registry / @devflow-tools/cli / 0.15.0

@devflow-tools/cli@0.15.0

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStrings

Manifest

NoLicense

scanned 32 file(s), 81.9 KB of source

Source & flagged code

2 flagged

bin/devflow.cjsView file

Lines 1-28javascript

1#!/usr/bin/env node

2'use strict';

3//

4// DevFlow CLI launcher — runs on the user's Node, locates the vendored Node 24

5// runtime from @colbymchenry/codegraph (which bundles node:sqlite), and execs

6// the real CLI with it. The user's Node is only ever a launcher.

7//

9var childProcess = require('child_process');

10var path = require('path');

High

Child Process

Package source references child process execution.

bin/devflow.cjsView on unpkg · L8

12var target = process.platform + '-' + process.arch;

13var pkg = '@colbymchenry/codegraph-' + target;

14var isWindows = process.platform === 'win32';

16main();

18function main() {

19 var nodeExe, entry;

21 if (isWindows) {

22 nodeExe = resolveSilent(pkg + '/node.exe');

23 entry = resolveSilent(pkg + '/lib/dist/bin/codegraph.js');

24 if (!nodeExe || !entry) fail();

25 // --liftoff-only keeps WASM grammars off V8's turboshaft tier (avoids Zone OOM on Node >= 22)

26 var args = ['--liftoff-only', entry, resolveEntry()].concat(process.argv.slice(2));

27 var res = childProcess.spawnSync(nodeExe, args, { stdio: 'inherit' });

28 process.exit(res.status === null ? 1 : res.status);

dist/commands/plugin-guide.jsView file

Lines 30-70javascript

30 // ignore — package.json may not exist

31 }

32 return detected;

33}

34/**

35 * Resolve a user-supplied plugin name to a fully-qualified package name.

36 */

37export function resolvePluginName(name) {

38 const trimmed

Source & flagged code

2 flagged · loading source

bin/devflow.cjsView file

8L9: var childProcess = require('child_process'); L10: var path = require('path');

High

Child Process

Package source references child process execution.

bin/devflow.cjsView on unpkg · L8

dist/commands/plugin-guide.jsView file

50try { L51: execSync(`npm install -g ${plugin}`, { stdio: "inherit" }); L52: console.log(`✓ ${plugin}`);

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/commands/plugin-guide.jsView on unpkg · L50

Findings

3 High3 Medium4 Low

HighChild Processbin/devflow.cjs

HighShell

HighRuntime Package Installdist/commands/plugin-guide.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowNo License

Source & flagged code

2 flagged

bin/devflow.cjsView file

Lines 1-28javascript

1#!/usr/bin/env node

2'use strict';

3//

4// DevFlow CLI launcher — runs on the user's Node, locates the vendored Node 24

5// runtime from @colbymchenry/codegraph (which bundles node:sqlite), and execs

6// the real CLI with it. The user's Node is only ever a launcher.

7//

9var childProcess = require('child_process');

10var path = require('path');

High

Child Process

Package source references child process execution.

bin/devflow.cjsView on unpkg · L8

12var target = process.platform + '-' + process.arch;

13var pkg = '@colbymchenry/codegraph-' + target;

14var isWindows = process.platform === 'win32';

16main();

18function main() {

19 var nodeExe, entry;

21 if (isWindows) {

22 nodeExe = resolveSilent(pkg + '/node.exe');

23 entry = resolveSilent(pkg + '/lib/dist/bin/codegraph.js');

24 if (!nodeExe || !entry) fail();

25 // --liftoff-only keeps WASM grammars off V8's turboshaft tier (avoids Zone OOM on Node >= 22)

26 var args = ['--liftoff-only', entry, resolveEntry()].concat(process.argv.slice(2));

27 var res = childProcess.spawnSync(nodeExe, args, { stdio: 'inherit' });

28 process.exit(res.status === null ? 1 : res.status);

dist/commands/plugin-guide.jsView file

Lines 30-70javascript

30 // ignore — package.json may not exist

31 }

32 return detected;

33}

34/**

35 * Resolve a user-supplied plugin name to a fully-qualified package name.

36 */

37export function resolvePluginName(name) {

38 const trimmed