registry / @creator-notes/cnotes / 0.23.5

@creator-notes/cnotes@0.23.5

CLI for CreatorNotes — create notes, build canvases, search knowledge from the terminal

Static Scan Results

scanned 10d ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 47 file(s), 385 KB of source, external domains: ai.google.dev, creatornotes.app, generativelanguage.googleapis.com, nodejs.org

Source & flagged code

4 flagged

dist/commands/init.jsView file

Lines 1-21javascript

1import { confirm, select } from "@inquirer/prompts";

2import { spawnSync } from "child_process";

3import { loadConfig, getServerConfig, setWorkspaceId, } from "../lib/auth-store.js";

High

Child Process

Package source references child process execution.

dist/commands/init.jsView on unpkg · L1

4import { ApiClient } from "../lib/api-client.js";

5import { handleError } from "../lib/errors.js";

6import { browserLogin } from "./auth.js";

7import { fetchAndSelectWorkspace } from "./workspace.js";

8import { buildClaudeConfig } from "./mcp.js";

9import { bold, dim, green, cyan, CHECK, ARROW, WARN } from "../lib/style.js";

10import { installMcpConfig, getConfigPath } from "../lib/install-mcp.js";

11import { hasAgentConfigDir, installSkill, getSkillDestPath, skillTargetLabel, SKILL_TARGETS, } from "../lib/install-skill.js";

12import { installClaudeSessionHook, isClaudeSessionHookInstalled, SESSION_HOOK_COMMAND, SESSION_HOOK_COMMAND_NPX, } from "../lib/install-hook.js";

13function printBanner(version) {

14 const width = 41; // inner width of the box

15 const title = "CreatorNotes CLI";

16 const ver = `v${version}`;

17 const pad = (text) => text + " ".repeat(Math.max(0, width - 3 - text.length));

18 console.log();

19 console.log(" ┌" + "─".repeat(width) + "┐");

20 console.log(" │" + " ".repeat(width) + "│");

21 console.log(` │ ${bold(pad(title))}│`);

Lines 65-112javascript

65 * Best-effort — defaults to false (assume globally installed) when uncertain.

66 */

67function isRunningUnderDlx() {

68 if (process.env.npm_command === "exec")

69 return true;

70 const argv1 = process.argv[1] ||

dist/cn.jsView file

Lines 1-23javascript

1#!/usr/bin/env node

2import { createRequire } from "node:module";

3import { Command } from "commander";

4const require = createRequire(import.meta.url);

5const pkg = require(

Source & flagged code

4 flagged · loading source

dist/commands/init.jsView file

1import { confirm, select } from "@inquirer/prompts"; L2: import { spawnSync } from "child_process"; L3: import { loadConfig, getServerConfig, setWorkspaceId, } from "../lib/auth-store.js";

High

Child Process

Package source references child process execution.

dist/commands/init.jsView on unpkg · L1

92function installGlobally() { L93: // `shell: true` is required on Windows so npm.cmd resolves correctly. L94: const result = spawnSync("npm", ["install", "-g", "@creator-notes/cnotes"], {

High

Shell

Package source references shell execution.

dist/commands/init.jsView on unpkg · L92

85* Best-effort command prefix for copy-pasteable hints. L86: * Returns "cnotes" when globally installed, otherwise the full npx form — L87: * `npx cnotes` does NOT resolve (the published package is @creator-notes/cnotes). ... L92: function installGlobally() { L93: // `shell: true` is required on Windows so npm.cmd resolves correctly. L94: const result = spawnSync("npm", ["install", "-g", "@creator-notes/cnotes"], {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/commands/init.jsView on unpkg · L85

dist/cn.jsView file

3import { Command } from "commander"; L4: const require = createRequire(import.meta.url); L5: const pkg = require("../package.json");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/cn.jsView on unpkg · L3

Findings

3 High4 Medium5 Low

HighChild Processdist/commands/init.js

HighShelldist/commands/init.js

HighRuntime Package Installdist/commands/init.js

MediumDynamic Requiredist/cn.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

dist/commands/init.jsView file

Lines 1-21javascript

1import { confirm, select } from "@inquirer/prompts";

2import { spawnSync } from "child_process";

3import { loadConfig, getServerConfig, setWorkspaceId, } from "../lib/auth-store.js";

High

Child Process

Package source references child process execution.

dist/commands/init.jsView on unpkg · L1

4import { ApiClient } from "../lib/api-client.js";

5import { handleError } from "../lib/errors.js";

6import { browserLogin } from "./auth.js";

7import { fetchAndSelectWorkspace } from "./workspace.js";

8import { buildClaudeConfig } from "./mcp.js";

9import { bold, dim, green, cyan, CHECK, ARROW, WARN } from "../lib/style.js";

10import { installMcpConfig, getConfigPath } from "../lib/install-mcp.js";

11import { hasAgentConfigDir, installSkill, getSkillDestPath, skillTargetLabel, SKILL_TARGETS, } from "../lib/install-skill.js";

12import { installClaudeSessionHook, isClaudeSessionHookInstalled, SESSION_HOOK_COMMAND, SESSION_HOOK_COMMAND_NPX, } from "../lib/install-hook.js";

13function printBanner(version) {

14 const width = 41; // inner width of the box

15 const title = "CreatorNotes CLI";

16 const ver = `v${version}`;

17 const pad = (text) => text + " ".repeat(Math.max(0, width - 3 - text.length));

18 console.log();

19 console.log(" ┌" + "─".repeat(width) + "┐");

20 console.log(" │" + " ".repeat(width) + "│");

21 console.log(` │ ${bold(pad(title))}│`);

Lines 65-112javascript

65 * Best-effort — defaults to false (assume globally installed) when uncertain.

66 */

67function isRunningUnderDlx() {

68 if (process.env.npm_command === "exec")

69 return true;

70 const argv1 = process.argv[1] ||

dist/cn.jsView file

Lines 1-23javascript

1#!/usr/bin/env node

2import { createRequire } from "node:module";

3import { Command } from "commander";

4const require = createRequire(import.meta.url);

5const pkg = require(