registry / @calibrate-ds/cli / 0.1.76

@calibrate-ds/cli@0.1.76

⚠ Under review

Calibrate — local-first design system compiler. Reads Figma files, normalizes them into a typed DesignSystemModel, and generates React components, design tokens, and AI-ready implementation prompts via MCP.

Static Scan Results

scanned 2d ago · by rust-scanner

Static analysis flagged 12 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 63 file(s), 615 KB of source, external domains: us.i.posthog.com, www.figma.com

Source & flagged code

5 flagged

dist/utils/storybook-setup.jsView file

Lines 1-23javascript

1import { resolveDSPaths, setupStorybook, patchStorybookStories, patchStorybookPreview, detectPackageManager, checkStorybookReadiness, detectBundler } from "@calibrate-ds/core";

2import { createInterface } from "node:readline/promises";

3import { stdin as input, stdout as output } from "node:process";

4import { spawnSync } from "node:child_process";

5import * as path from "node:path";

High

Child Process

Package source references child process execution.

dist/utils/storybook-setup.jsView on unpkg · L3

6import * as fs from "node:fs/promises";

7import { logger } from "./logger.js";

8import { getFramework, storybookPackageFor } from "./framework-registry.js";

9const C = {

10 bold: "\x1b[1m",

11 dim: "\x1b[2m",

12 cyan: "\x1b[36m",

13 green: "\x1b[32m",

14 yellow: "\x1b[33m",

15 reset: "\x1b[0m",

16};

17/**

18 * Ensures `package.json` at `pkgDir` has `storybook` and `build-storybook` scripts.

19 * No-ops if both are already present. Returns true if the file was modified.

20 */

21export async function injectStorybookScripts(pkgDir) {

22 const pkgPath = path.join(pkgDir, "package.json");

23 let pkg;

Lines 96-136javascript

96 steps.forEach((step, i) => {

97 console.log(` ${C.dim}${i + 1}.${C.reset} ${step.label}`);

98 console.log(` ${C.cyan}${cdCmd ?

dist/mcp/tools/action-tools.jsView file

Lines 1-41javascript

1import * as fs from "node:fs/promises";

2import * as path from "node:path";

3import { z } from "zod";

4import { getDesignToolAdapter, saveSnapshot, exportAllComponentContexts, loadManifest, updateComponentArtifacts, loadConfig, getGenerator, syncManifestWithReport, createNamingStrategy, resolveDSPaths, isIconComponent, normalizeIconDisplayName, getComponentContext, generateComponentStories, generateComponentPrompt, generateComponentDoc, buildReverseDepsMap, formatMetadataHeader, pruneStaleComponents, resolveTokenSource, enrichIconsWithSvg, enrichBitmapAssets, enrichComponentThumbnails, resolveToken, }

dist/commands/init.jsView file

Lines 436-476javascript

436 // ── Install deps (fresh repos) ────────────────────────────────────

437 if (isFresh && uiPackageRoot) {

438 // pm is interpolated into a shell command (shell:true is required on

439 // Windows where package managers are .cmd shims) — never let anything

440 // outside this whitelist through.

441 if (!["pnpm", "npm", "yarn"].includes

Source & flagged code

5 flagged · loading source

dist/utils/storybook-setup.jsView file

3import { stdin as input, stdout as output } from "node:process"; L4: import { spawnSync } from "node:child_process"; L5: import * as path from "node:path";

High

Child Process

Package source references child process execution.

dist/utils/storybook-setup.jsView on unpkg · L3

116stdio: "inherit", L117: shell: true, L118: });

High

Shell

Package source references shell execution.

dist/utils/storybook-setup.jsView on unpkg · L116

dist/mcp/tools/action-tools.jsView file

21try { L22: return JSON.parse(await fs.readFile(path.join(workspaceRoot, "ptb.lock"), "utf-8")); L23: } ... L93: type: "text", L94: text: `${tokenEnv} is not set.\n\nThe easiest fix — run this once in any terminal:\n\n ptb token set <your-figma-token>\n\nThis stores the token in ~/.config/calibrate-ds/credenti... L95: }], ... L510: ...(modelComponent.tokenBindings ? { tokenBindings: modelComponent.tokenBindings } : {}), L511: ...(modelComponent.styleMetadata ? { styleMetadata: modelComponent.styleMetadata } : {}), L512: ...(modelComponent.layout ? { layout: modelComponent.layout } : {}),

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/mcp/tools/action-tools.jsView on unpkg · L21

dist/commands/init.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @calibrate-ds/cli@0.1.70 matchedIdentity = npm:QGNhbGlicmF0ZS1kcy9jbGk:0.1.70 similarity = 0.841 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/commands/init.jsView on unpkg

456console.log(`\n Initializing Storybook...`); L457: const sbInit = spawnSync("npx storybook@latest init --no-dev", { L458: cwd: uiPackageRoot,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/commands/init.jsView on unpkg · L456

Findings

1 Critical3 High4 Medium4 Low

CriticalPrevious Version Dangerous Deltadist/commands/init.js

HighChild Processdist/utils/storybook-setup.js

HighShelldist/utils/storybook-setup.js

HighRuntime Package Installdist/commands/init.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/mcp/tools/action-tools.js

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

5 flagged

dist/utils/storybook-setup.jsView file

Lines 1-23javascript

1import { resolveDSPaths, setupStorybook, patchStorybookStories, patchStorybookPreview, detectPackageManager, checkStorybookReadiness, detectBundler } from "@calibrate-ds/core";

2import { createInterface } from "node:readline/promises";

3import { stdin as input, stdout as output } from "node:process";

4import { spawnSync } from "node:child_process";

5import * as path from "node:path";

High

Child Process

Package source references child process execution.

dist/utils/storybook-setup.jsView on unpkg · L3

6import * as fs from "node:fs/promises";

7import { logger } from "./logger.js";

8import { getFramework, storybookPackageFor } from "./framework-registry.js";

9const C = {

10 bold: "\x1b[1m",

11 dim: "\x1b[2m",

12 cyan: "\x1b[36m",

13 green: "\x1b[32m",

14 yellow: "\x1b[33m",

15 reset: "\x1b[0m",

16};

17/**

18 * Ensures `package.json` at `pkgDir` has `storybook` and `build-storybook` scripts.

19 * No-ops if both are already present. Returns true if the file was modified.

20 */

21export async function injectStorybookScripts(pkgDir) {

22 const pkgPath = path.join(pkgDir, "package.json");

23 let pkg;

Lines 96-136javascript

96 steps.forEach((step, i) => {

97 console.log(` ${C.dim}${i + 1}.${C.reset} ${step.label}`);

98 console.log(` ${C.cyan}${cdCmd ?

dist/mcp/tools/action-tools.jsView file

Lines 1-41javascript

1import * as fs from "node:fs/promises";

2import * as path from "node:path";

3import { z } from "zod";

dist/commands/init.jsView file

Lines 436-476javascript

436 // ── Install deps (fresh repos) ────────────────────────────────────

437 if (isFresh && uiPackageRoot) {

438 // pm is interpolated into a shell command (shell:true is required on

439 // Windows where package managers are .cmd shims) — never let anything

440 // outside this whitelist through.

441 if (!["pnpm", "npm", "yarn"].includes