registry / @beechcms/cms / 0.6.0

@beechcms/cms@0.6.0

Edge-Native, Schema-Driven Headless CMS built on Cloudflare Workers, D1, and R2. Features the Botanical Engine for alias-stable field management, a modular widget layer, and a React + Vite admin dashboard.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 8 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 8 file(s), 33.5 KB of source, external domains: developers.cloudflare.com

Source & flagged code

2 flagged

package.jsonView file

Lines 92-115json

92 "dev:plain": "cross-env BEECH_DEV_PLAIN=1 node scripts/dev.mjs",

93 "dev:tunnel-url": "docker compose -f docker/docker-compose.yml logs tunnel 2>&1 | grep -Eo 'https://[a-z0-9-]+\\.trycloudflare\\.com' | tail -n 1",

94 "dev:logs:mailpit": "docker compose -f docker/docker-compose.yml logs -f mailpit",

95 "dev:logs:sqlite": "docker compose -f docker/docker-compose.yml logs -f sqlite-web",

96 "dev:logs:tunnel": "docker compose -f docker/docker-compose.yml logs -f tunnel",

97 "dev:logs:minio": "docker compose -f docker/docker-compose.yml logs -f minio",

98 "dev:mailpit:reset": "curl -X DELETE http://localhost:8025/api/v1/messages",

99 "dev:stop": "docker compose -f docker/docker-compose.yml stop",

100 "dev:reset": "docker compose -f docker/docker-compose.yml down -v",

101 "build": "turbo run build",

102 "lint": "turbo run lint",

103 "type-check": "turbo run type-check",

104 "test": "turbo run test",

105 "test:coverage": "turbo run test:coverage",

106 "test:diff": "node scripts/test-coverage-diff.mjs",

107 "test:dev-cli": "vitest run --config scripts/dev-cli/vitest.config.ts",

108 "pipeline": "node scripts/pipeline.mjs",

109 "setup:graph": "node scripts/setup-graph.mjs",

110 "release": "node scripts/release.mjs",

111 "release:preview": "node scripts/release.mjs --preview",

112 "postinstall": "node scripts/check-docker.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L112

113 "doctor": "pnpm dlx react-doctor@latest"

114 }

115}

bin/create.mjsView file

Lines 101-141javascript

101

102export default createBeechApp({ seeds: Object.values(SEED_REGISTRY) })

103`

104}

105

106function buildSeedsTs(selectedKeys) {

107 return buildSeedsFile(selectedKeys)

108}

109

110function buildPackageJson(name) {

111 return JSON.stringify({

Source & flagged code

2 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/check-docker.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

bin/create.mjsView file

121'db:migrate:local': 'wrangler d1 migrations apply ' + name + '-db --local', L122: 'db:reset:local': 'node -e "require(\'fs\').rmSync(\'.wrangler/state\',{recursive:true,force:true})" && npm run db:migrate:local', L123: },

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/create.mjsView on unpkg · L121

Findings

1 High2 Medium5 Low

HighInstall Time Lifecycle Scriptspackage.json

MediumDynamic Requirebin/create.mjs

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License