registry / @digitalygo/diggocms-sdk-core / 0.9.0

@digitalygo/diggocms-sdk-core@0.9.0

Headless CMS SDK for React with base components, auto-rendering, and mock-friendly development

Static Scan Results

scanned 5h ago · by rust-scanner

Static analysis flagged 15 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 7 file(s), 823 KB of source, external domains: docs.diggocms.com, json-schema.org, raw.githubusercontent.com

Source & flagged code

5 flagged

bin/verify-bundle.jsView file

Lines 1-26javascript

1#!/usr/bin/env node

3import { createHash } from 'node:crypto';

4import { resolve, dirname, join } from 'node:path';

5import { fileURLToPath } from 'node:url';

6import { readFile, readdir, access, stat } from 'node:fs/promises';

7import { execSync } from 'node:child_process';

8import { existsSync, readFileSync } from 'node:fs';

High

Child Process

Package source references child process execution.

bin/verify-bundle.jsView on unpkg · L6

10const __filename = fileURLToPath(import.meta.url);

11const __dirname = dirname(__filename);

12const packageDir = resolve(__dirname, '..');

14const HEX40_RE = /^[0-9a-f]{40}$/;

15const HEX64_RE = /^[0-9a-f]{64}$/;

17function sha256(buf) {

18 return createHash('sha256').update(buf).digest('hex');

19}

21function computeBundleDigest(files) {

22 const lines = files.map((f) => `${f.path}:${f.digest}`);

23 return sha256(Buffer.from(lines.join('\n'), 'utf8'));

24}

26function validateFilePath(path) {

mcp-bundle/dist/cli.jsView file

225L226: Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.`)}for(let t of n.seen.entries()){let g=t[1];if(i===t[0]){v(t);continue}if(n.external){let D=n.exter... L227: `:""},this._extScope=n,this._scope=new li.Scope({parent:n}),this._nodes=[new YX]}toString(){return this._root.render(this.opts)}name(n){return this._scope.name(n)}scopeName(n){retu... ... L240: --${F}--\r L241: `,H=Buffer.from(X,"utf-8"),R=Buffer.concat([H,A,Buffer.from(V,"utf-8")]),B=await n.request(r,{method:"POST",headers:{"Content-Type":`multipart/form-data; boundary=${F}`},body:R},5)... L242: `),r.pass)i++}if(process.stderr.write(`

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

mcp-bundle/dist/cli.jsView on unpkg · L225

149`)}try{await zG(z,A,384),process.stderr.write(`Wrote .env.mcp-diggo. L150: `)}catch(J){let F=J instanceof Error?J.message:String(J);if(nu(L))process.stderr.write(`Env write failed: ${F}. Previous env preserved at ${L}. L151: `);throw Error(`Failed to write .env.mcp-diggo: ${F}`)}try{let J=await mA(i,$.mcpVersion,$.bundleDigest,r,u);process.stderr.write(`Registered mcp-diggo in ${J.path}. ... L161: `),!g.DESTRUCTIVE_TOOLS_ENABLED)process.stderr.write(`Destructive tools disabled. The MCP server will have a reduced-risk write inventory: mutation and provisioning tools that pass... L162: `);process.stderr.write("\nRun `mcp-diggo doctor` to verify the installation.\n")}var x5;var WG=S(()=>{xv();G4();j4();av();On();x5=["opencode.json","opencode.jsonc"]});function O(n... L163: `)}var EG=(n,

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

mcp-bundle/dist/cli.jsView on unpkg · L149

bin/cli.jsView file

Lines 74-114javascript

74 }

75 return ownPath;

76}

78async function getCoreVersionNumber() {

79 const raw = await readFile(

Source & flagged code

5 flagged · loading source

bin/verify-bundle.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code