registry / @deepstorm/cli / 0.2.3

@deepstorm/cli@0.2.3

DeepStorm CLI — 一键配置项目开发环境

Static Scan Results

scanned 4h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 8 file(s), 412 KB of source, external domains: json-schema.org, registry.npmjs.org

Source & flagged code

3 flagged

dist/cli.jsView file

Lines 8101-8141javascript

8101 templateCmd.command("init [tool] [capability]").description("\u5BFC\u51FA\u9ED8\u8BA4\u6A21\u677F\u5230 .deepstorm/templates/").action(async (tool, capability) => {

8102 if (!tool) {

8103 console.log("\u8BF7\u6307\u5B9A\u5DE5\u5177\u540D\u79F0\uFF1Adeepstorm template init <tool> [capability]");

8104 return;

8105 }

8106 const skillId = capability ? `${tool}-${capability}` : tool;

8107 await initTemplate(cliDir2, process.cwd(), skillId);

8108 });

8109 templateCmd.command("apply [tool] [capability]").description("\u5E94\u7528\u6A21\u677F\u5230 .claude/skills/").action((tool, capability) => {

8110 if (!tool) {

8111 console.log("\u8BF7\u6307\u5B9A\u5DE5\u5177\u540D\u79F0\uFF1Adeepstorm template apply <tool> [capability]");

8112 return;

8113 }

8114 const skillId = capability ? `${tool}-${capability}` : tool;

8115 applyTemplate(process.cwd(), skillId);

8116 });

8117}

8118

8119// src/commands/update.ts

8120var fs21 = __toESM(require("node:fs"));

8121var path19 = __toESM(require("node:path"));

8122var import_node_child_process = require("node:child_process");

8123

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L8121

8124// src/utils/version.ts

8125var fs19 = __toESM(require("node:fs"));

8126var path17 = __toESM(require("node:path"));

8127function getCliVersion() {

8128 try {

8129 const paths = [

8130 path17.resolve(__dirname, "package.json"),

8131 path17.resolve(__dirname, "..", "package.json")

8132 ];

8133 for (const pkgPath of paths) {

8134 if (fs19.existsSync(pkgPath)) {

8135 const pkg = JSON.parse(fs19.readFileSync(pkgPath, "utf-8"));

8136 return pkg.version || "0.0.0";

8137 }

8138 }

8139 return "0.0.0";

8140 } catch {

8141 return "0.0.0";

Lines 8461-8501javascript

8461 };

8462 } catch (err) {

8463 const message = err instanceof Error ? err.message : String(err);

8464 return {

8465 current,

8466 latest: null,

8467 error: message

8468 };

dist/hooks/reef-scope-check.shView file

•path = dist/hooks/reef-scope-check.sh kind = build_helper sizeBytes = 12007 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/hooks/reef-scope-check.shView on unpkg

Source & flagged code

3 flagged · loading source

dist/cli.jsView file

8121var path19 = __toESM(require("node:path")); L8122: var import_node_child_process = require("node:child_process"); L8123:

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L8121

8481try { L8482: (0, import_node_child_process.execSync)("npm install -g @deepstorm/cli@latest", { stdio: "inherit" }); L8483: console.log(`

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli.jsView on unpkg · L8481

dist/hooks/reef-scope-check.shView file

•path = dist/hooks/reef-scope-check.sh kind = build_helper sizeBytes = 12007 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/hooks/reef-scope-check.shView on unpkg

Findings

3 High3 Medium5 Low

HighChild Processdist/cli.js

HighShell

HighRuntime Package Installdist/cli.js

MediumEnvironment Vars

MediumShips Build Helperdist/hooks/reef-scope-check.sh

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

dist/cli.jsView file

Lines 8101-8141javascript

8101 templateCmd.command("init [tool] [capability]").description("\u5BFC\u51FA\u9ED8\u8BA4\u6A21\u677F\u5230 .deepstorm/templates/").action(async (tool, capability) => {

8102 if (!tool) {

8103 console.log("\u8BF7\u6307\u5B9A\u5DE5\u5177\u540D\u79F0\uFF1Adeepstorm template init <tool> [capability]");

8104 return;

8105 }

8106 const skillId = capability ? `${tool}-${capability}` : tool;

8107 await initTemplate(cliDir2, process.cwd(), skillId);

8108 });

8109 templateCmd.command("apply [tool] [capability]").description("\u5E94\u7528\u6A21\u677F\u5230 .claude/skills/").action((tool, capability) => {

8110 if (!tool) {

8111 console.log("\u8BF7\u6307\u5B9A\u5DE5\u5177\u540D\u79F0\uFF1Adeepstorm template apply <tool> [capability]");

8112 return;

8113 }

8114 const skillId = capability ? `${tool}-${capability}` : tool;

8115 applyTemplate(process.cwd(), skillId);

8116 });

8117}

8118

8119// src/commands/update.ts

8120var fs21 = __toESM(require("node:fs"));

8121var path19 = __toESM(require("node:path"));

8122var import_node_child_process = require("node:child_process");

8123

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L8121

8124// src/utils/version.ts

8125var fs19 = __toESM(require("node:fs"));

8126var path17 = __toESM(require("node:path"));

8127function getCliVersion() {

8128 try {

8129 const paths = [

8130 path17.resolve(__dirname, "package.json"),

8131 path17.resolve(__dirname, "..", "package.json")

8132 ];

8133 for (const pkgPath of paths) {

8134 if (fs19.existsSync(pkgPath)) {

8135 const pkg = JSON.parse(fs19.readFileSync(pkgPath, "utf-8"));

8136 return pkg.version || "0.0.0";

8137 }

8138 }

8139 return "0.0.0";

8140 } catch {

8141 return "0.0.0";

Lines 8461-8501javascript

8461 };

8462 } catch (err) {

8463 const message = err instanceof Error ? err.message : String(err);

8464 return {

8465 current,

8466 latest: null,

8467 error: message

8468 };

dist/hooks/reef-scope-check.shView file

•path = dist/hooks/reef-scope-check.sh kind = build_helper sizeBytes = 12007 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/hooks/reef-scope-check.shView on unpkg