registry / @celsian/cli / 0.5.4

@celsian/cli@0.5.4

Command-line tools for CelsianJS projects

Static Scan Results

scanned 6h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 9 file(s), 33.0 KB of source, external domains: docs.aws.amazon.com, fly.io, railway.com

Source & flagged code

3 flagged

dist/commands/deploy.jsView file

Lines 1-21javascript

1// @celsian/cli — Deploy command: generates config files and deploys to platform CLIs

2import { execSync } from "node:child_process";

3import { existsSync, mkdirSync, writeFileSync } from "node:fs";

High

Child Process

Package source references child process execution.

dist/commands/deploy.jsView on unpkg · L1

4import { dirname, resolve } from "node:path";

5import { logger } from "../utils/logger.js";

6const VALID_TARGETS = ["vercel", "lambda", "cloudflare", "fly", "railway", "docker"];

7// -- Auto-detection from existing config files ----------------------------------

8const CONFIG_DETECTION = [

9 ["wrangler.toml", "cloudflare"],

10 ["fly.toml", "fly"],

11 ["vercel.json", "vercel"],

12 ["railway.json", "railway"],

13 ["template.yaml", "lambda"],

14];

15function autoDetectPlatform() {

16 const cwd = process.cwd();

17 for (const [file, target] of CONFIG_DETECTION) {

18 if (existsSync(resolve(cwd, file))) {

19 return target;

20 }

21 }

Lines 334-374javascript

334 // The generated handler imports the platform adapter — tell the user the

335 // exact install command so the next step never fails on a missing package.

336 const adapterPkg = ADAPTER_PACKAGES[target];

337 if (adapterPkg) {

338 console.log("");

339 logger.info(`Install the platform adapter (required by the generated handler):`);

340 logger.bold(` npm install ${

dist/commands/routes.jsView file

Lines 3-43javascript

3import { existsSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";

4import { tmpdir } from "node:os";

5import { join, resolve } from "node:path";

6import { logger } from "../utils/logger.js";

7const NO_APP_MARKER = "__CELSIAN_NO_APP__";

Source & flagged code

3 flagged · loading source

dist/commands/deploy.jsView file

1// @celsian/cli — Deploy command: generates config files and deploys to platform CLIs L2: import { execSync } from "node:child_process"; L3: import { existsSync, mkdirSync, writeFileSync } from "node:fs";

High

Child Process

Package source references child process execution.

dist/commands/deploy.jsView on unpkg · L1

354try { L355: execSync("npx celsian build", { cwd, stdio: "inherit" }); L356: }

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/commands/deploy.jsView on unpkg · L354

dist/commands/routes.jsView file

23// ("Top-level await is currently not supported with the cjs output format"). L24: const loaderScript = `const mod = await import(${JSON.stringify(`file://${fullEntry}`)}); L25: const app = mod.default ?? mod.app;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/commands/routes.jsView on unpkg · L23

Findings

3 High3 Medium4 Low

HighChild Processdist/commands/deploy.js

HighShell

HighRuntime Package Installdist/commands/deploy.js

MediumDynamic Requiredist/commands/routes.js

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

dist/commands/deploy.jsView file

Lines 1-21javascript

1// @celsian/cli — Deploy command: generates config files and deploys to platform CLIs

2import { execSync } from "node:child_process";

3import { existsSync, mkdirSync, writeFileSync } from "node:fs";

High

Child Process

Package source references child process execution.

dist/commands/deploy.jsView on unpkg · L1

4import { dirname, resolve } from "node:path";

5import { logger } from "../utils/logger.js";

6const VALID_TARGETS = ["vercel", "lambda", "cloudflare", "fly", "railway", "docker"];

7// -- Auto-detection from existing config files ----------------------------------

8const CONFIG_DETECTION = [

9 ["wrangler.toml", "cloudflare"],

10 ["fly.toml", "fly"],

11 ["vercel.json", "vercel"],

12 ["railway.json", "railway"],

13 ["template.yaml", "lambda"],

14];

15function autoDetectPlatform() {

16 const cwd = process.cwd();

17 for (const [file, target] of CONFIG_DETECTION) {

18 if (existsSync(resolve(cwd, file))) {

19 return target;

20 }

21 }

Lines 334-374javascript

334 // The generated handler imports the platform adapter — tell the user the

335 // exact install command so the next step never fails on a missing package.

336 const adapterPkg = ADAPTER_PACKAGES[target];

337 if (adapterPkg) {

338 console.log("");

339 logger.info(`Install the platform adapter (required by the generated handler):`);

340 logger.bold(` npm install ${

dist/commands/routes.jsView file

Lines 3-43javascript

3import { existsSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";

4import { tmpdir } from "node:os";

5import { join, resolve } from "node:path";

6import { logger } from "../utils/logger.js";

7const NO_APP_MARKER = "__CELSIAN_NO_APP__";