registry / @create-node-app/core / 0.6.2

@create-node-app/core@0.6.2

Static Scan Results

scanned 4d ago · by rust-scanner

Static analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

UrlStrings

Manifest

WildcardDependency

scanned 2 file(s), 82.2 KB of source, external domains: blogs.msdn.microsoft.com, bun.sh, github.com, pnpm.js.org, registry.npmjs.org, registry.yarnpkg.com, yarnpkg.com

Source & flagged code

2 flagged

dist/index.cjsView file

Lines 23-63javascript

23 // compatible transform (i.e. "__esModule" has not been set), then set

24 // "default" to the CommonJS "module.exports" for node compatibility.

25 isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,

26 mod

27));

28var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);

30// index.ts

31var index_exports = {};

32__export(index_exports, {

33 checkForLatestVersion: () => checkForLatestVersion,

34 checkNodeVersion: () => checkNodeVersion,

35 createNodeApp: () => createNodeApp,

36 downloadRepository: () => downloadRepository,

37 getPackagePath: () => getPackagePath,

38 getTemplateBaseDirPath: () => getTemplateBaseDirPath,

39 getTemplateDirPath: () => getTemplateDirPath,

40 loadTemplateCnaConfig: () => loadTemplateCnaConfig,

41 printEnvInfo: () => printEnvInfo

42});

43module.exports = __toCommonJS(index_exports);

44var import_picocolors4 = __toESM(require("picocolors"), 1);

45var import_envinfo = __toESM(require("envinfo"), 1);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.cjsView on unpkg · L43

46var import_semver3 = __toESM(require("semver"), 1);

47var import_child_process3 = require("child_process");

49// installer.ts

50var import_lodash3 = __toESM(require("lodash"), 1);

51var import_path4 = __toESM(require("path"), 1);

52var import_fs5 = __toESM(require("fs"), 1);

53var import_picocolors3 = __toESM(require("picocolors"), 1);

54var import_os3 = __toESM(require("os"), 1);

55var import_semver2 = __toESM(require("semver"), 1);

56var import_child_process2 = require("child_process");

58// helpers.ts

59var import_child_process = require("child_process");

60var import_cross_spawn = __toESM(require("cross-spawn"), 1);

61var import_picocolors = __toESM(require("picocolors"), 1);

62var import_semver = __toESM(require("semver"), 1);

63var import_dns = __toESM(require("dns"), 1);

dist/index.jsView file

Lines 1-32javascript

1var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {

2 get: (a, b) =>

Source & flagged code

2 flagged · loading source

dist/index.cjsView file

43module.exports = __toCommonJS(index_exports); L44: var import_picocolors4 = __toESM(require("picocolors"), 1); L45: var import_envinfo = __toESM(require("envinfo"), 1);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.cjsView on unpkg · L43

dist/index.jsView file

12var getDirname = () => path.dirname(getFilename()); L13: var __dirname = /* @__PURE__ */ getDirname(); L14: ... L18: import semver3 from "semver"; L19: import { execFileSync as execFileSync3 } from "child_process"; L20: ... L34: import semver from "semver"; L35: import dns from "dns"; L36: import { URL as URL2 } from "url"; ... L38: // executable.ts L39: var resolveExecutable = (bin) => process.platform === "win32" ? `${bin}.cmd` : bin; L40:

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L12

Findings

1 High5 Medium3 Low

HighSandbox Evasion Gated Capabilitydist/index.js

MediumDynamic Requiredist/index.cjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumWildcard Dependency

LowScripts Present

LowFilesystem

LowUrl Strings

Source & flagged code

2 flagged

dist/index.cjsView file

Lines 23-63javascript

23 // compatible transform (i.e. "__esModule" has not been set), then set

24 // "default" to the CommonJS "module.exports" for node compatibility.

25 isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,

26 mod

27));

28var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);

30// index.ts

31var index_exports = {};

32__export(index_exports, {

33 checkForLatestVersion: () => checkForLatestVersion,

34 checkNodeVersion: () => checkNodeVersion,

35 createNodeApp: () => createNodeApp,

36 downloadRepository: () => downloadRepository,

37 getPackagePath: () => getPackagePath,

38 getTemplateBaseDirPath: () => getTemplateBaseDirPath,

39 getTemplateDirPath: () => getTemplateDirPath,

40 loadTemplateCnaConfig: () => loadTemplateCnaConfig,

41 printEnvInfo: () => printEnvInfo

42});

43module.exports = __toCommonJS(index_exports);

44var import_picocolors4 = __toESM(require("picocolors"), 1);

45var import_envinfo = __toESM(require("envinfo"), 1);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.cjsView on unpkg · L43

46var import_semver3 = __toESM(require("semver"), 1);

47var import_child_process3 = require("child_process");

49// installer.ts

50var import_lodash3 = __toESM(require("lodash"), 1);

51var import_path4 = __toESM(require("path"), 1);

52var import_fs5 = __toESM(require("fs"), 1);

53var import_picocolors3 = __toESM(require("picocolors"), 1);

54var import_os3 = __toESM(require("os"), 1);

55var import_semver2 = __toESM(require("semver"), 1);

56var import_child_process2 = require("child_process");

58// helpers.ts

59var import_child_process = require("child_process");

60var import_cross_spawn = __toESM(require("cross-spawn"), 1);

61var import_picocolors = __toESM(require("picocolors"), 1);

62var import_semver = __toESM(require("semver"), 1);

63var import_dns = __toESM(require("dns"), 1);

dist/index.jsView file

Lines 1-32javascript

1var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {

2 get: (a, b) =>