registry / @create-node-app/core / 0.6.10

@create-node-app/core@0.6.10

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

UrlStrings

Manifest

WildcardDependency

scanned 2 file(s), 85.4 KB of source, external domains: blogs.msdn.microsoft.com, bun.sh, github.com, pnpm.js.org, registry.npmjs.org, registry.yarnpkg.com, yarnpkg.com

Source & flagged code

3 flagged

dist/index.cjsView file

Lines 32-72javascript

32__export(index_exports, {

33 NON_EMPTY_DIR_ERROR_CODE: () => NON_EMPTY_DIR_ERROR_CODE,

34 NonEmptyTargetDirectoryError: () => NonEmptyTargetDirectoryError,

35 assertDirectoryIsEmpty: () => assertDirectoryIsEmpty,

36 checkForLatestVersion: () => checkForLatestVersion,

37 checkNodeVersion: () => checkNodeVersion,

38 createNodeApp: () => createNodeApp,

39 downloadRepository: () => downloadRepository,

40 getPackagePath: () => getPackagePath,

41 getTemplateBaseDirPath: () => getTemplateBaseDirPath,

42 getTemplateDirPath: () => getTemplateDirPath,

43 loadTemplateCnaConfig: () => loadTemplateCnaConfig,

44 printEnvInfo: () => printEnvInfo

45});

46module.exports = __toCommonJS(index_exports);

48// ../../node_modules/tsup/assets/cjs_shims.js

49var getImportMetaUrl = () => typeof document === "undefined" ? new URL(`file:${__filename}`).href : document.currentScript && document.currentScript.tagName.toUpperCase() === "SCRIPT" ? document.currentScript.src : new URL("main.js", document.baseURI).href;

50var importMetaUrl = /* @__PURE__ */ getImportMetaUrl();

52// index.ts

53var import_picocolors4 = __toESM(require("picocolors"), 1);

54var import_envinfo = __toESM(require("envinfo"), 1);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.cjsView on unpkg · L52

55var import_semver3 = __toESM(require("semver"), 1);

56var import_child_process3 = require("child_process");

58// installer.ts

59var import_lodash3 = __toESM(require("lodash"), 1);

60var import_path5 = __toESM(require("path"), 1);

61var import_fs6 = __toESM(require("fs"), 1);

62var import_picocolors3 = __toESM(require("picocolors"), 1);

63var import_os3 = __toESM(require("os"), 1);

64var import_semver2 = __toESM(require("semver"), 1);

65var import_child_process2 = require("child_process");

67// helpers.ts

68var import_child_process = require("child_process");

69var import_cross_spawn = __toESM(require("cross-spawn"), 1);

70var import_picocolors = __toESM(require("picocolors"), 1);

71var import_semver = __toESM(require("semver"), 1);

72var import_dns = __toESM(require("dns"), 1);

•matchType = previous_version_dangerous_delta matchedPackage = @create-node-app/core@0.6.3 matchedIdentity = npm:QGNyZWF0ZS1ub2RlLWFwcC9jb3Jl:0.6.3 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.cjsView on unpkg

dist/index.jsView file

Lines 1-32javascript

1var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {

2 get: (a, b) =>

Source & flagged code

3 flagged · loading source

dist/index.cjsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.cjsView on unpkg

52// index.ts L53: var import_picocolors4 = __toESM(require("picocolors"), 1); L54: var import_envinfo = __toESM(require("envinfo"), 1);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.cjsView on unpkg · L52

dist/index.jsView file

12var getDirname = () => path.dirname(getFilename()); L13: var __dirname = /* @__PURE__ */ getDirname(); L14: ... L18: import semver3 from "semver"; L19: import { execFileSync as execFileSync3 } from "child_process"; L20: ... L34: import semver from "semver"; L35: import dns from "dns"; L36: import { URL as URL2 } from "url"; ... L38: // executable.ts L39: var resolveExecutable = (bin) => process.platform === "win32" ? `${bin}.cmd` : bin; L40:

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L12

Findings

2 High5 Medium3 Low

HighSandbox Evasion Gated Capabilitydist/index.js

HighPrevious Version Dangerous Deltadist/index.cjs

MediumDynamic Requiredist/index.cjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumWildcard Dependency

LowScripts Present

LowFilesystem

LowUrl Strings

Source & flagged code

3 flagged

dist/index.cjsView file

Lines 32-72javascript

32__export(index_exports, {

33 NON_EMPTY_DIR_ERROR_CODE: () => NON_EMPTY_DIR_ERROR_CODE,

34 NonEmptyTargetDirectoryError: () => NonEmptyTargetDirectoryError,

35 assertDirectoryIsEmpty: () => assertDirectoryIsEmpty,

36 checkForLatestVersion: () => checkForLatestVersion,

37 checkNodeVersion: () => checkNodeVersion,

38 createNodeApp: () => createNodeApp,

39 downloadRepository: () => downloadRepository,

40 getPackagePath: () => getPackagePath,

41 getTemplateBaseDirPath: () => getTemplateBaseDirPath,

42 getTemplateDirPath: () => getTemplateDirPath,

43 loadTemplateCnaConfig: () => loadTemplateCnaConfig,

44 printEnvInfo: () => printEnvInfo

45});

46module.exports = __toCommonJS(index_exports);

48// ../../node_modules/tsup/assets/cjs_shims.js

50var importMetaUrl = /* @__PURE__ */ getImportMetaUrl();

52// index.ts

53var import_picocolors4 = __toESM(require("picocolors"), 1);

54var import_envinfo = __toESM(require("envinfo"), 1);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.cjsView on unpkg · L52

55var import_semver3 = __toESM(require("semver"), 1);

56var import_child_process3 = require("child_process");

58// installer.ts

59var import_lodash3 = __toESM(require("lodash"), 1);

60var import_path5 = __toESM(require("path"), 1);

61var import_fs6 = __toESM(require("fs"), 1);

62var import_picocolors3 = __toESM(require("picocolors"), 1);

63var import_os3 = __toESM(require("os"), 1);

64var import_semver2 = __toESM(require("semver"), 1);

65var import_child_process2 = require("child_process");

67// helpers.ts

68var import_child_process = require("child_process");

69var import_cross_spawn = __toESM(require("cross-spawn"), 1);

70var import_picocolors = __toESM(require("picocolors"), 1);

71var import_semver = __toESM(require("semver"), 1);

72var import_dns = __toESM(require("dns"), 1);

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.cjsView on unpkg

dist/index.jsView file

Lines 1-32javascript

1var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {

2 get: (a, b) =>