registry / @broxium/cli / 1.11.0

@broxium/cli@1.11.0

⚠ Under review

Official CLI for the Broxium ecosystem — scaffold, generate and deploy sub-apps

Static Scan Results

scanned 17d ago · by rust-scanner

Static analysis flagged 12 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 15 file(s), 197 KB of source, external domains: core.yourplatform.com, www.apachefriends.org, www.w3.org

Source & flagged code

4 flagged

dist/commands/update.jsView file

Lines 1-58javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.updateCommand = updateCommand;

4const child_process_1 = require("child_process");

5const banner_1 = require("../utils/banner");

High

Child Process

Package source references child process execution.

dist/commands/update.jsView on unpkg · L3

6const version_1 = require("../version");

7function getLatestVersion(pkg) {

8 const result = (0, child_process_1.spawnSync)("npm", ["view", pkg, "version"], { encoding: "utf-8" });

9 if (result.error || result.status !== 0)

10 throw new Error("Could not fetch latest version from npm registry");

11 return result.stdout.trim();

12}

13function isGlobalInstall() {

14 try {

15 const globalBin = (0, child_process_1.execSync)("npm root -g", { encoding: "utf-8" }).trim();

16 const selfBin = (0, child_process_1.execSync)("npm root", { encoding: "utf-8", cwd: __dirname }).trim();

17 return selfBin.startsWith(globalBin);

18 }

19 catch {

20 return false;

21 }

22}

23async function updateCommand() {

24 const pkg = "@broxium/cli";

25 console.log(`\n\x1b[35m◆ Broxium Self-Update\x1b[0m\n`);

26 (0, banner_1.printInfo)(`Current version: \x1b[1m${version_1.VERSION}\x1b[0m`);

27 let latest;

28 try {

29 process.stdout.write(" Checking npm registry… ");

30 latest = getLatestVersion(pkg);

31 process.stdout.write(`\x1b[32m${latest}\x1b[0m\n`);

32 }

33 catch (e) {

34 process.stdout.write("\n");

35 (0, banner_1.printError)(`Could not reach npm registry: ${e.message}`);

36 process.exit(1);

37 }

38 if (latest === version_1.VERSION) {

39 (0, banner_1.printSuccess)(`Already on the latest version (${version_1.VERSION}). Nothing to do.`);

40 return;

41 }

42 console.log(`\n New version available: \x1b[32m${latest}\x1b[0m (current: \x1b[33m${version_1.VERSION}\x1b[0m)`);

43 console.log(" Installing…\n");

44 const result = (0, child_process_1.spawnSync)("npm", ["install", "-g", `${pkg}@${latest}`], {

45 stdio: "inherit",

46 encoding: "utf-8",

47 });

48 if (result.status !== 0) {

49 (0, banner_1.printError)("Update failed. Try manually: npm install -g @broxium/cli");

50 if (process.platform !== "win32") {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/commands/update.jsView on unpkg · L43

51 (0, banner_1.printInfo)("On macOS/Linux you may need: sudo npm install -g @broxium/cli");

52 }

53 process.exit(1);

54 }

55 console.log();

56 (0, banner_1.printSuccess)(`Updated to ${latest}! Run \x1b[1mbroxium -v\x1b[0m to confirm.`);

57}

dist/commands/login.jsView file

Lines 31-71javascript

31 __setModuleDefault(result, mod);

32 return result;

33 };

34})();

35var __importDefault = (this && this.__importDefault) || function (

dist/commands/publish.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @broxium/cli@1.10.1 matchedIdentity = npm:QGJyb3hpdW0vY2xp:1.10.1 similarity = 0.857 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/commands/publish.jsView on unpkg

Source & flagged code

4 flagged · loading source

dist/commands/update.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code