registry / @bigcommerce/catalyst / 1.0.0

@bigcommerce/catalyst@1.0.0

CLI tool for Catalyst development and deployment.

Static Scan Results

scanned 15d ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsTelemetryUrlStrings

Manifest

NoLicense

scanned 2 file(s), 168 KB of source, external domains: api.github.com, codeload.github.com, cxm-prd.bigcommerceapp.com, github.com, login.bigcommerce.com, registry.npmjs.org

Source & flagged code

1 flagged

dist/cli.jsView file

Lines 7-47javascript

7 "Your access token is invalid or has expired.\nRun `catalyst auth login` to re-authenticate."

8 );

9 this.name = "UnauthorizedError";

10 }

11};

12function assertAuthorized(response) {

13 if (response.status === 401) {

14 throw new UnauthorizedError();

15 }

16}

18// src/cli/lib/logger.ts

19import { createConsola } from "consola";

20var consola = createConsola({

21 level: "3" ? parseInt("3", 10) : 3

22});

24// src/cli/lib/telemetry.ts

25import { Analytics } from "@segment/analytics-node";

26import { randomBytes, randomUUID } from "crypto";

28// package.json

29var package_default = {

30 name: "@bigcommerce/catalyst",

31 version: "1.0.0",

32 type: "module",

33 repository: {

34 type: "git",

35 url: "https://github.com/bigcommerce/catalyst",

36 directory: "packages/catalyst"

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli.jsView on unpkg · L27

37 },

38 bin: {

39 catalyst: "dist/cli.js"

40 },

41 files: [

42 "dist",

43 "templates"

44 ],

45 scripts: {

46 dev: "tsup --watch",

47 typecheck: "tsc --noEmit",

Source & flagged code

1 flagged · loading source

dist/cli.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code