registry / @cocreate/cli / 1.56.1

@cocreate/cli@1.56.1

Polyrepo management bash CLI tool. Run all git commands and yarn commands on multiple repositories. Also includes a few custom macros for cloning, installing, etc.

Static Scan Results

scanned 8h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystem

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 47 file(s), 139 KB of source, external domains: cdn.cocreate.app, cdn.jsdelivr.net, cocreate.app, deb.nodesource.com, github.com, img.badgesize.io, img.shields.io, schema.org

Source & flagged code

5 flagged

package.jsonView file

Lines 1-39json

2 "name": "@cocreate/cli",

3 "version": "1.56.1",

4 "description": "Polyrepo management bash CLI tool. Run all git commands and yarn commands on multiple repositories. Also includes a few custom macros for cloning, installing, etc.",

5 "keywords"

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node src/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node src/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

src/execute.jsView file

4const util = require("node:util"); L5: const exec = util.promisify(require("node:child_process").exec); L6: const { getConfig } = require("./getConfig");

High

Child Process

Package source references child process execution.

src/execute.jsView on unpkg · L4

src/addMeta.jsView file

1const fs = require("fs"); L2: const path = require("path");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/addMeta.jsView on unpkg · L1

src/commands/fs/webpack.jsView file

145fs.writeFileSync(webpackPath, fileContent); L146: execSync(`npx prettier --write "${webpackPath}"`).toString(); L147: return true;

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/commands/fs/webpack.jsView on unpkg · L145

Findings

3 High4 Medium4 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processsrc/execute.js

HighRuntime Package Installsrc/commands/fs/webpack.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requiresrc/addMeta.js

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

src/execute.jsView file

Lines 1-24javascript

1const path = require("path");

2const fs = require("fs");

3const spawn = require("./spawn");

4const util = require("node:util");

5const exec = util.promisify(require("node:child_process").exec);

6const { getConfig } = require("./getConfig");

High

Child Process

Package source references child process execution.

src/execute.jsView on unpkg · L4

8const { color } = require("./fonts");

10module.exports = async function execute(command, config) {

11 let failed = [];

12 let [filename, ...args] = command.replaceAll("'", '"').trim().split(" ");

14 let type;

16 if (filename.endsWith(".js")) {

17 type = filename.slice(0, -3);

18 } else {

19 type = filename;

20 filename += ".js";

21 }

23 let predefined = path.resolve(__dirname, "commands", filename);

24 let isPredefined = fs.existsSync(predefined);

src/addMeta.jsView file

Lines 1-21javascript

1const fs = require("fs");

2const path = require("path");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/addMeta.jsView on unpkg · L1

4/**

5 * CLI-compatible function to enrich repository configurations with metadata

6 * (e.g. package.json details, dependency maps).

7 *

8 * @param {Array<Object>} repos - List of repository configuration items.

9 * @param {Array<Object>} failed - Reference list to register execution failures.

10 * @param {string} [directory] - Optional parent directory to override path resolution.

11 * @returns {Promise<Array<Object>>} Enriched repositories array.

12 */

13module.exports = async function addMeta(repos, failed, directory) {

14 const cwd = process.cwd();

16 for (let i = 0; i < repos.length; i++) {

17 const repo = repos[i];

18 if (!repo) continue;

20 const rawPath = repo.path || repo.absolutePath || repo.directory;

21 if (!rawPath) {

src/commands/fs/webpack.jsView file

Lines 125-165javascript

125 minimize: isProduction,

126 minimizer: [

127 new EsbuildPlugin({

128 target: "es2017",

129 css: true

130 })

131 ],

132 splitChunks: {

133 cacheGroups: {

134 defaultVendors: false

135 },

136 }

137 },

138 performance: {

139 hints: isProduction ? "warning" : false

140 }

141 };

142 return config;

143};

144`;

145 fs.writeFileSync(webpackPath, fileContent);

146 execSync(`npx prettier --write "${webpackPath}"`).toString();

147 return true;

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/commands/fs/webpack.jsView on unpkg · L145

148 } catch (error) {

149 return false;

150 }

151}

152

153function toCamelCase(str) {

154 let index = 0;

155 str = str.replace(/^CoCreate-/, "");

156 do {

157 index = str.indexOf("-", index);

158 if (index !== -1) {

159 let t = str.substring(0, index);

160 if (

161 index + 1 < str.length &&

162 str[index + 1] >= "a" &&

163 str[index + 1] <= "z"

164 ) {

165 t += String.fromCharCode(str.charCodeAt(index + 1) - 32);