registry / @cracktier/kit / 0.1.27

@cracktier/kit@0.1.27

Cracktier internal component library

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 7 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcess

Supply chain

HighEntropyStrings

Manifest

NoLicense

scanned 30 file(s), 164 KB of source

Source & flagged code

2 flagged

dist/commands/add.jsView file

Lines 1-68javascript

1"use strict";

2var __importDefault = (this && this.__importDefault) || function (mod) {

3 return (mod && mod.__esModule) ? mod : { "default": mod };

4};

5Object.defineProperty(exports, "__esModule", { value: true });

6exports.add = add;

7const path_1 = __importDefault(require("path"));

8const fs_extra_1 = __importDefault(require("fs-extra"));

9const picocolors_1 = __importDefault(require("picocolors"));

10const child_process_1 = require("child_process");

11const registry_1 = require("../registry");

High

Child Process

Package source references child process execution.

dist/commands/add.jsView on unpkg · L9

12const PACKAGE_ROOT = path_1.default.join(__dirname, "..", "..");

13async function installComponent(name, installed) {

14 if (installed.has(name))

15 return;

16 const item = registry_1.registry[name];

17 if (!item) {

18 console.error(picocolors_1.default.red(`✗ Unknown component: "${name}"`));

19 console.log(` Available: ${Object.keys(registry_1.registry).join(", ")}`);

20 process.exit(1);

21 }

22 // Install registry dependencies first (depth-first)

23 for (const dep of item.registryDependencies) {

24 await installComponent(dep, installed);

25 }

26 // Copy component files into the user's project

27 for (const file of item.files) {

28 const src = path_1.default.join(PACKAGE_ROOT, file.src);

29 const dest = path_1.default.join(process.cwd(), file.dest);

30 if (await fs_extra_1.default.pathExists(dest)) {

31 console.log(picocolors_1.default.yellow(` ~ ${file.dest} (already exists, skipping)`));

32 }

33 else {

34 if (!(await fs_extra_1.default.pathExists(src))) {

35 console.error(picocolors_1.default.red(`✗ ${name}: source file missing from package: ${file.src}`));

36 console.error(picocolors_1.default.gray(` This is a packaging bug in @cracktier/kit — please report it.`));

37 process.exit(1);

38 }

39 await fs_extra_1.default.ensureDir(path_1.default.dirname(dest));

40 await fs_extra_1.default.copy(src, dest);

41 console.log(picocolors_1.default.green(` + ${file.dest}`));

42 }

43 }

44 // Install npm dependencies if any

45 if (item.npmDependencies.length > 0) {

46 const pkgManager = detectPackageManager();

47 const deps = item.npmDependencies.join(" ");

48 const cmd = pkgManager === "pnpm"

49 ? `pnpm add ${deps}`

50 : pkgManager === "yarn"

51 ? `yarn add ${deps}`

52 : `npm install ${deps}`;

53 console.log(picocolors_1.default.gray(` Installing ${deps}…`));

54 try {

55 (0, child_process_1.execSync)(cmd, { stdio: "inherit", cwd: process.cwd() });

56 }

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/commands/add.jsView on unpkg · L48

57 catch {

58 console.log(picocolors_1.default.yellow(` Could not auto-install. Run manually:\n ${cmd}`));

59 }

60 }

61 installed.add(name);

62 console.log(picocolors_1.default.green(`✓ ${name}`));

63}

64function detectPackageManager() {

65 const cwd = process.cwd();

66 if (fs_extra_1.default.existsSync(path_1.default.join(cwd, "pnpm-lock.yaml")))

67 return "pnpm";

68 if (fs_extra_1.default.existsSync(path_1.default.join(cwd, "yarn.lock")))

Source & flagged code

2 flagged · loading source

dist/commands/add.jsView file

9const picocolors_1 = __importDefault(require("picocolors")); L10: const child_process_1 = require("child_process"); L11: const registry_1 = require("../registry");

High

Child Process

Package source references child process execution.

dist/commands/add.jsView on unpkg · L9

48const cmd = pkgManager === "pnpm" L49: ? `pnpm add ${deps}` L50: : pkgManager === "yarn" ... L54: try { L55: (0, child_process_1.execSync)(cmd, { stdio: "inherit", cwd: process.cwd() }); L56: }

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/commands/add.jsView on unpkg · L48

Findings

2 High1 Medium4 Low

HighChild Processdist/commands/add.js

HighRuntime Package Installdist/commands/add.js

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowHigh Entropy Strings

LowNo License

Source & flagged code

2 flagged

dist/commands/add.jsView file

Lines 1-68javascript

1"use strict";

2var __importDefault = (this && this.__importDefault) || function (mod) {

3 return (mod && mod.__esModule) ? mod : { "default": mod };

4};

5Object.defineProperty(exports, "__esModule", { value: true });

6exports.add = add;

7const path_1 = __importDefault(require("path"));

8const fs_extra_1 = __importDefault(require("fs-extra"));

9const picocolors_1 = __importDefault(require("picocolors"));

10const child_process_1 = require("child_process");

11const registry_1 = require("../registry");

High

Child Process

Package source references child process execution.

dist/commands/add.jsView on unpkg · L9

12const PACKAGE_ROOT = path_1.default.join(__dirname, "..", "..");

13async function installComponent(name, installed) {

14 if (installed.has(name))

15 return;

16 const item = registry_1.registry[name];

17 if (!item) {

18 console.error(picocolors_1.default.red(`✗ Unknown component: "${name}"`));

19 console.log(` Available: ${Object.keys(registry_1.registry).join(", ")}`);

20 process.exit(1);

21 }

22 // Install registry dependencies first (depth-first)

23 for (const dep of item.registryDependencies) {

24 await installComponent(dep, installed);

25 }

26 // Copy component files into the user's project

27 for (const file of item.files) {

28 const src = path_1.default.join(PACKAGE_ROOT, file.src);

29 const dest = path_1.default.join(process.cwd(), file.dest);

30 if (await fs_extra_1.default.pathExists(dest)) {

31 console.log(picocolors_1.default.yellow(` ~ ${file.dest} (already exists, skipping)`));

32 }

33 else {

34 if (!(await fs_extra_1.default.pathExists(src))) {

35 console.error(picocolors_1.default.red(`✗ ${name}: source file missing from package: ${file.src}`));

36 console.error(picocolors_1.default.gray(` This is a packaging bug in @cracktier/kit — please report it.`));

37 process.exit(1);

38 }

39 await fs_extra_1.default.ensureDir(path_1.default.dirname(dest));

40 await fs_extra_1.default.copy(src, dest);

41 console.log(picocolors_1.default.green(` + ${file.dest}`));

42 }

43 }

44 // Install npm dependencies if any

45 if (item.npmDependencies.length > 0) {

46 const pkgManager = detectPackageManager();

47 const deps = item.npmDependencies.join(" ");

48 const cmd = pkgManager === "pnpm"

49 ? `pnpm add ${deps}`

50 : pkgManager === "yarn"

51 ? `yarn add ${deps}`

52 : `npm install ${deps}`;

53 console.log(picocolors_1.default.gray(` Installing ${deps}…`));

54 try {

55 (0, child_process_1.execSync)(cmd, { stdio: "inherit", cwd: process.cwd() });

56 }

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/commands/add.jsView on unpkg · L48

57 catch {

58 console.log(picocolors_1.default.yellow(` Could not auto-install. Run manually:\n ${cmd}`));

59 }

60 }

61 installed.add(name);

62 console.log(picocolors_1.default.green(`✓ ${name}`));

63}

64function detectPackageManager() {

65 const cwd = process.cwd();

66 if (fs_extra_1.default.existsSync(path_1.default.join(cwd, "pnpm-lock.yaml")))

67 return "pnpm";

68 if (fs_extra_1.default.existsSync(path_1.default.join(cwd, "yarn.lock")))