registry / @deepstorm/cli / 0.6.2

@deepstorm/cli@0.6.2

DeepStorm CLI — 一键配置项目开发环境

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 8 file(s), 443 KB of source, external domains: json-schema.org, registry.npmjs.org, repo.spring.io, www.liquibase.org, www.w3.org

Source & flagged code

3 flagged

dist/cli.jsView file

Lines 8912-8952javascript

8912 templateCmd.command("init [tool] [capability]").description("\u5BFC\u51FA\u9ED8\u8BA4\u6A21\u677F\u5230 .deepstorm/templates/").action(async (tool, capability) => {

8913 if (!tool) {

8914 console.log("\u8BF7\u6307\u5B9A\u5DE5\u5177\u540D\u79F0\uFF1Adeepstorm template init <tool> [capability]");

8915 return;

8916 }

8917 const skillId = capability ? `${tool}-${capability}` : tool;

8918 await initTemplate(cliDir2, process.cwd(), skillId);

8919 });

8920 templateCmd.command("apply [tool] [capability]").description("\u5E94\u7528\u6A21\u677F\u5230 .claude/skills/").action((tool, capability) => {

8921 if (!tool) {

8922 console.log("\u8BF7\u6307\u5B9A\u5DE5\u5177\u540D\u79F0\uFF1Adeepstorm template apply <tool> [capability]");

8923 return;

8924 }

8925 const skillId = capability ? `${tool}-${capability}` : tool;

8926 applyTemplate(process.cwd(), skillId);

8927 });

8928}

8929

8930// src/commands/update.ts

8931var fs22 = __toESM(require("node:fs"));

8932var path20 = __toESM(require("node:path"));

8933var import_node_child_process = require("node:child_process");

8934

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L8932

8935// src/utils/version.ts

8936var fs20 = __toESM(require("node:fs"));

8937var path18 = __toESM(require("node:path"));

8938function getCliVersion() {

8939 try {

8940 const paths = [

8941 path18.resolve(__dirname, "package.json"),

8942 path18.resolve(__dirname, "..", "package.json")

8943 ];

8944 for (const pkgPath of paths) {

8945 if (fs20.existsSync(pkgPath)) {

8946 const pkg = JSON.parse(fs20.readFileSync(pkgPath, "utf-8"));

8947 return pkg.version || "0.0.0";

8948 }

8949 }

8950 return "0.0.0";

8951 } catch {

8952 return "0.0.0";

Lines 9327-9367javascript

9327 };

9328 }

9329 const isUpToDate = current === latest;

9330 const hasUpdate = !isUpToDate && latest !== null;

9331 return {

9332 current,

9333 latest,

9334

dist/hooks/reef-scope-check.shView file

•path = dist/hooks/reef-scope-check.sh kind = build_helper sizeBytes = 12007 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/hooks/reef-scope-check.shView on unpkg

Source & flagged code

3 flagged · loading source

dist/cli.jsView file

8932var path20 = __toESM(require("node:path")); L8933: var import_node_child_process = require("node:child_process"); L8934:

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L8932

9347console.log("\u2192 \u6B63\u5728\u81EA\u52A8\u66F4\u65B0..."); L9348: const updateCmd = process.env.DEEPSTORM_UPDATE_CMD || "npm install -g @deepstorm/cli@latest"; L9349: try { L9350: (0, import_node_child_process.execSync)(updateCmd, { stdio: "inherit" }); L9351: console.log(`

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli.jsView on unpkg · L9347

dist/hooks/reef-scope-check.shView file

•path = dist/hooks/reef-scope-check.sh kind = build_helper sizeBytes = 12007 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/hooks/reef-scope-check.shView on unpkg

Findings

3 High3 Medium5 Low

HighChild Processdist/cli.js

HighShell

HighRuntime Package Installdist/cli.js

MediumEnvironment Vars

MediumShips Build Helperdist/hooks/reef-scope-check.sh

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

dist/cli.jsView file

Lines 8912-8952javascript

8912 templateCmd.command("init [tool] [capability]").description("\u5BFC\u51FA\u9ED8\u8BA4\u6A21\u677F\u5230 .deepstorm/templates/").action(async (tool, capability) => {

8913 if (!tool) {

8914 console.log("\u8BF7\u6307\u5B9A\u5DE5\u5177\u540D\u79F0\uFF1Adeepstorm template init <tool> [capability]");

8915 return;

8916 }

8917 const skillId = capability ? `${tool}-${capability}` : tool;

8918 await initTemplate(cliDir2, process.cwd(), skillId);

8919 });

8920 templateCmd.command("apply [tool] [capability]").description("\u5E94\u7528\u6A21\u677F\u5230 .claude/skills/").action((tool, capability) => {

8921 if (!tool) {

8922 console.log("\u8BF7\u6307\u5B9A\u5DE5\u5177\u540D\u79F0\uFF1Adeepstorm template apply <tool> [capability]");

8923 return;

8924 }

8925 const skillId = capability ? `${tool}-${capability}` : tool;

8926 applyTemplate(process.cwd(), skillId);

8927 });

8928}

8929

8930// src/commands/update.ts

8931var fs22 = __toESM(require("node:fs"));

8932var path20 = __toESM(require("node:path"));

8933var import_node_child_process = require("node:child_process");

8934

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L8932

8935// src/utils/version.ts

8936var fs20 = __toESM(require("node:fs"));

8937var path18 = __toESM(require("node:path"));

8938function getCliVersion() {

8939 try {

8940 const paths = [

8941 path18.resolve(__dirname, "package.json"),

8942 path18.resolve(__dirname, "..", "package.json")

8943 ];

8944 for (const pkgPath of paths) {

8945 if (fs20.existsSync(pkgPath)) {

8946 const pkg = JSON.parse(fs20.readFileSync(pkgPath, "utf-8"));

8947 return pkg.version || "0.0.0";

8948 }

8949 }

8950 return "0.0.0";

8951 } catch {

8952 return "0.0.0";

Lines 9327-9367javascript

9327 };

9328 }

9329 const isUpToDate = current === latest;

9330 const hasUpdate = !isUpToDate && latest !== null;

9331 return {

9332 current,

9333 latest,

9334

dist/hooks/reef-scope-check.shView file

•path = dist/hooks/reef-scope-check.sh kind = build_helper sizeBytes = 12007 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/hooks/reef-scope-check.shView on unpkg