registry / @devvit/cli / 0.13.8

@devvit/cli@0.13.8

Reddit's Dev Platform CLI Tool

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 103 file(s), 457 KB of source, external domains: date-fns.org, developers.reddit.com, devvit-gateway.reddit.com, gql-fed.reddit.com, oauth.reddit.com, test.com, www.reddit.com, www.w3.org

Source & flagged code

5 flagged

dist/util/kill-process-tree.jsView file

Lines 1-21javascript

1import { spawnSync } from 'node:child_process';

2import { execaCommand } from 'execa';

High

Child Process

Package source references child process execution.

dist/util/kill-process-tree.jsView on unpkg · L1

3/**

High

Shell

Package source references shell execution.

dist/util/kill-process-tree.jsView on unpkg · L1

4 * Synchronously deliver an initial "stop" signal to the process tree:

5 * SIGTERM to the POSIX process group, or `taskkill /T /F` on Windows.

6 *

7 * Returns as soon as the signal is queued (POSIX) or `taskkill` finishes

8 * (Windows). On POSIX it does *not* wait for the tree to actually exit and

9 * does *not* escalate to SIGKILL - if you need either, use the async

10 * {@link killProcessTree} instead. This sync entry point exists for

11 * `process.on('exit', ...)` handlers, which run during event-loop

12 * shutdown and can't await.

13 */

14export function killProcessTreeSync(subprocess) {

15 const pid = subprocess.pid;

16 if (pid == null)

17 return;

18 if (process.platform === 'win32') {

19 try {

20 spawnSync('taskkill', ['/pid', String(pid), '/T', '/F'], { stdio: 'ignore' });

21 }

dist/lib/hooks/init/check-node-version.jsView file

Lines 1-27javascript

1import { createRequire } from 'node:module';

2import { isWebContainer } from '../../../util/platform-util.js';

3const hook = async function () {

4 // TODO: remove this check after stackblitz ships node20 support

5 if (isWebContainer()) {

dist/commands/init.jsView file

Lines 396-436javascript

396 });

397}

398export async function updatePackageJSON(projectPath, appName) {

399 const pkgJsonPath = path.join(projectPath, 'package.json');

400 const templatePkgJson =

bin/devvit.cmdView file

•path = bin/devvit.cmd kind = build_helper sizeBytes = 37 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/devvit.cmdView on unpkg

Source & flagged code

5 flagged · loading source

dist/util/kill-process-tree.jsView file

1import { spawnSync } from 'node:child_process'; L2: import { execaCommand } from 'execa';

High

Child Process

Package source references child process execution.

dist/util/kill-process-tree.jsView on unpkg · L1

1import { spawnSync } from 'node:child_process'; L2: import { execaCommand } from 'execa'; L3: /**

High

Shell

Package source references shell execution.

dist/util/kill-process-tree.jsView on unpkg · L1

dist/lib/hooks/init/check-node-version.jsView file

8// Verify that the user is using a supported version of Node.js, based on the engines property in package.json L9: const require = createRequire(import.meta.url); L10: const { engines } = require('../../../../package.json');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/lib/hooks/init/check-node-version.jsView on unpkg · L8

dist/commands/init.jsView file

416try { L417: await exec(`npm i --loglevel=error --no-fund`, { L418: cwd: projectPath,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/commands/init.jsView on unpkg · L416

bin/devvit.cmdView file

•path = bin/devvit.cmd kind = build_helper sizeBytes = 37 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/devvit.cmdView on unpkg

Findings

3 High5 Medium4 Low

HighChild Processdist/util/kill-process-tree.js

HighShelldist/util/kill-process-tree.js

HighRuntime Package Installdist/commands/init.js

MediumDynamic Requiredist/lib/hooks/init/check-node-version.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperbin/devvit.cmd

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

5 flagged

dist/util/kill-process-tree.jsView file

Lines 1-21javascript

1import { spawnSync } from 'node:child_process';

2import { execaCommand } from 'execa';

High

Child Process

Package source references child process execution.

dist/util/kill-process-tree.jsView on unpkg · L1

3/**

High

Shell

Package source references shell execution.

dist/util/kill-process-tree.jsView on unpkg · L1

4 * Synchronously deliver an initial "stop" signal to the process tree:

5 * SIGTERM to the POSIX process group, or `taskkill /T /F` on Windows.

6 *

7 * Returns as soon as the signal is queued (POSIX) or `taskkill` finishes

8 * (Windows). On POSIX it does *not* wait for the tree to actually exit and

9 * does *not* escalate to SIGKILL - if you need either, use the async

10 * {@link killProcessTree} instead. This sync entry point exists for

11 * `process.on('exit', ...)` handlers, which run during event-loop

12 * shutdown and can't await.

13 */

14export function killProcessTreeSync(subprocess) {

15 const pid = subprocess.pid;

16 if (pid == null)

17 return;

18 if (process.platform === 'win32') {

19 try {

20 spawnSync('taskkill', ['/pid', String(pid), '/T', '/F'], { stdio: 'ignore' });

21 }

dist/lib/hooks/init/check-node-version.jsView file

Lines 1-27javascript

1import { createRequire } from 'node:module';

2import { isWebContainer } from '../../../util/platform-util.js';

3const hook = async function () {

4 // TODO: remove this check after stackblitz ships node20 support

5 if (isWebContainer()) {

dist/commands/init.jsView file

Lines 396-436javascript

396 });

397}

398export async function updatePackageJSON(projectPath, appName) {

399 const pkgJsonPath = path.join(projectPath, 'package.json');

400 const templatePkgJson =

bin/devvit.cmdView file

•path = bin/devvit.cmd kind = build_helper sizeBytes = 37 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/devvit.cmdView on unpkg