registry / @cwe-platform/plugin-cli / 0.1.1

@cwe-platform/plugin-cli@0.1.1

CasinoWebEngine plugin developer CLI — build, validate and hot-reload plugins against a dev runtime.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 12.3 KB of source

Source & flagged code

4 flagged

bin/cwe-plugin.mjsView file

Lines 38-98javascript

38 if (str.includes(question)) write(str);

39 else write("*");

40 };

41 }

42 rl.question(question, (answer) => {

43 rl.close();

44 if (hidden) process.stdout.write("\n");

45 resolvePrompt(answer.trim());

46 });

47 });

48}

50program

51 .command("login")

52 .description("staff login against the dev runtime; saves devToken into cwe-plugin.json")

53 .option("--email <email>", "staff email (prompted if omitted)")

54 .option("--password <password>", "staff password (prompted if omitted — prefer the prompt: flags land in shell history)")

55 .action(async (opts) => {

56 const config = await loadConfig();

57 const email = opts.email ?? (await prompt("staff email: "));

58 const password = opts.password ?? (await prompt("staff password: ", { hidden: true }));

Medium

Secret Pattern

Package contains a possible secret pattern.

bin/cwe-plugin.mjsView on unpkg · L58

59 const token = await staffLogin(config.runtimeUrl, email, password);

60 const path = await saveDevToken(token);

61 console.log(` ✓ logged in — devToken saved to ${path}`);

62 console.log(

63 " ℹ staff tokens are short-lived (default 15 min). For long `dev` sessions, export",

64 );

65 console.log(

66 " CWE_STAFF_EMAIL / CWE_STAFF_PASSWORD and the watcher re-logs-in on 401 automatically.",

67 );

68 });

70async function validateLocal() {

71 // Import the built bundle + the SDK's doctor-lite from the PLUGIN's own

72 // node_modules (the CLI has no SDK dependency of its own — no dual copies).

73 const config = await loadConfig();

74 const bundleUrl = pathToFileURL(resolve(process.cwd(), config.bundle)).href;

75 const testingUrl = pathToFileURL(

76 resolve(process.cwd(), "node_modules/@cwe-platform/plugin-sdk/dist/testing.js"),

77 ).href;

78 const [{ default: plugin }, { validateManifest }] = await Promise.all([

79 import(`${bundleUrl}?t=${Date.now()}`),

80 import(testingUrl),

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/cwe-plugin.mjsView on unpkg · L78

81 ]);

82 const result = validateManifest(plugin);

83 for (const warning of result.warnings) console.warn(` ⚠ ${warning}`);

84 for (const error of result.errors) console.error(` ✗ ${error}`);

85 if (!result.ok) throw new Error("local manifest validation failed");

86 console.log(" ✓ manifest valid (doctor-lite)");

87}

89program

90 .command("build")

91 .description("tsup build + local validateManifest")

92 .action(async () => {

93 await runBuild();

94 await validateLocal();

95 });

97program

98 .command("validate")

src/lib.mjsView file

Lines 1-57javascript

1/**

2 * @cwe-platform/plugin-cli internals. Deliberately thin: build = the plugin's

3 * own tsup, validate/dev = HTTP against the dev runtime's harness endpoints.

4 * Plain ESM JS — the CLI ships source, no build step of its own.

5 */

6import { createHash } from "node:crypto";

7import { readFile, writeFile } from "node:fs/promises";

8import { spawn } from "node:child_process";

Source & flagged code

4 flagged · loading source

bin/cwe-plugin.mjsView file

58patternName = generic_password severity = medium line = 58 matchedText = const pa...}));

Medium

Secret Pattern

Package contains a possible secret pattern.

bin/cwe-plugin.mjsView on unpkg · L58

78const [{ default: plugin }, { validateManifest }] = await Promise.all([ L79: import(`${bundleUrl}?t=${Date.now()}`), L80: import(testingUrl),

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/cwe-plugin.mjsView on unpkg · L78

src/lib.mjsView file

7import { readFile, writeFile } from "node:fs/promises"; L8: import { spawn } from "node:child_process"; L9: import { join, resolve } from "node:path";

High

Child Process

Package source references child process execution.

src/lib.mjsView on unpkg · L7

37return new Promise((resolvePromise, reject) => { L38: const child = spawn("npx", ["tsup"], { cwd, stdio: "inherit", shell: process.platform === "win32" }); L39: child.on("exit", (code) => {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/lib.mjsView on unpkg · L37

Findings

3 High5 Medium3 Low

HighChild Processsrc/lib.mjs

HighShell

HighRuntime Package Installsrc/lib.mjs

MediumSecret Patternbin/cwe-plugin.mjs

MediumDynamic Requirebin/cwe-plugin.mjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

Source & flagged code

4 flagged

bin/cwe-plugin.mjsView file

Lines 38-98javascript

38 if (str.includes(question)) write(str);

39 else write("*");

40 };

41 }

42 rl.question(question, (answer) => {

43 rl.close();

44 if (hidden) process.stdout.write("\n");

45 resolvePrompt(answer.trim());

46 });

47 });

48}

50program

51 .command("login")

52 .description("staff login against the dev runtime; saves devToken into cwe-plugin.json")

53 .option("--email <email>", "staff email (prompted if omitted)")

54 .option("--password <password>", "staff password (prompted if omitted — prefer the prompt: flags land in shell history)")

55 .action(async (opts) => {

56 const config = await loadConfig();

57 const email = opts.email ?? (await prompt("staff email: "));

58 const password = opts.password ?? (await prompt("staff password: ", { hidden: true }));

Medium

Secret Pattern

Package contains a possible secret pattern.

bin/cwe-plugin.mjsView on unpkg · L58

59 const token = await staffLogin(config.runtimeUrl, email, password);

60 const path = await saveDevToken(token);

61 console.log(` ✓ logged in — devToken saved to ${path}`);

62 console.log(

63 " ℹ staff tokens are short-lived (default 15 min). For long `dev` sessions, export",

64 );

65 console.log(

66 " CWE_STAFF_EMAIL / CWE_STAFF_PASSWORD and the watcher re-logs-in on 401 automatically.",

67 );

68 });

70async function validateLocal() {

71 // Import the built bundle + the SDK's doctor-lite from the PLUGIN's own

72 // node_modules (the CLI has no SDK dependency of its own — no dual copies).

73 const config = await loadConfig();

74 const bundleUrl = pathToFileURL(resolve(process.cwd(), config.bundle)).href;

75 const testingUrl = pathToFileURL(

76 resolve(process.cwd(), "node_modules/@cwe-platform/plugin-sdk/dist/testing.js"),

77 ).href;

78 const [{ default: plugin }, { validateManifest }] = await Promise.all([

79 import(`${bundleUrl}?t=${Date.now()}`),

80 import(testingUrl),

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/cwe-plugin.mjsView on unpkg · L78

81 ]);

82 const result = validateManifest(plugin);

83 for (const warning of result.warnings) console.warn(` ⚠ ${warning}`);

84 for (const error of result.errors) console.error(` ✗ ${error}`);

85 if (!result.ok) throw new Error("local manifest validation failed");

86 console.log(" ✓ manifest valid (doctor-lite)");

87}

89program

90 .command("build")

91 .description("tsup build + local validateManifest")

92 .action(async () => {

93 await runBuild();

94 await validateLocal();

95 });

97program

98 .command("validate")

src/lib.mjsView file

Lines 1-57javascript

1/**

2 * @cwe-platform/plugin-cli internals. Deliberately thin: build = the plugin's

3 * own tsup, validate/dev = HTTP against the dev runtime's harness endpoints.

4 * Plain ESM JS — the CLI ships source, no build step of its own.

5 */

6import { createHash } from "node:crypto";

7import { readFile, writeFile } from "node:fs/promises";

8import { spawn } from "node:child_process";