(tmpdir(), `beech-seed-${Date.now()}.sql`);

30 try {

31 writeFileSync(tmpFile, sql, "utf-8");

32 const args = ["d1", "execute", options.db, "--file", tmpFile, ...buildArgs(options)];

33 const result = spawnSync("npx", ["wrangler", ...args], { stdio: "inherit", cwd: process.cwd(), shell: true });

34 return result.status === 0;

High

Shell

Package source references shell execution.

dist/index.jsView on unpkg · L32

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L32

35 } finally {

36 try {

37 rmSync(tmpFile);

38 } catch {

39 }

40 }

41}

42function queryD1(sql, options) {

43 const tmpFile = join(tmpdir(), `beech-query-${Date.now()}.sql`);

44 let result;

45 try {

46 writeFileSync(tmpFile, sql, "utf-8");

47 const args = ["d1", "execute", options.db, "--file", tmpFile, "--json", ...buildArgs(options)];

48 result = spawnSync("npx", ["wrangler", ...args], { encoding: "utf-8", cwd: process.cwd(), shell: true });

49 } finally {

50 try {

51 rmSync(tmpFile);

52 } catch {

Source & flagged code

3 flagged · loading source

dist/index.jsView file

16// src/lib/wrangler.ts L17: import { spawnSync } from "node:child_process"; L18: import { writeFileSync, rmSync, existsSync, readFileSync } from "node:fs";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L16

32const args = ["d1", "execute", options.db, "--file", tmpFile, ...buildArgs(options)]; L33: const result = spawnSync("npx", ["wrangler", ...args], { stdio: "inherit", cwd: process.cwd(), shell: true }); L34: return result.status === 0;

High

Shell

Package source references shell execution.

dist/index.jsView on unpkg · L32

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L32

Findings

3 High3 Medium4 Low

HighChild Processdist/index.js

HighShelldist/index.js

HighRuntime Package Installdist/index.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

dist/index.jsView file

Lines 1-52javascript

1var __defProp = Object.defineProperty;

2var __getOwnPropNames = Object.getOwnPropertyNames;

3var __esm = (fn, res, err) => function __init() {

4 if (err) throw err[0];

5 try {

6 return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;

7 } catch (e) {

8 throw err = [e], e;

9 }

10};

11var __export = (target, all) => {

12 for (var name in all)

13 __defProp(target, name, { get: all[name], enumerable: true });

14};

16// src/lib/wrangler.ts

17import { spawnSync } from "node:child_process";

18import { writeFileSync, rmSync, existsSync, readFileSync } from "node:fs";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L16

19import { tmpdir } from "node:os";

20import { join, resolve } from "node:path";

21function buildArgs(options) {

22 const args = [];

23 if (options.configPath) args.push("--config", options.configPath);

24 if (options.local) args.push("--local");

25 else args.push("--remote");

26 return args;

27}

28function executeD1File(sql, options) {

29 const tmpFile = join(tmpdir(), `beech-seed-${Date.now()}.sql`);

30 try {

31 writeFileSync(tmpFile, sql, "utf-8");

32 const args = ["d1", "execute", options.db, "--file", tmpFile, ...buildArgs(options)];

33 const result = spawnSync("npx", ["wrangler", ...args], { stdio: "inherit", cwd: process.cwd(), shell: true });

34 return result.status === 0;

High

Shell

Package source references shell execution.

dist/index.jsView on unpkg · L32

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L32

35 } finally {

36 try {

37 rmSync(tmpFile);

38 } catch {

39 }

40 }

41}

42function queryD1(sql, options) {

43 const tmpFile = join(tmpdir(), `beech-query-${Date.now()}.sql`);

44 let result;

45 try {

46 writeFileSync(tmpFile, sql, "utf-8");

47 const args = ["d1", "execute", options.db, "--file", tmpFile, "--json", ...buildArgs(options)];

48 result = spawnSync("npx", ["wrangler", ...args], { encoding: "utf-8", cwd: process.cwd(), shell: true });

49 } finally {

50 try {

51 rmSync(tmpFile);

52 } catch {