registry / @dk/jolly / 0.11.2

@dk/jolly@0.11.2

Jolly sets up a Saleor Cloud storefront with Vercel and Stripe from your terminal or coding agent.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 1 file(s), 239 KB of source, external domains: cloud.saleor.io, docs.saleor.io, github.com, stripe-v2.saleor.app, your-store.saleor.cloud

Source & flagged code

4 flagged

dist/index.jsView file

Lines 67-107javascript

67 line: `${CSI2}2K`,

68 lineEnd: `${CSI2}K`,

69 lineStart: `${CSI2}1K`,

70 lines(count) {

71 let clear = "";

72 for (let i4 = 0; i4 < count; i4++)

73 clear += this.line + (i4 < count - 1 ? cursor3.up() : "");

74 if (count)

75 clear += cursor3.left;

76 return clear;

77 }

78 };

79 module.exports = { cursor: cursor3, scroll, erase: erase3, beep };

80 }

81});

83// src/index.ts

84import { existsSync as existsSync3, readFileSync as readFileSync4, writeFileSync as writeFileSync2, rmSync, openSync, closeSync } from "node:fs";

85import { tmpdir } from "node:os";

86import { join as join2 } from "node:path";

87import { fileURLToPath as fileURLToPath2 } from "node:url";

88import { spawn, spawnSync } from "node:child_process";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L87

90// src/lib/cloud-api.ts

91import { readFileSync } from "node:fs";

92import { parse } from "yaml";

94// src/lib/hosts.ts

95var FIRST_PARTY_HOSTS = [

96 "cloud.saleor.io",

97 "auth.saleor.io",

98 "github.com"

99];

100function overrideHost(envVar) {

101 const override = process.env[envVar];

102 if (!override || override.trim().length === 0) return void 0;

103 try {

104 return new URL(override.trim()).hostname;

105 } catch {

106 return void 0;

107 }

Lines 1182-1222javascript

1182 if (s2.length > 1 && s2[0] === "-") {

1183 if (s2[1] !== "-" && s2.length > 2 && !s2.includes("=")) if (s2.

Lines 4411-4451javascript

4411 if (args.help) {

4412 return commandUsage(args);

4413 }

4414 switch (sub) {

4415 case "store":

4416 return commandCreateStore(args);

4417 default:

4418 return errorEnvelope("create"

Lines 4787-4827javascript

4787 id: "us-channel-purchasable",

4788 status: "skipped",

4789 description: "Store endpoint or SALEOR_TOKEN not configured; `us`-channel purchasability was not checked."

4790 });

4791 } else {

4792 const purchasable = await probeChannelPurchasability(

4793 purchaseEndpoint,

Source & flagged code

4 flagged · loading source

dist/index.jsView file

87import { fileURLToPath as fileURLToPath2 } from "node:url"; L88: import { spawn, spawnSync } from "node:child_process"; L89:

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L87

1202L1203: // node_modules/@bomb.sh/tab/dist/powershell-CHePOaos.mjs L1204: function t(t3, n3) {

High

Shell

Package source references shell execution.

dist/index.jsView on unpkg · L1202

4431const source = skill.id === "jolly" ? bundledJollySkillPath() : skill.ref; L4432: const result = spawnSync( L4433: "npx", ... L4440: const path = join2(projectDir(), ".mcp.json"); L4441: const endpoint = loadEnvValues(projectDir())["NEXT_PUBLIC_SALEOR_API_URL"] ?? process.env["NEXT_PUBLIC_SALEOR_API_URL"] ?? "https://your-store.saleor.cloud/graphql/"; L4442: const jollyEntry = {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L4431

4807description: "The store is reachable but no product is available for purchase in the `us` channel \u2014 add channel listings (with price + availability) so products can sell; chec... L4808: command: "npx @saleor/configurator deploy --failOnDelete" L4809: }); ... L4819: if (wants("storefront")) { L4820: const pnpmProbe = spawnSync("pnpm", ["--version"], { encoding: "utf8" }); L4821: const globalPnpm = !pnpmProbe.error && pnpmProbe.status === 0;

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L4807

Findings

4 High3 Medium6 Low

HighChild Processdist/index.js

HighShelldist/index.js

HighSame File Env Network Executiondist/index.js

HighRuntime Package Installdist/index.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

4 flagged

dist/index.jsView file

Lines 67-107javascript

67 line: `${CSI2}2K`,

68 lineEnd: `${CSI2}K`,

69 lineStart: `${CSI2}1K`,

70 lines(count) {

71 let clear = "";

72 for (let i4 = 0; i4 < count; i4++)

73 clear += this.line + (i4 < count - 1 ? cursor3.up() : "");

74 if (count)

75 clear += cursor3.left;

76 return clear;

77 }

78 };

79 module.exports = { cursor: cursor3, scroll, erase: erase3, beep };

80 }

81});

83// src/index.ts

84import { existsSync as existsSync3, readFileSync as readFileSync4, writeFileSync as writeFileSync2, rmSync, openSync, closeSync } from "node:fs";

85import { tmpdir } from "node:os";

86import { join as join2 } from "node:path";

87import { fileURLToPath as fileURLToPath2 } from "node:url";

88import { spawn, spawnSync } from "node:child_process";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L87

90// src/lib/cloud-api.ts

91import { readFileSync } from "node:fs";

92import { parse } from "yaml";

94// src/lib/hosts.ts

95var FIRST_PARTY_HOSTS = [

96 "cloud.saleor.io",

97 "auth.saleor.io",

98 "github.com"

99];

100function overrideHost(envVar) {

101 const override = process.env[envVar];

102 if (!override || override.trim().length === 0) return void 0;

103 try {

104 return new URL(override.trim()).hostname;

105 } catch {

106 return void 0;

107 }

Lines 1182-1222javascript

1182 if (s2.length > 1 && s2[0] === "-") {

1183 if (s2[1] !== "-" && s2.length > 2 && !s2.includes("=")) if (s2.

Lines 4411-4451javascript

4411 if (args.help) {

4412 return commandUsage(args);

4413 }

4414 switch (sub) {

4415 case "store":

4416 return commandCreateStore(args);

4417 default:

4418 return errorEnvelope("create"

Lines 4787-4827javascript

4787 id: "us-channel-purchasable",

4788 status: "skipped",

4789 description: "Store endpoint or SALEOR_TOKEN not configured; `us`-channel purchasability was not checked."

4790 });

4791 } else {

4792 const purchasable = await probeChannelPurchasability(

4793 purchaseEndpoint,