registry / @bigcommerce/catalyst / 1.1.1

@bigcommerce/catalyst@1.1.1

CLI tool for Catalyst development and deployment.

Static Scan Results

scanned 1h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsTelemetryUrlStrings

Manifest

NoLicense

scanned 2 file(s), 200 KB of source, external domains: api.github.com, codeload.github.com, cxm-prd.bigcommerceapp.com, github.com, login.bigcommerce.com, registry.npmjs.org

Source & flagged code

2 flagged

dist/cli.jsView file

Lines 4-44javascript

4var UserActionableError = class extends Error {

5 constructor(message) {

6 super(message);

7 this.name = "UserActionableError";

8 }

9};

11// src/cli/lib/logger.ts

12import { createConsola } from "consola";

13var consola = createConsola({

14 level: "3" ? parseInt("3", 10) : 3,

15 // Drop the per-line timestamp. It adds noise for a short-lived CLI and, on

16 // long lines, consola can't right-align it so it falls back to an inline

17 // `[time]` prefix that breaks copy-pasteable command suggestions.

18 formatOptions: { date: false }

19});

21// src/cli/lib/telemetry.ts

22import { Analytics } from "@segment/analytics-node";

23import { randomBytes, randomUUID } from "crypto";

25// package.json

26var package_default = {

27 name: "@bigcommerce/catalyst",

28 version: "1.1.1",

29 type: "module",

30 repository: {

31 type: "git",

32 url: "https://github.com/bigcommerce/catalyst",

33 directory: "packages/catalyst"

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli.jsView on unpkg · L24

34 },

35 bin: {

36 catalyst: "dist/cli.js"

37 },

38 files: [

39 "dist",

40 "templates"

41 ],

42 scripts: {

43 dev: "tsup --watch",

44 typecheck: "tsc --noEmit",

•matchType = previous_version_dangerous_delta matchedPackage = @bigcommerce/catalyst@1.1.0 matchedIdentity = npm:QGJpZ2NvbW1lcmNlL2NhdGFseXN0:1.1.0 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.jsView on unpkg

Source & flagged code

2 flagged · loading source

dist/cli.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code