registry / @book000/create-ts / 0.1.19

@book000/create-ts@0.1.19

Create book000-style TypeScript projects

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

FilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 17 file(s), 56.9 KB of source, external domains: api.github.com, github.com

Source & flagged code

4 flagged

package.jsonView file

Lines 22-54json

22 },

23 "publishConfig": {

24 "access": "public"

25 },

26 "dependencies": {

27 "@clack/prompts": "1.7.0",

28 "commander": "15.0.0",

29 "execa": "9.6.1"

30 },

31 "devDependencies": {

32 "@book000/eslint-config": "1.15.3",

33 "@types/node": "25.9.5",

34 "eslint": "10.6.0",

35 "prettier": "3.9.4",

36 "run-z": "2.1.0",

37 "tsdown": "0.22.4",

38 "typescript": "6.0.3",

39 "vitest": "4.1.10"

40 },

41 "scripts": {

42 "preinstall": "npx only-allow pnpm",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L42

43 "build": "tsdown",

44 "dev": "tsdown --watch",

45 "lint": "run-z lint:prettier,lint:eslint,lint:tsc",

46 "lint:prettier": "prettier --check src",

47 "lint:eslint": "eslint . -c eslint.config.mjs",

48 "lint:tsc": "tsc",

49 "fix": "run-z fix:prettier fix:eslint",

50 "fix:eslint": "eslint . -c eslint.config.mjs --fix",

51 "fix:prettier": "prettier --write src",

52 "test": "vitest run"

53 }

54}

dist/index.mjsView file

Lines 1-26javascript

1#!/usr/bin/env node

2import { cancel, confirm, group, intro, isCancel, log, note, outro, select, spinner, text } from "@clack/prompts";

3import { Command } from "commander";

4import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";

5import path from "node:path";

6import { fileURLToPath } from

templates/nodejs/common/entrypoint.shView file

•path = [redacted].sh kind = build_helper sizeBytes = 34 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/nodejs/common/entrypoint.shView on unpkg

Source & flagged code

4 flagged · loading source

package.jsonView file

•scripts.preinstall = npx only-allow pnpm

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/index.mjsView file

6import { fileURLToPath } from "node:url"; L7: import { execa } from "execa"; L8: //#region src/template.ts

High

Shell

Package source references shell execution.

dist/index.mjsView on unpkg · L6

485s.stop("pnpm-lock.yaml をコピーしました"); L486: s.start("pnpm install を実行しています..."); L487: await execa("pnpm", ["install", "--frozen-lockfile"], { L488: cwd: outDir,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.mjsView on unpkg · L485

templates/nodejs/common/entrypoint.shView file

•path = [redacted].sh kind = build_helper sizeBytes = 34 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/nodejs/common/entrypoint.shView on unpkg

Findings

3 High3 Medium4 Low

HighInstall Time Lifecycle Scriptspackage.json

HighShelldist/index.mjs

HighRuntime Package Installdist/index.mjs

MediumNetwork

MediumShips Build Helpertemplates/nodejs/common/entrypoint.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

package.jsonView file

Lines 22-54json

22 },

23 "publishConfig": {

24 "access": "public"

25 },

26 "dependencies": {

27 "@clack/prompts": "1.7.0",

28 "commander": "15.0.0",

29 "execa": "9.6.1"

30 },

31 "devDependencies": {

32 "@book000/eslint-config": "1.15.3",

33 "@types/node": "25.9.5",

34 "eslint": "10.6.0",

35 "prettier": "3.9.4",

36 "run-z": "2.1.0",

37 "tsdown": "0.22.4",

38 "typescript": "6.0.3",

39 "vitest": "4.1.10"

40 },

41 "scripts": {

42 "preinstall": "npx only-allow pnpm",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L42

43 "build": "tsdown",

44 "dev": "tsdown --watch",

45 "lint": "run-z lint:prettier,lint:eslint,lint:tsc",

46 "lint:prettier": "prettier --check src",

47 "lint:eslint": "eslint . -c eslint.config.mjs",

48 "lint:tsc": "tsc",

49 "fix": "run-z fix:prettier fix:eslint",

50 "fix:eslint": "eslint . -c eslint.config.mjs --fix",

51 "fix:prettier": "prettier --write src",

52 "test": "vitest run"

53 }

54}

dist/index.mjsView file

Lines 1-26javascript

1#!/usr/bin/env node

2import { cancel, confirm, group, intro, isCancel, log, note, outro, select, spinner, text } from "@clack/prompts";

3import { Command } from "commander";

4import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";

5import path from "node:path";

6import { fileURLToPath } from

templates/nodejs/common/entrypoint.shView file

•path = [redacted].sh kind = build_helper sizeBytes = 34 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/nodejs/common/entrypoint.shView on unpkg

Lines 465-505javascript

465 if (options.addReviewer) {

466 const addReviewerYml = readTemplate("workflows/add-reviewer.yml");

467 writeFileSync(path.join(workflowDir, "add-reviewer.yml"), addReviewerYml, "utf8");

468 }

469 s.stop("ワークフローファイルをコピーしました");

470 s.start("package.json を生成しています...");

471 const variantPkgText = readTemplate(`nodejs/${options.variant}/package.json`);

472 const patchedPkgJson = patchPackageJson(JSON.parse(variantPkgText), options, nodeMajor);

473 const depcheckIgnore = templateConfig.depcheckIgnore ?? [];

474 if (depcheckIgnore.length > 0 || options.test) {

475 const depcheckPath = path.join(outDir, ".depcheckrc.json");

476 const updatedDepcheck = updateDepcheck(JSON.parse(readFileSync(depcheckPath, "utf8")), depcheckIgnore, options.test);

477 writeFileSync(depcheckPath, JSON.stringify(updatedDepcheck, null, 2) + "\n", "utf8");

478 }

479 if (templateConfig.configSchema) mkdirSync(path.join(outDir, "schema"), { recursive: true });

480 writeFileSync(path.join(outDir, "package.json"), JSON.stringify(patchedPkgJson, null, 2) + "\n", "utf8");

481 s.stop("package.json を生成しました");

482 s.start("pnpm-lock.yaml をコピーしています...");

483 const pnpmLock = readTemplate(`nodejs/${options.variant}/pnpm-lock.yaml`);

484 writeFileSync(path.join(outDir, "pnpm-lock.yaml"), pnpmLock, "utf8");

485 s.stop("pnpm-lock.yaml をコピーしました");

486 s.start("pnpm install を実行しています...");

487 await execa("pnpm", ["install", "--frozen-lockfile"], {

488 cwd: outDir,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.mjsView on unpkg · L485

489 stdio: "inherit"

490 });

491 s.stop("依存パッケージをインストールしました");

492 if (!options.test) {

493 s.start("Jest 関連パッケージを削除しています...");

494 await execa("pnpm", [

495 "remove",

496 "jest",

497 "@types/jest",

498 "ts-jest"

499 ], { cwd: outDir });

500 s.stop("Jest 関連パッケージを削除しました");

501 }

502 s.start("fixpack を実行しています...");

503 try {

504 await execa("npx", ["--yes", "fixpack"], { cwd: outDir });

505 s.stop("fixpack を実行しました");