registry / @bleedingdev/modern-js-create / 3.5.0-ultramodern.29

@bleedingdev/modern-js-create@3.5.0-ultramodern.29

⚠ Under review

A Progressive React Framework for modern web development.

Static Scan Results

scanned 6d ago · by rust-scanner

Static analysis flagged 12 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 144 file(s), 1.43 MB of source, external domains: example.com, mise.run, modernjs.dev, schema.org, workspace.example.workers.dev, www.sitemaps.org, www.w3.org

Source & flagged code

4 flagged

dist/esm/index.jsView file

Lines 1-21javascript

1import { execFileSync } from "node:child_process";

2import node_fs from "node:fs";

High

Child Process

Package source references child process execution.

dist/esm/index.jsView on unpkg · L1

3import node_path from "node:path";

4import node_readline from "node:readline";

5import { fileURLToPath } from "node:url";

6import { resolveCreatePackageRoot } from "./create-package-root.js";

7import { i18n, localeKeys } from "./locale/index.js";

8import { BLEEDINGDEV_CREATE_PACKAGE, BLEEDINGDEV_FRAMEWORK_VERSION_ENV, BLEEDINGDEV_PACKAGE_NAME_PREFIX, BLEEDINGDEV_PACKAGE_SCOPE, WORKSPACE_PACKAGE_VERSION } from "./ultramodern-package-source.js";

9import { runUltramodernToolingCli } from "./ultramodern-tooling/commands.js";

10import { addUltramodernVertical, generateUltramodernWorkspace, planUltramodernVertical } from "./ultramodern-workspace/index.js";

11import { hasUltramodernBridgeCliOptions, parseUltramodernBridgeCliOptions, ultramodernBridgeCliBooleanFlags, ultramodernBridgeCliValueFlags } from "./ultramodern-workspace/bridge-config.js";

12const src_dirname = node_path.dirname(fileURLToPath(import.meta.url));

13const createPackageRoot = resolveCreatePackageRoot(src_dirname);

14const semverPattern = /^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/;

15const LEGACY_MODERN_JS_FLAG = '--legacy-modern-js';

16const LEGACY_MODERN_JS_CONFIRMATION = 'USE LEGACY MODERN.JS';

17const WORKSPACE_PROTOCOL_FLAG = '--workspace';

18const DRY_RUN_FLAG = '--dry-run';

19const VERTICAL_FLAG = '--vertical';

20const VERTICAL_NAME_FLAG = '--vertical-name';

21const CODESMITH_OVERLAY_FLAG = '--codesmith-overlay';

bin/run.jsView file

Lines 1-28javascript

1#!/usr/bin/env node

2import fs from 'node:fs';

3import { createRequire } from 'node:module';

4import path from 'node:path';

5import { fileURLToPath, pathToFileURL } from 'node:url';

7const __filename

templates/workspace-scripts/ultramodern-typecheck.mjsView file

Lines 97-137javascript

98 if (buildTarget && projectTarget) {

99 fail('Choose either --build or --project, not both.');

100 }

101

102 return {

103 mode: buildTarget ? 'build' : 'project',

template-workspace/scripts/bootstrap-agent-skills.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @bleedingdev/modern-js-create@3.5.0-ultramodern.28 matchedIdentity = npm:[redacted]:3.5.0-ultramodern.28 similarity = 0.564 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

template-workspace/scripts/bootstrap-agent-skills.mjsView on unpkg

Source & flagged code

4 flagged · loading source

dist/esm/index.jsView file

1import { execFileSync } from "node:child_process"; L2: import node_fs from "node:fs";

High

Child Process

Package source references child process execution.

dist/esm/index.jsView on unpkg · L1

bin/run.jsView file

8const __dirname = path.dirname(__filename); L9: const require = createRequire(import.meta.url); L10:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/run.jsView on unpkg · L8

templates/workspace-scripts/ultramodern-typecheck.mjsView file

117const cli = process.env.EFFECT_TSGO_CLI || 'effect-tsgo'; L118: const result = spawnSync(cli, ['get-exe-path'], { L119: encoding: 'utf8', ... L124: fail( L125: `Unable to run ${cli}. Run pnpm install or set EFFECT_TSGO_BIN to the native-preview tsgo binary.`, L126: );

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

templates/workspace-scripts/ultramodern-typecheck.mjsView on unpkg · L117

template-workspace/scripts/bootstrap-agent-skills.mjsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

template-workspace/scripts/bootstrap-agent-skills.mjsView on unpkg

Findings

1 Critical3 High4 Medium4 Low

CriticalPrevious Version Dangerous Deltatemplate-workspace/scripts/bootstrap-agent-skills.mjs

HighChild Processdist/esm/index.js

HighShell

HighRuntime Package Installtemplates/workspace-scripts/ultramodern-typecheck.mjs

MediumDynamic Requirebin/run.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

dist/esm/index.jsView file

Lines 1-21javascript

1import { execFileSync } from "node:child_process";

2import node_fs from "node:fs";

High

Child Process

Package source references child process execution.

dist/esm/index.jsView on unpkg · L1

3import node_path from "node:path";

4import node_readline from "node:readline";

5import { fileURLToPath } from "node:url";

6import { resolveCreatePackageRoot } from "./create-package-root.js";

7import { i18n, localeKeys } from "./locale/index.js";

9import { runUltramodernToolingCli } from "./ultramodern-tooling/commands.js";

10import { addUltramodernVertical, generateUltramodernWorkspace, planUltramodernVertical } from "./ultramodern-workspace/index.js";

11import { hasUltramodernBridgeCliOptions, parseUltramodernBridgeCliOptions, ultramodernBridgeCliBooleanFlags, ultramodernBridgeCliValueFlags } from "./ultramodern-workspace/bridge-config.js";

12const src_dirname = node_path.dirname(fileURLToPath(import.meta.url));

13const createPackageRoot = resolveCreatePackageRoot(src_dirname);

14const semverPattern = /^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/;

15const LEGACY_MODERN_JS_FLAG = '--legacy-modern-js';

16const LEGACY_MODERN_JS_CONFIRMATION = 'USE LEGACY MODERN.JS';

17const WORKSPACE_PROTOCOL_FLAG = '--workspace';

18const DRY_RUN_FLAG = '--dry-run';

19const VERTICAL_FLAG = '--vertical';

20const VERTICAL_NAME_FLAG = '--vertical-name';

21const CODESMITH_OVERLAY_FLAG = '--codesmith-overlay';

bin/run.jsView file

Lines 1-28javascript

1#!/usr/bin/env node

2import fs from 'node:fs';

3import { createRequire } from 'node:module';

4import path from 'node:path';

5import { fileURLToPath, pathToFileURL } from 'node:url';

7const __filename

templates/workspace-scripts/ultramodern-typecheck.mjsView file

Lines 97-137javascript

98 if (buildTarget && projectTarget) {

99 fail('Choose either --build or --project, not both.');

100 }

101

102 return {

103 mode: buildTarget ? 'build' : 'project',

template-workspace/scripts/bootstrap-agent-skills.mjsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

template-workspace/scripts/bootstrap-agent-skills.mjsView on unpkg