registry / @calibrate-ds/cli / 0.1.67

@calibrate-ds/cli@0.1.67

⚠ Under review

**Calibrate is a local-first design system compiler for design engineers.** It reads your Figma file, builds a structured model of your design system, and uses it to scaffold typed components, design tokens, MDX docs, and AI implementation prompts — all f

Static Scan Results

scanned 10d ago · by rust-scanner

Static analysis flagged 12 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 61 file(s), 598 KB of source, external domains: www.figma.com

Source & flagged code

5 flagged

dist/utils/storybook-setup.jsView file

Lines 1-23javascript

1import { resolveDSPaths, setupStorybook, patchStorybookStories, patchStorybookPreview, detectPackageManager, checkStorybookReadiness, detectBundler } from "@calibrate-ds/core";

2import { createInterface } from "node:readline/promises";

3import { stdin as input, stdout as output } from "node:process";

4import { spawnSync } from "node:child_process";

5import * as path from "node:path";

High

Child Process

Package source references child process execution.

dist/utils/storybook-setup.jsView on unpkg · L3

6import * as fs from "node:fs/promises";

7import { logger } from "./logger.js";

8import { getFramework, storybookPackageFor } from "./framework-registry.js";

9const C = {

10 bold: "\x1b[1m",

11 dim: "\x1b[2m",

12 cyan: "\x1b[36m",

13 green: "\x1b[32m",

14 yellow: "\x1b[33m",

15 reset: "\x1b[0m",

16};

17/**

18 * Ensures `package.json` at `pkgDir` has `storybook` and `build-storybook` scripts.

19 * No-ops if both are already present. Returns true if the file was modified.

20 */

21export async function injectStorybookScripts(pkgDir) {

22 const pkgPath = path.join(pkgDir, "package.json");

23 let pkg;

Lines 96-136javascript

96 steps.forEach((step, i) => {

97 console.log(` ${C.dim}${i + 1}.${C.reset} ${step.label}`);

98 console.log(` ${C.cyan}${cdCmd ?

dist/mcp/tools/action-tools.jsView file

Lines 1-22javascript

1import * as fs from "node:fs/promises";

2import * as path from "node:path";

3import { execSync } from "node:child_process";

4import { z } from "zod";

Medium

dist/commands/init.jsView file

Lines 430-470javascript

430 }

431 // ── .ptb/ directory ───────────────────────────────────────────────

432 // Create early so the user can drop imported-tokens.json in before ptb scan runs

433 await fs.mkdir(path.join(cwd, ".ptb"), { recursive: true });

434 // ── .gitignore ────────────────────────────────────────────────────

435 await ensureGitignore(cwd).catch((e

dist/verify/run-verify.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @calibrate-ds/cli@0.1.65 matchedIdentity = npm:QGNhbGlicmF0ZS1kcy9jbGk:0.1.65 similarity = 0.951 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

dist/verify/run-verify.jsView on unpkg

Source & flagged code

5 flagged · loading source

dist/utils/storybook-setup.jsView file

3import { stdin as input, stdout as output } from "node:process"; L4: import { spawnSync } from "node:child_process"; L5: import * as path from "node:path";

High

Child Process

Package source references child process execution.

dist/utils/storybook-setup.jsView on unpkg · L3

116stdio: "inherit", L117: shell: true, L118: });

High

Shell

Package source references shell execution.

dist/utils/storybook-setup.jsView on unpkg · L116

dist/mcp/tools/action-tools.jsView file

2import * as path from "node:path"; L3: import { execSync } from "node:child_process"; L4: import { z } from "zod"; ... L31: try { L32: return JSON.parse(await fs.readFile(path.join(workspaceRoot, "ptb.lock"), "utf-8")); L33: } ... L103: type: "text", L104: text: `${tokenEnv} is not set.\n\nThe easiest fix — run this once in any terminal:\n\n ptb token set <your-figma-token>\n\nThis stores the token in ~/.config/calibrate-ds/credenti... L105: }], ... L513: ...(modelComponent.tokenBindings ? { tokenBindings: modelComponent.tokenBindings } : {}), L514: ...(modelComponent.styleMetadata ? { styleMetadata: modelComponent.styleMetadata } : {}), L515: ...(modelComponent.layout ? { layout: modelComponent.layout } : {}),

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/mcp/tools/action-tools.jsView on unpkg · L2

dist/commands/init.jsView file

450console.log(`\n Initializing Storybook...`); L451: const sbInit = spawnSync("npx storybook@latest init --no-dev", { L452: cwd: uiPackageRoot,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/commands/init.jsView on unpkg · L450

dist/verify/run-verify.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

dist/verify/run-verify.jsView on unpkg

Findings

1 Critical3 High4 Medium4 Low

CriticalPrevious Version Dangerous Deltadist/verify/run-verify.js

HighChild Processdist/utils/storybook-setup.js

HighShelldist/utils/storybook-setup.js

HighRuntime Package Installdist/commands/init.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/mcp/tools/action-tools.js

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

5 flagged

dist/utils/storybook-setup.jsView file

Lines 1-23javascript

1import { resolveDSPaths, setupStorybook, patchStorybookStories, patchStorybookPreview, detectPackageManager, checkStorybookReadiness, detectBundler } from "@calibrate-ds/core";

2import { createInterface } from "node:readline/promises";

3import { stdin as input, stdout as output } from "node:process";

4import { spawnSync } from "node:child_process";

5import * as path from "node:path";

High

Child Process

Package source references child process execution.

dist/utils/storybook-setup.jsView on unpkg · L3

6import * as fs from "node:fs/promises";

7import { logger } from "./logger.js";

8import { getFramework, storybookPackageFor } from "./framework-registry.js";

9const C = {

10 bold: "\x1b[1m",

11 dim: "\x1b[2m",

12 cyan: "\x1b[36m",

13 green: "\x1b[32m",

14 yellow: "\x1b[33m",

15 reset: "\x1b[0m",

16};

17/**

18 * Ensures `package.json` at `pkgDir` has `storybook` and `build-storybook` scripts.

19 * No-ops if both are already present. Returns true if the file was modified.

20 */

21export async function injectStorybookScripts(pkgDir) {

22 const pkgPath = path.join(pkgDir, "package.json");

23 let pkg;

Lines 96-136javascript

96 steps.forEach((step, i) => {

97 console.log(` ${C.dim}${i + 1}.${C.reset} ${step.label}`);

98 console.log(` ${C.cyan}${cdCmd ?

dist/mcp/tools/action-tools.jsView file

Lines 1-22javascript

1import * as fs from "node:fs/promises";

2import * as path from "node:path";

3import { execSync } from "node:child_process";

4import { z } from "zod";

Medium

dist/commands/init.jsView file

Lines 430-470javascript

430 }

431 // ── .ptb/ directory ───────────────────────────────────────────────

432 // Create early so the user can drop imported-tokens.json in before ptb scan runs

433 await fs.mkdir(path.join(cwd, ".ptb"), { recursive: true });

434 // ── .gitignore ────────────────────────────────────────────────────

435 await ensureGitignore(cwd).catch((e

dist/verify/run-verify.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

dist/verify/run-verify.jsView on unpkg