Loading npm security reports…

@book000/create-ts@0.1.41: Suspicious npm security report (Warn) | LPM Firewall

registry / @book000/create-ts / 0.1.41

@book000/create-ts@0.1.41

Create book000-style TypeScript projects

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

FilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 17 file(s), 56.9 KB of source, external domains: api.github.com, github.com

Source & flagged code

4 flagged

package.jsonView file

Lines 22-54json

22 },

23 "publishConfig": {

24 "access": "public"

25 },

26 "dependencies": {

27 "@clack/prompts": "1.7.0",

28 "commander": "15.0.0",

29 "execa": "9.6.1"

30 },

31 "devDependencies": {

32 "@book000/eslint-config": "1.15.3",

33 "@types/node": "25.9.5",

34 "eslint": "10.7.0",

35 "prettier": "3.9.5",

36 "run-z": "2.1.0",

37 "tsdown": "0.22.7",

38 "typescript": "6.0.3",

39 "vitest": "4.1.10"

40 },

41 "scripts": {

42 "preinstall": "npx only-allow pnpm",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L42

43 "build": "tsdown",

44 "dev": "tsdown --watch",

45 "lint": "run-z lint:prettier,lint:eslint,lint:tsc",

46 "lint:prettier": "prettier --check src",

47 "lint:eslint": "eslint . -c eslint.config.mjs",

48 "lint:tsc": "tsc",

49 "fix": "run-z fix:prettier fix:eslint",

50 "fix:eslint": "eslint . -c eslint.config.mjs --fix",

51 "fix:prettier": "prettier --write src",

52 "test": "vitest run"

53 }

54}

dist/index.mjsView file

Lines 1-26javascript

1#!/usr/bin/env node

2import { cancel, confirm, group, intro, isCancel, log, note, outro, select, spinner, text } from "@clack/prompts";

3import { Command } from "commander";

4import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";

5import path from

templates/nodejs/common/entrypoint.shView file

•path = [redacted].sh kind = build_helper sizeBytes = 34 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/nodejs/common/entrypoint.shView on unpkg

Source & flagged code

4 flagged · loading source

package.jsonView file

•scripts.preinstall = npx only-allow pnpm

High

Install Time Lifecycle Scripts

Lines 465-505javascript

465 if (options.addReviewer) {

466 const addReviewerYml = readTemplate("workflows/add-reviewer.yml");

467 writeFileSync(path.join(workflowDir, "add-reviewer.yml"), addReviewerYml, "utf8");

468 }

469 s.stop("ワークフローファイルをコピーしました");

470 s.start("package.json を生成しています...");

471 const variantPkgText = readTemplate(`nodejs/${options.variant}/package.json`);

472 const patchedPkgJson = patchPackageJson(JSON.parse(variantPkgText), options, nodeMajor);

473 const depcheckIgnore = templateConfig.depcheckIgnore ?? [];

474 if (depcheckIgnore.length > 0 || options.test) {

475 const depcheckPath = path.join(outDir, ".depcheckrc.json");

476 const updatedDepcheck = updateDepcheck(JSON.parse(readFileSync(depcheckPath, "utf8")), depcheckIgnore, options.test);

477 writeFileSync(depcheckPath, JSON.stringify(updatedDepcheck, null, 2) + "\n", "utf8");

478 }

479 if (templateConfig.configSchema) mkdirSync(path.join(outDir, "schema"), { recursive: true });

480 writeFileSync(path.join(outDir, "package.json"), JSON.stringify(patchedPkgJson, null, 2) + "\n", "utf8");

481 s.stop("package.json を生成しました");

482 s.start("pnpm-lock.yaml をコピーしています...");

483 const pnpmLock = readTemplate(`nodejs/${options.variant}/pnpm-lock.yaml`);

484 writeFileSync(path.join(outDir, "pnpm-lock.yaml"), pnpmLock, "utf8");

485 s.stop("pnpm-lock.yaml をコピーしました");

486 s.start("pnpm install を実行しています...");

487 await execa("pnpm", ["install", "--frozen-lockfile"], {

488 cwd: outDir,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.mjsView on unpkg · L485

489 stdio: "inherit"

490 });

491 s.stop("依存パッケージをインストールしました");

492 if (!options.test) {

493 s.start("Jest 関連パッケージを削除しています...");

494 await execa("pnpm", [

495 "remove",

496 "jest",

497 "@types/jest",

498 "ts-jest"

499 ], { cwd: outDir });

500 s.stop("Jest 関連パッケージを削除しました");

501 }

502 s.start("fixpack を実行しています...");

503 try {

504 await execa("npx", ["--yes", "fixpack"], { cwd: outDir });

505 s.stop("fixpack を実行しました");

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code