registry / @deepstorm/cli / 0.7.2

@deepstorm/cli@0.7.2

DeepStorm CLI — 一键配置项目开发环境

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 8 file(s), 461 KB of source, external domains: github.com, json-schema.org, raw.githubusercontent.com, registry.npmjs.org, repo.spring.io, www.liquibase.org, www.w3.org

Source & flagged code

3 flagged

dist/cli.jsView file

Lines 7155-7195javascript

7155 console.log(" \u251C\u2500\u2500 build.gradle.kts");

7156 console.log(" \u251C\u2500\u2500 angular.json");

7157 console.log(" \u2514\u2500\u2500 package.json");

7158 } else if (hasFrontend) {

7159 console.log(" \u251C\u2500\u2500 src/main/web/ # Angular \u524D\u7AEF");

7160 console.log(" \u251C\u2500\u2500 angular.json");

7161 console.log(" \u2514\u2500\u2500 package.json");

7162 } else if (hasBackend) {

7163 console.log(" \u251C\u2500\u2500 src/");

7164 console.log(" \u2502 \u251C\u2500\u2500 main/java/");

7165 console.log(" \u2502 \u251C\u2500\u2500 main/resources/");

7166 console.log(" \u2502 \u251C\u2500\u2500 test/java/");

7167 console.log(" \u2502 \u2514\u2500\u2500 test/resources/");

7168 console.log(" \u251C\u2500\u2500 build.gradle.kts");

7169 console.log(" \u2514\u2500\u2500 settings.gradle.kts");

7170 }

7171}

7172

7173// src/utils/auto-install.ts

7174var fs3 = __toESM(require("node:fs"));

7175var path3 = __toESM(require("node:path"));

7176var import_node_child_process = require("node:child_process");

7177var EXEC_OPTIONS = { encoding: "utf-8", timeout: 12e4, stdio: "pipe" };

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L7175

7178function execSafe(command) {

7179 try {

7180 const output = (0, import_node_child_process.execSync)(command, EXEC_OPTIONS);

7181 return { success: true, output: output.toString() };

7182 } catch (error) {

7183 const message = error instanceof Error ? error.message : String(error);

7184 return { success: false, output: message };

7185 }

7186}

7187function isBmadInstalled() {

7188 const result = execSafe("npx bmad-method status");

7189 return result.success && result.output.includes("Version:");

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli.jsView on unpkg · L7175

7190}

7191function isGrillMeInstalled(targetDir) {

7192 return fs3.existsSync(path3.join(targetDir, ".claude", "skills", "grill-me", "SKILL.md"));

7193}

7194function installBmadMethod() {

7195 if (isBmadInstalled()) {

dist/hooks/reef-scope-check.shView file

•path = dist/hooks/reef-scope-check.sh kind = build_helper sizeBytes = 12007 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/hooks/reef-scope-check.shView on unpkg

Source & flagged code

3 flagged · loading source

dist/cli.jsView file

7175var path3 = __toESM(require("node:path")); L7176: var import_node_child_process = require("node:child_process"); L7177: var EXEC_OPTIONS = { encoding: "utf-8", timeout: 12e4, stdio: "pipe" };

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L7175

7175var path3 = __toESM(require("node:path")); L7176: var import_node_child_process = require("node:child_process"); L7177: var EXEC_OPTIONS = { encoding: "utf-8", timeout: 12e4, stdio: "pipe" }; ... L7187: function isBmadInstalled() { L7188: const result = execSafe("npx bmad-method status"); L7189: return result.success && result.output.includes("Version:");

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli.jsView on unpkg · L7175

dist/hooks/reef-scope-check.shView file

•path = dist/hooks/reef-scope-check.sh kind = build_helper sizeBytes = 12007 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/hooks/reef-scope-check.shView on unpkg

Findings

3 High3 Medium4 Low

HighChild Processdist/cli.js

HighShell

HighRuntime Package Installdist/cli.js

MediumEnvironment Vars

MediumShips Build Helperdist/hooks/reef-scope-check.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

dist/cli.jsView file

Lines 7155-7195javascript

7155 console.log(" \u251C\u2500\u2500 build.gradle.kts");

7156 console.log(" \u251C\u2500\u2500 angular.json");

7157 console.log(" \u2514\u2500\u2500 package.json");

7158 } else if (hasFrontend) {

7159 console.log(" \u251C\u2500\u2500 src/main/web/ # Angular \u524D\u7AEF");

7160 console.log(" \u251C\u2500\u2500 angular.json");

7161 console.log(" \u2514\u2500\u2500 package.json");

7162 } else if (hasBackend) {

7163 console.log(" \u251C\u2500\u2500 src/");

7164 console.log(" \u2502 \u251C\u2500\u2500 main/java/");

7165 console.log(" \u2502 \u251C\u2500\u2500 main/resources/");

7166 console.log(" \u2502 \u251C\u2500\u2500 test/java/");

7167 console.log(" \u2502 \u2514\u2500\u2500 test/resources/");

7168 console.log(" \u251C\u2500\u2500 build.gradle.kts");

7169 console.log(" \u2514\u2500\u2500 settings.gradle.kts");

7170 }

7171}

7172

7173// src/utils/auto-install.ts

7174var fs3 = __toESM(require("node:fs"));

7175var path3 = __toESM(require("node:path"));

7176var import_node_child_process = require("node:child_process");

7177var EXEC_OPTIONS = { encoding: "utf-8", timeout: 12e4, stdio: "pipe" };

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L7175

7178function execSafe(command) {

7179 try {

7180 const output = (0, import_node_child_process.execSync)(command, EXEC_OPTIONS);

7181 return { success: true, output: output.toString() };

7182 } catch (error) {

7183 const message = error instanceof Error ? error.message : String(error);

7184 return { success: false, output: message };

7185 }

7186}

7187function isBmadInstalled() {

7188 const result = execSafe("npx bmad-method status");

7189 return result.success && result.output.includes("Version:");

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli.jsView on unpkg · L7175

7190}

7191function isGrillMeInstalled(targetDir) {

7192 return fs3.existsSync(path3.join(targetDir, ".claude", "skills", "grill-me", "SKILL.md"));

7193}

7194function installBmadMethod() {

7195 if (isBmadInstalled()) {

dist/hooks/reef-scope-check.shView file

•path = dist/hooks/reef-scope-check.sh kind = build_helper sizeBytes = 12007 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/hooks/reef-scope-check.shView on unpkg