registry / @chargebee/chargebee-apps-shared / 0.0.1

@chargebee/chargebee-apps-shared@0.0.1

Shared interfaces and utilities for Chargebee Apps CLI

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 7 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystem

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 22 file(s), 107 KB of source

Source & flagged code

3 flagged

dist/dependency/dependency-manager.jsView file

Lines 1-26javascript

1"use strict";

2var __importDefault = (this && this.__importDefault) || function (mod) {

3 return (mod && mod.__esModule) ? mod : { "default": mod };

4};

5Object.defineProperty(exports, "__esModule", { value: true });

6exports.DependencyManager = void 0;

7const child_process_1 = require("child_process");

8const path_1 = __importDefault(require("path"));

High

Child Process

Package source references child process execution.

dist/dependency/dependency-manager.jsView on unpkg · L6

9const semver_1 = __importDefault(require("semver"));

10const internal_logger_1 = require("../logger/internal-logger");

11/**

12 * DependencyManager handles isolated npm installations for user projects

13 * Public implementation for managing dependencies in development environment

14 */

15class DependencyManager {

16 constructor(fileSystem) {

17 this.fileSystem = fileSystem;

18 this.installed = false;

19 }

20 /**

21 * Ensures dependencies are installed for a user project

22 * @param {string} projectPath - Path to the user project directory

23 * @param {Manifest} manifest - The project manifest containing dependencies

24 * @returns {Promise<void>}

25 */

26 async ensureDependencies(projectPath, manifest) {

Lines 89-129javascript

89 };

90 }

91 /**

92 * Creates or updates package.json for the project

93 * @param {string} packageJsonPath - Path to package.json

94 * @param {Record<string, string>} dependencies - Dependencies from manifest

95 */

96 async createPackageJson(packageJsonPath, dependencies) {

97 const

dist/validator/package-validator.jsView file

Lines 1-26javascript

1"use strict";

2var __importDefault = (this && this.__importDefault) || function (mod) {

3 return (mod && mod.__esModule) ? mod : { "default": mod };

4};

5Object.

Source & flagged code

3 flagged · loading source

dist/dependency/dependency-manager.jsView file

6exports.DependencyManager = void 0; L7: const child_process_1 = require("child_process"); L8: const path_1 = __importDefault(require("path"));

High

Child Process

Package source references child process execution.

dist/dependency/dependency-manager.jsView on unpkg · L6

109try { L110: (0, child_process_1.execSync)('npm install --ignore-scripts --no-audit --no-fund --loglevel=error', { L111: cwd: handlerPath,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/dependency/dependency-manager.jsView on unpkg · L109

dist/validator/package-validator.jsView file

6exports.PackageValidator = void 0; L7: const path_1 = __importDefault(require("path")); L8: /**

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/validator/package-validator.jsView on unpkg · L6

Findings

2 High3 Medium2 Low

HighChild Processdist/dependency/dependency-manager.js

HighRuntime Package Installdist/dependency/dependency-manager.js

MediumDynamic Requiredist/validator/package-validator.js

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

Source & flagged code

3 flagged

dist/dependency/dependency-manager.jsView file

Lines 1-26javascript

1"use strict";

2var __importDefault = (this && this.__importDefault) || function (mod) {

3 return (mod && mod.__esModule) ? mod : { "default": mod };

4};

5Object.defineProperty(exports, "__esModule", { value: true });

6exports.DependencyManager = void 0;

7const child_process_1 = require("child_process");

8const path_1 = __importDefault(require("path"));

High

Child Process

Package source references child process execution.

dist/dependency/dependency-manager.jsView on unpkg · L6

9const semver_1 = __importDefault(require("semver"));

10const internal_logger_1 = require("../logger/internal-logger");

11/**

12 * DependencyManager handles isolated npm installations for user projects

13 * Public implementation for managing dependencies in development environment

14 */

15class DependencyManager {

16 constructor(fileSystem) {

17 this.fileSystem = fileSystem;

18 this.installed = false;

19 }

20 /**

21 * Ensures dependencies are installed for a user project

22 * @param {string} projectPath - Path to the user project directory

23 * @param {Manifest} manifest - The project manifest containing dependencies

24 * @returns {Promise<void>}

25 */

26 async ensureDependencies(projectPath, manifest) {

Lines 89-129javascript

89 };

90 }

91 /**

92 * Creates or updates package.json for the project

93 * @param {string} packageJsonPath - Path to package.json

94 * @param {Record<string, string>} dependencies - Dependencies from manifest

95 */

96 async createPackageJson(packageJsonPath, dependencies) {

97 const

dist/validator/package-validator.jsView file

Lines 1-26javascript

1"use strict";

2var __importDefault = (this && this.__importDefault) || function (mod) {

3 return (mod && mod.__esModule) ? mod : { "default": mod };

4};

5Object.