registry / @decocms/tanstack / 7.6.0

@decocms/tanstack@7.6.0

Deco framework binding for TanStack Start + Cloudflare Workers

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 37 file(s), 275 KB of source, external domains: admin.deco.cx, api.example.com, deco.cx, example.com, o.com

Source & flagged code

3 flagged

src/vite/plugin.jsView file

Lines 13-53javascript

13 * file, and this plugin intercepts the .ts import to return JSON.parse(...)

14 * — V8's JSON parser is 2-10x faster than the JS parser for large data.

15 *

16 * meta.gen handling:

17 * The admin schema bundle (`.deco/meta.gen.json`) is server-only;

18 * the client receives pre-resolved blocks via the SSR payload. Stubbing

19 * it on the client cuts a typically-large module out of the browser bundle.

20 * Match is done by substring on the import id, so any path style works.

21 *

22 * manualChunks:

23 * `@decocms/tanstack` and `@decocms/apps` are intentionally NOT split

24 * into their own chunks. They have circular re-exports that produce a

25 * load-order crash when chunked separately. Rollup's default bundling

26 * (group with importer or vendor catch-all) avoids that.

27 *

28 * Usage:

29 * ```ts

30 * import { decoVitePlugin } from "@decocms/tanstack/vite";

31 * export default defineConfig({ plugins: [decoVitePlugin(), ...] });

32 * ```

33 */

34import { exec, execFileSync } from "node:child_process";

35import { existsSync, readFileSync, writeFileSync } from "node:fs";

High

Child Process

Package source references child process execution.

src/vite/plugin.jsView on unpkg · L33

36import path from "node:path";

38/**

39 * Resolve a per-build identifier for cache-key versioning.

40 *

41 * The returned string is injected into the worker bundle as the

42 * `__DECO_BUILD_HASH__` global via Vite `define`. `createDecoWorkerEntry`

43 * appends it (or `env.BUILD_HASH` if explicitly set) as `__v=<hash>` on

44 * every Cache API key, so each new deploy gets its own cache namespace

45 * — old edge-cached HTML referencing dead asset filenames stops being

46 * served the moment the new worker is live.

47 *

48 * Resolution order:

49 * 1. WORKERS_CI_COMMIT_SHA — Cloudflare Workers Builds default env var

50 * (the production deploy path-of-record). Sliced to 12 chars.

51 * 2. `git rev-parse --short=12 HEAD` — local `wrangler deploy` from a

52 * developer laptop. Try/catch so missing git or shallow clones don't

53 * fail the build.

Lines 399-439javascript

399

400 // Resolve the site name once from vite define or env.

401 const definedSite = server.config.define?.["process.env.DECO_SITE_NAME"];

402 const schemaSiteName = definedSite

403 ? JSON.parse(definedSite)

404 : process.env.DECO_SITE_NAME || "storefront";

src/sdk/workerEntry.tsView file

Lines 452-492typescript

452 * existing WAF allowlist during migration).

453 * - Pass `false` to leave `globalThis.fetch` untouched.

454 *

455 * @default `Deco/<version> (+https://deco.cx)` — see DECO_USER_AGENT.

456 */

457 outboundUserAgent?: string

Source & flagged code

3 flagged · loading source

src/vite/plugin.jsView file

33*/ L34: import { exec, execFileSync } from "node:child_process"; L35: import { existsSync, readFileSync, writeFileSync } from "node:fs";

High

Child Process

Package source references child process execution.

src/vite/plugin.jsView on unpkg · L33

419); L420: const cmd = `npx tsx ${JSON.stringify(scriptPath)} --site ${schemaSiteName}`; L421: exec(cmd, { cwd }, (err) => { L422: schemaInFlight = false;

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/vite/plugin.jsView on unpkg · L419

src/sdk/workerEntry.tsView file

472if (data.args && data.args.script) { L473: try { eval(data.args.script); } catch(e) { console.error("[deco] inject error:", e); } L474: }

Low

Eval

Package source references a known benign dynamic code generation pattern.

src/sdk/workerEntry.tsView on unpkg · L472

Findings

3 High3 Medium6 Low

HighChild Processsrc/vite/plugin.js

HighShell

HighRuntime Package Installsrc/vite/plugin.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvalsrc/sdk/workerEntry.ts

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

3 flagged

src/vite/plugin.jsView file

Lines 13-53javascript

13 * file, and this plugin intercepts the .ts import to return JSON.parse(...)

14 * — V8's JSON parser is 2-10x faster than the JS parser for large data.

15 *

16 * meta.gen handling:

17 * The admin schema bundle (`.deco/meta.gen.json`) is server-only;

18 * the client receives pre-resolved blocks via the SSR payload. Stubbing

19 * it on the client cuts a typically-large module out of the browser bundle.

20 * Match is done by substring on the import id, so any path style works.

21 *

22 * manualChunks:

23 * `@decocms/tanstack` and `@decocms/apps` are intentionally NOT split

24 * into their own chunks. They have circular re-exports that produce a

25 * load-order crash when chunked separately. Rollup's default bundling

26 * (group with importer or vendor catch-all) avoids that.

27 *

28 * Usage:

29 * ```ts

30 * import { decoVitePlugin } from "@decocms/tanstack/vite";

31 * export default defineConfig({ plugins: [decoVitePlugin(), ...] });

32 * ```

33 */

34import { exec, execFileSync } from "node:child_process";

35import { existsSync, readFileSync, writeFileSync } from "node:fs";

High

Child Process

Package source references child process execution.

src/vite/plugin.jsView on unpkg · L33

36import path from "node:path";

38/**

39 * Resolve a per-build identifier for cache-key versioning.

40 *

41 * The returned string is injected into the worker bundle as the

42 * `__DECO_BUILD_HASH__` global via Vite `define`. `createDecoWorkerEntry`

43 * appends it (or `env.BUILD_HASH` if explicitly set) as `__v=<hash>` on

44 * every Cache API key, so each new deploy gets its own cache namespace

45 * — old edge-cached HTML referencing dead asset filenames stops being

46 * served the moment the new worker is live.

47 *

48 * Resolution order:

49 * 1. WORKERS_CI_COMMIT_SHA — Cloudflare Workers Builds default env var

50 * (the production deploy path-of-record). Sliced to 12 chars.

51 * 2. `git rev-parse --short=12 HEAD` — local `wrangler deploy` from a

52 * developer laptop. Try/catch so missing git or shallow clones don't

53 * fail the build.

Lines 399-439javascript

399

400 // Resolve the site name once from vite define or env.

401 const definedSite = server.config.define?.["process.env.DECO_SITE_NAME"];

402 const schemaSiteName = definedSite

403 ? JSON.parse(definedSite)

404 : process.env.DECO_SITE_NAME || "storefront";

src/sdk/workerEntry.tsView file

Lines 452-492typescript

452 * existing WAF allowlist during migration).

453 * - Pass `false` to leave `globalThis.fetch` untouched.

454 *

455 * @default `Deco/<version> (+https://deco.cx)` — see DECO_USER_AGENT.

456 */

457 outboundUserAgent?: string