registry / @decocms/blocks-cli / 7.81.3
@decocms/blocks-cli@7.81.3
⚠ Under reviewDeco codegen (generate-blocks, generate-schema, generate-invoke) and Fresh-to-TanStack migration tooling
Static Scan Results
scanned 1d ago · by rust-scannerStatic analysis completed at 97.0% confidence. No malicious behavior was detected; 21 low-signal pattern(s) were surfaced and cleared.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
12 flagged · loading sourcescripts/generate-workspaces.test.tsView file
1// @vitest-environment node
L2: import { spawnSync } from "node:child_process";
L3: import fs from "node:fs";
High
Child Process
Package source references child process execution.
scripts/generate-workspaces.test.tsView on unpkg · L1scripts/migrate.ts#virtual:normalized:round1View file
94// Skipped in dry-run, when --no-compile is passed, or when bootstrap
L95: // didn"t install dependencies (handled inside `compile`).\n if (!opts.noCompile) {\n const compileResult = compile(ctx, {\n strict: opts.strict,\n withBuild:...
L96: * (`deco-kv-<site>` — never shared, since `index:live` is one key per namespace
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
scripts/migrate.ts#virtual:normalized:round1View on unpkg · L94Findings
13 High3 Medium5 Low
HighChild Processscripts/generate-workspaces.test.ts
HighShell
HighSame File Env Network Executionscripts/migrate.ts#virtual:normalized:round1
HighRuntime Package Installscripts/generate-invoke.test.ts
HighSemantic Analysis Limitedscripts/audit-observability-config.ts#virtual:normalized:round1
HighKnown Malware Source Similarityscripts/deco-migrate-cli.ts
HighKnown Malware Source Similarityscripts/audit-observability-config.test.ts
HighKnown Malware Source Similarityscripts/audit-secrets.ts
HighKnown Malware Source Similarityscripts/migrate/phase-analyze.ts
HighKnown Malware Source Similarityscripts/migrate/phase-cleanup.ts
High
Affected versions and remediation
This report applies to @decocms/blocks-cli@7.81.3.
See all versions of @decocms/blocks-cli for other recorded verdicts.
- Review the evidence and your use of @decocms/blocks-cli@7.81.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.