registry  /  @devflow-tools/cli  /  0.12.5

@devflow-tools/cli@0.12.5

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
Supply chain
HighEntropyStrings
Manifest
NoLicense
scanned 33 file(s), 85.5 KB of source

Source & flagged code

2 flagged · loading source
bin/devflow.cjsView file
8L9: var childProcess = require('child_process'); L10: var path = require('path');
High
Child Process

Package source references child process execution.

bin/devflow.cjsView on unpkg · L8
dist/lib/dashboard-cache.jsView file
73` Run: npm run build:dist (requires Node >= 18)\n` + L74: ` Or install from npm: npm install @devflow-tools/devflow@${cliVersion}`); L75: } L76: // Copy standalone output to cache L77: execSync(`cp -r "${standaloneDir}/"* "${dashDir}/"`, { stdio: "pipe" }); L78: if (existsSync(staticDir)) {
High
Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/lib/dashboard-cache.jsView on unpkg · L73

Findings

3 High3 Medium4 Low
HighChild Processbin/devflow.cjs
HighShell
HighRuntime Package Installdist/lib/dashboard-cache.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowNo License