registry / @dotcarbon/create-app / 0.3.1

@dotcarbon/create-app@0.3.1

Scaffold a new DotCarbon app

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 8 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 33 file(s), 27.2 KB of source, external domains: dotnet.microsoft.com

Source & flagged code

3 flagged

dist/index.jsView file

Lines 1-26javascript

1#!/usr/bin/env node

2import * as p from '@clack/prompts';

3import { writeFile, readFile, cp, unlink, rename, readdir, stat } from 'fs/promises';

4import { existsSync } from 'fs';

5import { join, dirname, sep } from 'path';

6import { fileURLToPath } from 'url';

7import { execSync, spawn } from 'child_process';

8const __dirname = dirname(fileURLToPath(import.meta.url));

9const TEMPLATES = ['react', 'vue', 'svelte', 'solid', 'preact', 'vanilla'];

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L6

10const TEMPLATE_LABELS = {

11 react: 'React', vue: 'Vue', svelte: 'Svelte', solid: 'Solid', preact: 'Preact', vanilla: 'Vanilla',

12};

13const PMS = ['pnpm', 'npm', 'yarn', 'bun'];

14const EXCLUDE_DIRS = new Set(['node_modules', 'dist', 'bin', 'obj', 'out']);

15async function main() {

16 const args = process.argv.slice(2);

17 const valueFlags = new Set(['--template', '--pm', '--lang']);

18 const getFlag = (name) => { const i = args.indexOf(name); return i >= 0 ? args[i + 1] : undefined; };

19 const noInstall = args.includes('--no-install');

20 const autoYes = args.includes('--yes') || args.includes('-y');

21 const interactive = Boolean(process.stdin.isTTY) && !autoYes;

22 let name = args.find((a, i) => !a.startsWith('-') && !valueFlags.has(args[i - 1]));

23 let template = getFlag('--template');

24 let lang = getFlag('--lang');

25 let pm = getFlag('--pm');

26 if (args.includes('--ts') || args.includes('--typescript'))

•matchType = previous_version_dangerous_delta matchedPackage = @dotcarbon/create-app@0.2.0 matchedIdentity = npm:QGRvdGNhcmJvbi9jcmVhdGUtYXBw:0.2.0 similarity = 0.970 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg

dist/shared/icons/icon.icnsView file

•path = dist/shared/icons/icon.icns kind = high_entropy_blob sizeBytes = 1812779 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/shared/icons/icon.icnsView on unpkg

Source & flagged code

3 flagged · loading source

dist/index.jsView file

6import { fileURLToPath } from 'url'; L7: import { execSync, spawn } from 'child_process'; L8: const __dirname = dirname(fileURLToPath(import.meta.url)); L9: const TEMPLATES = ['react', 'vue', 'svelte', 'solid', 'preact', 'vanilla']; ... L35: name = interactive L36: ? asString(await p.text({ L37: message: 'Project name', ... L94: await replaceInDir(targetDir, '{{PM}}', pm); L95: const packageMetadata = JSON.parse(await readFile(join(__dirname, '..', 'package.json'), 'utf-8')); L96: await replaceInDir(targetDir, '{{DOTCARBON_VERSION}}', packageMetadata.version); ... L152: const proc = spawn('dotnet', ['tool', 'install', '--global', 'DotCarbon.Cli'], { L153: stdio: 'ignore', shell: process.platform === 'win32',

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L6

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg

dist/shared/icons/icon.icnsView file

•path = dist/shared/icons/icon.icns kind = high_entropy_blob sizeBytes = 1812779 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/shared/icons/icon.icnsView on unpkg

Findings

3 High1 Medium4 Low

HighSandbox Evasion Gated Capabilitydist/index.js

HighShips High Entropy Blobdist/shared/icons/icon.icns

HighPrevious Version Dangerous Deltadist/index.js

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

dist/index.jsView file

Lines 1-26javascript

1#!/usr/bin/env node

2import * as p from '@clack/prompts';

3import { writeFile, readFile, cp, unlink, rename, readdir, stat } from 'fs/promises';

4import { existsSync } from 'fs';

5import { join, dirname, sep } from 'path';

6import { fileURLToPath } from 'url';

7import { execSync, spawn } from 'child_process';

8const __dirname = dirname(fileURLToPath(import.meta.url));

9const TEMPLATES = ['react', 'vue', 'svelte', 'solid', 'preact', 'vanilla'];

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L6

10const TEMPLATE_LABELS = {

11 react: 'React', vue: 'Vue', svelte: 'Svelte', solid: 'Solid', preact: 'Preact', vanilla: 'Vanilla',

12};

13const PMS = ['pnpm', 'npm', 'yarn', 'bun'];

14const EXCLUDE_DIRS = new Set(['node_modules', 'dist', 'bin', 'obj', 'out']);

15async function main() {

16 const args = process.argv.slice(2);

17 const valueFlags = new Set(['--template', '--pm', '--lang']);

18 const getFlag = (name) => { const i = args.indexOf(name); return i >= 0 ? args[i + 1] : undefined; };

19 const noInstall = args.includes('--no-install');

20 const autoYes = args.includes('--yes') || args.includes('-y');

21 const interactive = Boolean(process.stdin.isTTY) && !autoYes;

22 let name = args.find((a, i) => !a.startsWith('-') && !valueFlags.has(args[i - 1]));

23 let template = getFlag('--template');

24 let lang = getFlag('--lang');

25 let pm = getFlag('--pm');

26 if (args.includes('--ts') || args.includes('--typescript'))

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg

dist/shared/icons/icon.icnsView file

•path = dist/shared/icons/icon.icns kind = high_entropy_blob sizeBytes = 1812779 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/shared/icons/icon.icnsView on unpkg