registry / @cwe-platform/plugin-cli / 0.1.0

@cwe-platform/plugin-cli@0.1.0

CasinoWebEngine plugin developer CLI — build, validate and hot-reload plugins against a dev runtime.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 8 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireFilesystemNetworkShell

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 7.32 KB of source

Source & flagged code

3 flagged

src/lib.mjsView file

Lines 1-55javascript

1/**

2 * @cwe-platform/plugin-cli internals. Deliberately thin: build = the plugin's

3 * own tsup, validate/dev = HTTP against the dev runtime's harness endpoints.

4 * Plain ESM JS — the CLI ships source, no build step of its own.

5 */

6import { createHash } from "node:crypto";

7import { readFile } from "node:fs/promises";

8import { spawn } from "node:child_process";

9import { join, resolve } from "node:path";

High

Child Process

Package source references child process execution.

src/lib.mjsView on unpkg · L7

11/** cwe-plugin.json: { runtimeUrl, devToken, pluginKey, bundle? } */

12export async function loadConfig(cwd = process.cwd()) {

13 const path = join(cwd, "cwe-plugin.json");

14 let raw;

15 try {

16 raw = await readFile(path, "utf8");

17 } catch {

18 throw new Error(

19 `Missing cwe-plugin.json in ${cwd} — create it with { "runtimeUrl": "http://localhost:3000", "pluginKey": "<key>", "devToken": "<staff token>" }`,

20 );

21 }

22 const config = JSON.parse(raw);

23 for (const field of ["runtimeUrl", "pluginKey"]) {

24 if (!config[field]) throw new Error(`cwe-plugin.json is missing '${field}'`);

25 }

26 return {

27 runtimeUrl: String(config.runtimeUrl).replace(/\/$/, ""),

28 pluginKey: config.pluginKey,

29 devToken: config.devToken ?? "",

30 bundle: config.bundle ?? "dist/index.js",

31 };

32}

34export function runBuild(cwd = process.cwd()) {

35 return new Promise((resolvePromise, reject) => {

36 const child = spawn("npx", ["tsup"], { cwd, stdio: "inherit", shell: process.platform === "win32" });

37 child.on("exit", (code) => {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/lib.mjsView on unpkg · L35

38 if (code === 0) resolvePromise(undefined);

39 else reject(new Error(`tsup exited with code ${code}`));

40 });

41 child.on("error", reject);

42 });

43}

45async function api(config, method, path, body) {

46 const response = await fetch(`${config.runtimeUrl}${path}`, {

47 method,

48 headers: {

49 "content-type": "application/json",

50 ...(config.devToken ? { authorization: `Bearer ${config.devToken}` } : {}),

51 },

52 ...(body !== undefined ? { body: JSON.stringify(body) } : {}),

53 });

54 const text = await response.text();

55 let json;

bin/cwe-plugin.mjsView file

Lines 8-48javascript

8 *

9 * Config: cwe-plugin.json (runtimeUrl, pluginKey, devToken, bundle?).

10 */

11import { watch } from "node:fs";

12import { pathToFileURL } from "node:url";

13import { resolve } from "node:path";

14import { Command } from "commander";

Source & flagged code

3 flagged · loading source

src/lib.mjsView file

7import { readFile } from "node:fs/promises"; L8: import { spawn } from "node:child_process"; L9: import { join, resolve } from "node:path";

High

Child Process

Package source references child process execution.

src/lib.mjsView on unpkg · L7

35return new Promise((resolvePromise, reject) => { L36: const child = spawn("npx", ["tsup"], { cwd, stdio: "inherit", shell: process.platform === "win32" }); L37: child.on("exit", (code) => {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/lib.mjsView on unpkg · L35

bin/cwe-plugin.mjsView file

28const [{ default: plugin }, { validateManifest }] = await Promise.all([ L29: import(`${bundleUrl}?t=${Date.now()}`), L30: import(testingUrl),

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/cwe-plugin.mjsView on unpkg · L28

Findings

3 High3 Medium2 Low

HighChild Processsrc/lib.mjs

HighShell

HighRuntime Package Installsrc/lib.mjs

MediumDynamic Requirebin/cwe-plugin.mjs

MediumNetwork

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

Source & flagged code

3 flagged

src/lib.mjsView file

Lines 1-55javascript

1/**

2 * @cwe-platform/plugin-cli internals. Deliberately thin: build = the plugin's

3 * own tsup, validate/dev = HTTP against the dev runtime's harness endpoints.

4 * Plain ESM JS — the CLI ships source, no build step of its own.

5 */

6import { createHash } from "node:crypto";

7import { readFile } from "node:fs/promises";

8import { spawn } from "node:child_process";

9import { join, resolve } from "node:path";

High

Child Process

Package source references child process execution.

src/lib.mjsView on unpkg · L7

11/** cwe-plugin.json: { runtimeUrl, devToken, pluginKey, bundle? } */

12export async function loadConfig(cwd = process.cwd()) {

13 const path = join(cwd, "cwe-plugin.json");

14 let raw;

15 try {

16 raw = await readFile(path, "utf8");

17 } catch {

18 throw new Error(

19 `Missing cwe-plugin.json in ${cwd} — create it with { "runtimeUrl": "http://localhost:3000", "pluginKey": "<key>", "devToken": "<staff token>" }`,

20 );

21 }

22 const config = JSON.parse(raw);

23 for (const field of ["runtimeUrl", "pluginKey"]) {

24 if (!config[field]) throw new Error(`cwe-plugin.json is missing '${field}'`);

25 }

26 return {

27 runtimeUrl: String(config.runtimeUrl).replace(/\/$/, ""),

28 pluginKey: config.pluginKey,

29 devToken: config.devToken ?? "",

30 bundle: config.bundle ?? "dist/index.js",

31 };

32}

34export function runBuild(cwd = process.cwd()) {

35 return new Promise((resolvePromise, reject) => {

36 const child = spawn("npx", ["tsup"], { cwd, stdio: "inherit", shell: process.platform === "win32" });

37 child.on("exit", (code) => {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/lib.mjsView on unpkg · L35

38 if (code === 0) resolvePromise(undefined);

39 else reject(new Error(`tsup exited with code ${code}`));

40 });

41 child.on("error", reject);

42 });

43}

45async function api(config, method, path, body) {

46 const response = await fetch(`${config.runtimeUrl}${path}`, {

47 method,

48 headers: {

49 "content-type": "application/json",

50 ...(config.devToken ? { authorization: `Bearer ${config.devToken}` } : {}),

51 },

52 ...(body !== undefined ? { body: JSON.stringify(body) } : {}),

53 });

54 const text = await response.text();

55 let json;

bin/cwe-plugin.mjsView file

Lines 8-48javascript

8 *

9 * Config: cwe-plugin.json (runtimeUrl, pluginKey, devToken, bundle?).

10 */

11import { watch } from "node:fs";

12import { pathToFileURL } from "node:url";

13import { resolve } from "node:path";

14import { Command } from "commander";