registry / @craxjs/crax / 1.1.1

@craxjs/crax@1.1.1

Lightweight React framework built on Vite. A Next.js alternative that brings back the simplicity of Create React App.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 8 file(s), 15.1 KB of source, external domains: example.com, github.com, raw.githubusercontent.com

Source & flagged code

3 flagged

dist/index.jsView file

Lines 1-27javascript

1#!/usr/bin/env node

3// src/index.ts

4import { cp, readFile, writeFile, access, mkdir, rm } from "fs/promises";

5import { resolve, join, basename } from "path";

6import { fileURLToPath } from "url";

7import { createInterface }

Source & flagged code

3 flagged · loading source

dist/index.jsView file

148} L149: const { spawn } = await import("child_process"); L150: const tsxBin = resolve(cwd, "node_modules", ".bin", "tsx");

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L148

7import { createInterface } from "readline"; L8: var __dirname = fileURLToPath(new URL(".", import.meta.url)); L9: var REPO_RAW = "https://raw.githubusercontent.com/craxjs/crax/main"; L10: var LATEST_VERSION = 1; L11: async function prompt(question) { L12: const rl = createInterface({ input: process.stdin, output: process.stdout }); L13: return new Promise( ... L28: function detectPackageManager() { L29: const ua = process.env.npm[redacted] ?? ""; L30: if (ua.startsWith("yarn")) return "yarn"; ... L43: const { pipeline } = await import("stream/promises"); L44: const { createGunzip } = await import("zlib");

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L7

148} L149: const { spawn } = await import("child_process"); L150: const tsxBin = resolve(cwd, "node_modules", ".bin", "tsx"); ... L157: console.error(`Error running tsx: ${err.message}`); L158: console.error("Make sure tsx is installed: pnpm add -D tsx"); L159: process.exit(1);

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L148

Findings

3 High3 Medium4 Low

HighChild Processdist/index.js

HighSandbox Evasion Gated Capabilitydist/index.js

HighRuntime Package Installdist/index.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Lines 128-168javascript

128 }

129 const updatedConfig = configContent.replace(

130 /templateVersion:\s*\d+/,

131 `templateVersion: ${LATEST_VERSION}`

132 );

133 await writeFile(configPath, updatedConfig);

134 console.log(` Done. You're up to date.

135`);

136}

137async function og() {

138 const cwd = process.cwd();

139 const configPath = resolve(cwd, "crax.config.mjs");

140 if (!await dirExists(configPath)) {

141 console.error("Error: no crax.config.mjs found. Are you in a crax project?");

142 process.exit(1);

143 }

144 const generatePath = resolve(cwd, ".crax", "og", "generate.ts");

145 if (!await dirExists(generatePath)) {

146 console.error('Error: .crax/og/generate.ts not found. Run "crax upgrade" to get the latest .crax/ modules.');

147 process.exit(1);

148 }

149 const { spawn } = await import("child_process");

150 const tsxBin = resolve(cwd, "node_modules", ".bin", "tsx");

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L148

151 const child = spawn(tsxBin, [generatePath], {

152 cwd,

153 stdio: "inherit",

154 env: { ...process.env }

155 });

156 child.on("error", (err) => {

157 console.error(`Error running tsx: ${err.message}`);

158 console.error("Make sure tsx is installed: pnpm add -D tsx");

159 process.exit(1);

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L148

160 });

161 child.on("exit", (code) => {

162 process.exit(code ?? 0);

163 });

164}

165async function pwa() {

166 const cwd = process.cwd();

167 const configPath = resolve(cwd, "crax.config.mjs");

168 if (!await dirExists(configPath)) {