registry / @deepstorm/cli / 0.2.2

@deepstorm/cli@0.2.2

DeepStorm CLI — 一键配置项目开发环境

Static Scan Results

scanned 5h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 8 file(s), 404 KB of source, external domains: json-schema.org, registry.npmjs.org

Source & flagged code

3 flagged

dist/cli.jsView file

Lines 8099-8139javascript

8099 listTemplates(registry2, tool);

8100 });

8101 templateCmd.command("init [tool] [capability]").description("\u5BFC\u51FA\u9ED8\u8BA4\u6A21\u677F\u5230 .deepstorm/templates/").action(async (tool, capability) => {

8102 if (!tool) {

8103 console.log("\u8BF7\u6307\u5B9A\u5DE5\u5177\u540D\u79F0\uFF1Adeepstorm template init <tool> [capability]");

8104 return;

8105 }

8106 const skillId = capability ? `${tool}-${capability}` : tool;

8107 await initTemplate(cliDir2, process.cwd(), skillId);

8108 });

8109 templateCmd.command("apply [tool] [capability]").description("\u5E94\u7528\u6A21\u677F\u5230 .claude/skills/").action((tool, capability) => {

8110 if (!tool) {

8111 console.log("\u8BF7\u6307\u5B9A\u5DE5\u5177\u540D\u79F0\uFF1Adeepstorm template apply <tool> [capability]");

8112 return;

8113 }

8114 const skillId = capability ? `${tool}-${capability}` : tool;

8115 applyTemplate(process.cwd(), skillId);

8116 });

8117}

8118

8119// src/commands/update.ts

8120var import_node_child_process = require("node:child_process");

8121

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L8119

8122// src/utils/version.ts

8123var fs19 = __toESM(require("node:fs"));

8124var path17 = __toESM(require("node:path"));

8125function getCliVersion() {

8126 try {

8127 const paths = [

8128 path17.resolve(__dirname, "package.json"),

8129 path17.resolve(__dirname, "..", "package.json")

8130 ];

8131 for (const pkgPath of paths) {

8132 if (fs19.existsSync(pkgPath)) {

8133 const pkg = JSON.parse(fs19.readFileSync(pkgPath, "utf-8"));

8134 return pkg.version || "0.0.0";

8135 }

8136 }

8137 return "0.0.0";

8138 } catch {

8139 return "0.0.0";

Lines 8198-8238javascript

8198 };

8199 } catch (err) {

8200 const message = err instanceof Error ? err.message : String(err);

8201 return {

8202 current,

8203 latest: null,

8204 error: message

8205 };

dist/hooks/reef-scope-check.shView file

•path = dist/hooks/reef-scope-check.sh kind = build_helper sizeBytes = 12007 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/hooks/reef-scope-check.shView on unpkg

Source & flagged code

3 flagged · loading source

dist/cli.jsView file

8119// src/commands/update.ts L8120: var import_node_child_process = require("node:child_process"); L8121:

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L8119

8218try { L8219: (0, import_node_child_process.execSync)("npm install -g @deepstorm/cli@latest", { stdio: "inherit" }); L8220: console.log(`

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli.jsView on unpkg · L8218

dist/hooks/reef-scope-check.shView file

•path = dist/hooks/reef-scope-check.sh kind = build_helper sizeBytes = 12007 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/hooks/reef-scope-check.shView on unpkg

Findings

3 High3 Medium5 Low

HighChild Processdist/cli.js

HighShell

HighRuntime Package Installdist/cli.js

MediumEnvironment Vars

MediumShips Build Helperdist/hooks/reef-scope-check.sh

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

dist/cli.jsView file

Lines 8099-8139javascript

8099 listTemplates(registry2, tool);

8100 });

8101 templateCmd.command("init [tool] [capability]").description("\u5BFC\u51FA\u9ED8\u8BA4\u6A21\u677F\u5230 .deepstorm/templates/").action(async (tool, capability) => {

8102 if (!tool) {

8103 console.log("\u8BF7\u6307\u5B9A\u5DE5\u5177\u540D\u79F0\uFF1Adeepstorm template init <tool> [capability]");

8104 return;

8105 }

8106 const skillId = capability ? `${tool}-${capability}` : tool;

8107 await initTemplate(cliDir2, process.cwd(), skillId);

8108 });

8109 templateCmd.command("apply [tool] [capability]").description("\u5E94\u7528\u6A21\u677F\u5230 .claude/skills/").action((tool, capability) => {

8110 if (!tool) {

8111 console.log("\u8BF7\u6307\u5B9A\u5DE5\u5177\u540D\u79F0\uFF1Adeepstorm template apply <tool> [capability]");

8112 return;

8113 }

8114 const skillId = capability ? `${tool}-${capability}` : tool;

8115 applyTemplate(process.cwd(), skillId);

8116 });

8117}

8118

8119// src/commands/update.ts

8120var import_node_child_process = require("node:child_process");

8121

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L8119

8122// src/utils/version.ts

8123var fs19 = __toESM(require("node:fs"));

8124var path17 = __toESM(require("node:path"));

8125function getCliVersion() {

8126 try {

8127 const paths = [

8128 path17.resolve(__dirname, "package.json"),

8129 path17.resolve(__dirname, "..", "package.json")

8130 ];

8131 for (const pkgPath of paths) {

8132 if (fs19.existsSync(pkgPath)) {

8133 const pkg = JSON.parse(fs19.readFileSync(pkgPath, "utf-8"));

8134 return pkg.version || "0.0.0";

8135 }

8136 }

8137 return "0.0.0";

8138 } catch {

8139 return "0.0.0";

Lines 8198-8238javascript

8198 };

8199 } catch (err) {

8200 const message = err instanceof Error ? err.message : String(err);

8201 return {

8202 current,

8203 latest: null,

8204 error: message

8205 };

dist/hooks/reef-scope-check.shView file

•path = dist/hooks/reef-scope-check.sh kind = build_helper sizeBytes = 12007 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/hooks/reef-scope-check.shView on unpkg