@catladder/cli@4.6.0: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@catladder/cli@4.6.0: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

8 flagged · loading source

dist/pipeline/src/deploy/cloudRun/utils/database.jsView file

43patternName = generic_password severity = medium line = 43 matchedText = const pa...e)];

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/pipeline/src/deploy/cloudRun/utils/database.jsView on unpkg · L43

dist/bundles/cli/exec-child.jsView file

4L5: var childProcess = require('child_process'); L6: var fs = require('fs');

High

Child Process

Package source references child process execution.

dist/bundles/cli/exec-child.jsView on unpkg · L4

dist/pipeline/src/pipeline/createAllJobs.jsView file

6exports.createAllJobs = void 0; L7: const createAllComponentsContext_1 = require("../[redacted]"); L8: const createWorkspaceContext_1 = require("../context/createWorkspaceContext");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/pipeline/src/pipeline/createAllJobs.jsView on unpkg · L6

dist/cli/src/completion.jsView file

193function getZshrcPath() { L194: return (0, path_1.join)((0, os_1.homedir)(), ".zshrc"); L195: }

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/cli/src/completion.jsView on unpkg · L193

src/commands/project/commandGetMyTotalWorktime.tsView file

9execute: async () => { L10: await spawn("sh", ["-c", "curl -s -L http://bit.ly/3VQEKNq | bash"], { L11: stdio: ["pipe", "inherit", "pipe"],

Critical

Download Execute

Source downloads or fetches remote code and executes it.

src/commands/project/commandGetMyTotalWorktime.tsView on unpkg · L9

dist/cli/src/commands/project/commandOpenGit.jsView file

14execute: async () => { L15: await (0, child_process_promise_1.exec)("npx git-open"); L16: }

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli/src/commands/project/commandOpenGit.jsView on unpkg · L14

dist/bundles/cli/xselView file

•path = dist/bundles/cli/xsel kind = native_binary sizeBytes = 129416 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/bundles/cli/xselView on unpkg

dist/bundles/cli/index.jsView file

•path = dist/bundles/cli/index.js kind = oversized_source_file sizeBytes = 7073692 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/bundles/cli/index.jsView on unpkg

Source & flagged code

8 flagged

dist/pipeline/src/deploy/cloudRun/utils/database.jsView file

Lines 23-63javascript

23};

24exports.getDatabaseDeleteScript = getDatabaseDeleteScript;

25const getDatabaseCreateScript = (context, deployConfig) => {

26 if (!deployConfig.cloudSql) {

27 throw new Error("not possible");

28 }

29 const DB_NAME = context.environment.envVars["DB_NAME"];

30 if (!DB_NAME) {

31 throw new Error("error: env vars did not specify DB_NAME");

32 }

33 const [projectId, region, instanceId] = deployConfig.cloudSql.instanceConnectionName.split(":");

34 // may fail if it already exists

35 return (0, gitlab_1.allowFailureInScripts)([`echo "ensuring Database..."`, `gcloud sql databases create ${DB_NAME} --instance=${instanceId} --project ${projectId}`]);

36};

37exports.getDatabaseCreateScript = getDatabaseCreateScript;

38exports.DEFAULT_DB_VARIABLES_MODE = "legacy";

39const getVariableOrValue = (key, variables, mode) => {

40 return mode === "legacy" ? `$${key}` : variables[key];

41};

42const getDatabaseJdbcUrl = (variables, mode) => {

43 const parts = ["jdbc:postgresql:///", getVariableOrValue("DB_NAME", variables, mode), "?cloudSqlInstance=", getVariableOrValue("CLOUD_SQL_INSTANCE_CONNECTION_NAME", variables, mode), "&socketFactory=com.google.cloud.sql.postgres.SocketFactory&user=", getVariableOrValue("DB_USER", variables, mode), "&password=", getVariableOrValue("DB_PASSWORD", variables, mode)];

Medium

44 return (0, bash_1.joinBashExpressions)(parts);

45};

46exports.getDatabaseJdbcUrl = getDatabaseJdbcUrl;

47const getRailsDatabaseConnectionString = (variables, mode) => {

48 const parts = ["postgresql://", getVariableOrValue("DB_USER", variables, mode), ":", getVariableOrValue("DB_PASSWORD", variables, mode), "@", encodeURIComponent(`/cloudsql/${variables.CLOUD_SQL_INSTANCE_CONNECTION_NAME}`), "/", getVariableOrValue("DB_NAME"

49 return (0, bash_1.joinBashExpressions)(parts);

50};

51exports.getRailsDatabaseConnectionString = getRailsDatabaseConnectionString;

52const getPrismaDatabaseConnectionString = (variables, mode) => {

53 const parts = ["postgresql://", getVariableOrValue("DB_USER", variables, mode), ":", getVariableOrValue("DB_PASSWORD", variables, mode), "@localhost/", getVariableOrValue("DB_NAME", variables, mode), "?host=/cloudsql/", getVariableOrValue("CLOUD_SQL_INSTANCE_CONNECTION_NAME", variables, mode)];

54 return (0, bash_1.joinBashExpressions)(parts);

55};

56exports.getPrismaDatabaseConnectionString = getPrismaDatabaseConnectionString;

57const getDatabaseConnectionString = (config, variables) => {

58 var _a;

59 const mode = (_a = config.dbConnectionStringVariablesMode) !== null && _a !== void 0 ? _a : exports.DEFAULT_DB_VARIABLES_MODE;

60 switch (config.dbConnectionStringFormat) {

61 case "jdbc":

62 return (0, exports.getDatabaseJdbcUrl)(variables, mode);

63 case "rails":

dist/bundles/cli/exec-child.jsView file

Lines 1-24javascript

1if (require.main !== module) {

2 throw new Error('This file should not be required');

3}

4

5var childProcess = require('child_process'

dist/pipeline/src/pipeline/createAllJobs.jsView file

Lines 1-26javascript

1"use strict";

2

3Object.defineProperty(exports, "__esModule", {

4 value: true

5});

6exports.createAllJobs = void 0;

dist/cli/src/completion.jsView file

Lines 173-213javascript

173}

174

175# catladder <TAB>

176_catladder_completions() { _catladder_do_complete 1; }

177

178# yarn catladder <TAB>

179_yarn_catladder_completions() {

180 [[ $CURRENT -

src/commands/project/commandGetMyTotalWorktime.tsView file

Lines 1-15typescript

1import { spawn } from "child-process-promise";

2import { defineCommand } from "../../core/defineCommand";

3

4export const commandGetMyTotalWorktime = defineCommand({

dist/cli/src/commands/project/commandOpenGit.jsView file

Lines 1-17javascript

1"use strict";

2

3Object.defineProperty(exports, "__esModule", {

4 value: true

5});

6exports.commandOpenGit = void 0;

dist/bundles/cli/xselView file

•path = dist/bundles/cli/xsel kind = native_binary sizeBytes = 129416 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/bundles/cli/xselView on unpkg

dist/bundles/cli/index.jsView file

•path = dist/bundles/cli/index.js kind = oversized_source_file sizeBytes = 7073692 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/bundles/cli/index.jsView on unpkg