registry / @dk/jolly / 0.12.3

@dk/jolly@0.12.3

Jolly sets up a Saleor Cloud storefront with Vercel and Stripe from your terminal or coding agent.

Static Scan Results

scanned 7h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 1 file(s), 249 KB of source, external domains: cloud.saleor.io, docs.saleor.io, github.com, stripe-v2.saleor.app, your-store.saleor.cloud

Source & flagged code

4 flagged

dist/index.jsView file

Lines 67-107javascript

67 line: `${CSI2}2K`,

68 lineEnd: `${CSI2}K`,

69 lineStart: `${CSI2}1K`,

70 lines(count) {

71 let clear = "";

72 for (let i4 = 0; i4 < count; i4++)

73 clear += this.line + (i4 < count - 1 ? cursor3.up() : "");

74 if (count)

75 clear += cursor3.left;

76 return clear;

77 }

78 };

79 module.exports = { cursor: cursor3, scroll, erase: erase3, beep };

80 }

81});

83// src/index.ts

84import { existsSync as existsSync3, readFileSync as readFileSync4, writeFileSync as writeFileSync2, rmSync, openSync, closeSync } from "node:fs";

85import { tmpdir } from "node:os";

86import { join as join2 } from "node:path";

87import { fileURLToPath as fileURLToPath2 } from "node:url";

88import { spawn, spawnSync } from "node:child_process";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L87

90// src/lib/cloud-api.ts

91import { readFileSync } from "node:fs";

92import { parse } from "yaml";

94// src/lib/hosts.ts

95var FIRST_PARTY_HOSTS = [

96 "cloud.saleor.io",

97 "auth.saleor.io",

98 "github.com"

99];

100function overrideHost(envVar) {

101 const override = process.env[envVar];

102 if (!override || override.trim().length === 0) return void 0;

103 try {

104 return new URL(override.trim()).hostname;

105 } catch {

106 return void 0;

107 }

Lines 1256-1296javascript

1256 if (s2.length > 1 && s2[0] === "-") {

1257 if (s2[1] !== "-" && s2.length > 2 && !s2.includes("=")) if (s2.

Lines 4609-4649javascript

4609 message: `"${sub}" is not a create subcommand. Valid: ${CREATE_SUBCOMMANDS.join(", ")}.`,

4610 remediation: "Run `jolly create --help` to list available subcommands."

4611 }

4612 ]);

4613 }

4614}

4615function bundledJollySkillPath() {

4616 return

Lines 5009-5049javascript

5009 id: "us-channel-purchasable",

5010 status: "skipped",

5011 description: "Store endpoint or SALEOR_TOKEN not configured; `us`-channel purchasability was not checked."

5012 });

5013 } else {

5014 const purchasable = await probeChannelPurchasability(

5015 purchaseEndpoint,

Source & flagged code

4 flagged · loading source

dist/index.jsView file

87import { fileURLToPath as fileURLToPath2 } from "node:url"; L88: import { spawn, spawnSync } from "node:child_process"; L89:

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L87

1276L1277: // node_modules/@bomb.sh/tab/dist/powershell-CHePOaos.mjs L1278: function t(t3, n3) {

High

Shell

Package source references shell execution.

dist/index.jsView on unpkg · L1276

4629return new Promise((resolve) => { L4630: const child = spawn( L4631: "npx", ... L4639: const path = join2(projectDir(), ".mcp.json"); L4640: const endpoint = loadEnvValues(projectDir())["NEXT_PUBLIC_SALEOR_API_URL"] ?? process.env["NEXT_PUBLIC_SALEOR_API_URL"] ?? "https://your-store.saleor.cloud/graphql/"; L4641: const jollyEntry = {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L4629

5029description: "The store is reachable but no product is available for purchase in the `us` channel \u2014 add channel listings (with price + availability) so products can sell; chec... L5030: command: "npx @saleor/configurator deploy --failOnDelete" L5031: }); ... L5041: if (wants("storefront")) { L5042: const pnpmProbe = spawnSync("pnpm", ["--version"], { encoding: "utf8" }); L5043: const globalPnpm = !pnpmProbe.error && pnpmProbe.status === 0;

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L5029

Findings

4 High3 Medium6 Low

HighChild Processdist/index.js

HighShelldist/index.js

HighSame File Env Network Executiondist/index.js

HighRuntime Package Installdist/index.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

4 flagged

dist/index.jsView file

Lines 67-107javascript

67 line: `${CSI2}2K`,

68 lineEnd: `${CSI2}K`,

69 lineStart: `${CSI2}1K`,

70 lines(count) {

71 let clear = "";

72 for (let i4 = 0; i4 < count; i4++)

73 clear += this.line + (i4 < count - 1 ? cursor3.up() : "");

74 if (count)

75 clear += cursor3.left;

76 return clear;

77 }

78 };

79 module.exports = { cursor: cursor3, scroll, erase: erase3, beep };

80 }

81});

83// src/index.ts

84import { existsSync as existsSync3, readFileSync as readFileSync4, writeFileSync as writeFileSync2, rmSync, openSync, closeSync } from "node:fs";

85import { tmpdir } from "node:os";

86import { join as join2 } from "node:path";

87import { fileURLToPath as fileURLToPath2 } from "node:url";

88import { spawn, spawnSync } from "node:child_process";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L87

90// src/lib/cloud-api.ts

91import { readFileSync } from "node:fs";

92import { parse } from "yaml";

94// src/lib/hosts.ts

95var FIRST_PARTY_HOSTS = [

96 "cloud.saleor.io",

97 "auth.saleor.io",

98 "github.com"

99];

100function overrideHost(envVar) {

101 const override = process.env[envVar];

102 if (!override || override.trim().length === 0) return void 0;

103 try {

104 return new URL(override.trim()).hostname;

105 } catch {

106 return void 0;

107 }

Lines 1256-1296javascript

1256 if (s2.length > 1 && s2[0] === "-") {

1257 if (s2[1] !== "-" && s2.length > 2 && !s2.includes("=")) if (s2.

Lines 4609-4649javascript

4609 message: `"${sub}" is not a create subcommand. Valid: ${CREATE_SUBCOMMANDS.join(", ")}.`,

4610 remediation: "Run `jolly create --help` to list available subcommands."

4611 }

4612 ]);

4613 }

4614}

4615function bundledJollySkillPath() {

4616 return

Lines 5009-5049javascript

5009 id: "us-channel-purchasable",

5010 status: "skipped",

5011 description: "Store endpoint or SALEOR_TOKEN not configured; `us`-channel purchasability was not checked."

5012 });

5013 } else {

5014 const purchasable = await probeChannelPurchasability(

5015 purchaseEndpoint,