registry / @dotcarbon/create-app / 0.6.1

@dotcarbon/create-app@0.6.1

Scaffold a new DotCarbon app

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 7 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 33 file(s), 27.2 KB of source, external domains: dotnet.microsoft.com

Source & flagged code

2 flagged

dist/index.jsView file

Lines 1-26javascript

1#!/usr/bin/env node

2import * as p from '@clack/prompts';

3import { writeFile, readFile, cp, unlink, rename, readdir, stat } from 'fs/promises';

4import { existsSync } from 'fs';

5import { join, dirname, sep } from 'path';

6import { fileURLToPath } from 'url';

7import { execSync, spawn } from 'child_process';

8const __dirname = dirname(fileURLToPath(import.meta.url));

9const TEMPLATES = ['react', 'vue', 'svelte', 'solid', 'preact', 'vanilla'];

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L6

10const TEMPLATE_LABELS = {

11 react: 'React', vue: 'Vue', svelte: 'Svelte', solid: 'Solid', preact: 'Preact', vanilla: 'Vanilla',

12};

13const PMS = ['pnpm', 'npm', 'yarn', 'bun'];

14const EXCLUDE_DIRS = new Set(['node_modules', 'dist', 'bin', 'obj', 'out']);

15async function main() {

16 const args = process.argv.slice(2);

17 const valueFlags = new Set(['--template', '--pm', '--lang']);

18 const getFlag = (name) => { const i = args.indexOf(name); return i >= 0 ? args[i + 1] : undefined; };

19 const noInstall = args.includes('--no-install');

20 const autoYes = args.includes('--yes') || args.includes('-y');

21 const interactive = Boolean(process.stdin.isTTY) && !autoYes;

22 let name = args.find((a, i) => !a.startsWith('-') && !valueFlags.has(args[i - 1]));

23 let template = getFlag('--template');

24 let lang = getFlag('--lang');

25 let pm = getFlag('--pm');

26 if (args.includes('--ts') || args.includes('--typescript'))

dist/shared/icons/icon.icnsView file

•path = dist/shared/icons/icon.icns kind = high_entropy_blob sizeBytes = 1812779 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/shared/icons/icon.icnsView on unpkg

Source & flagged code

2 flagged · loading source

dist/index.jsView file

6import { fileURLToPath } from 'url'; L7: import { execSync, spawn } from 'child_process'; L8: const __dirname = dirname(fileURLToPath(import.meta.url)); L9: const TEMPLATES = ['react', 'vue', 'svelte', 'solid', 'preact', 'vanilla']; ... L35: name = interactive L36: ? asString(await p.text({ L37: message: 'Project name', ... L94: await replaceInDir(targetDir, '{{PM}}', pm); L95: const packageMetadata = JSON.parse(await readFile(join(__dirname, '..', 'package.json'), 'utf-8')); L96: await replaceInDir(targetDir, '{{DOTCARBON_VERSION}}', packageMetadata.version); ... L152: const proc = spawn('dotnet', ['tool', 'install', '--global', 'DotCarbon.Cli'], { L153: stdio: 'ignore', shell: process.platform === 'win32',

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L6

dist/shared/icons/icon.icnsView file

•path = dist/shared/icons/icon.icns kind = high_entropy_blob sizeBytes = 1812779 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/shared/icons/icon.icnsView on unpkg

Findings

2 High1 Medium4 Low

HighSandbox Evasion Gated Capabilitydist/index.js

HighShips High Entropy Blobdist/shared/icons/icon.icns

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

dist/index.jsView file

Lines 1-26javascript

1#!/usr/bin/env node

2import * as p from '@clack/prompts';

3import { writeFile, readFile, cp, unlink, rename, readdir, stat } from 'fs/promises';

4import { existsSync } from 'fs';

5import { join, dirname, sep } from 'path';

6import { fileURLToPath } from 'url';

7import { execSync, spawn } from 'child_process';

8const __dirname = dirname(fileURLToPath(import.meta.url));

9const TEMPLATES = ['react', 'vue', 'svelte', 'solid', 'preact', 'vanilla'];

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L6

10const TEMPLATE_LABELS = {

11 react: 'React', vue: 'Vue', svelte: 'Svelte', solid: 'Solid', preact: 'Preact', vanilla: 'Vanilla',

12};

13const PMS = ['pnpm', 'npm', 'yarn', 'bun'];

14const EXCLUDE_DIRS = new Set(['node_modules', 'dist', 'bin', 'obj', 'out']);

15async function main() {

16 const args = process.argv.slice(2);

17 const valueFlags = new Set(['--template', '--pm', '--lang']);

18 const getFlag = (name) => { const i = args.indexOf(name); return i >= 0 ? args[i + 1] : undefined; };

19 const noInstall = args.includes('--no-install');

20 const autoYes = args.includes('--yes') || args.includes('-y');

21 const interactive = Boolean(process.stdin.isTTY) && !autoYes;

22 let name = args.find((a, i) => !a.startsWith('-') && !valueFlags.has(args[i - 1]));

23 let template = getFlag('--template');

24 let lang = getFlag('--lang');

25 let pm = getFlag('--pm');

26 if (args.includes('--ts') || args.includes('--typescript'))

dist/shared/icons/icon.icnsView file

•path = dist/shared/icons/icon.icns kind = high_entropy_blob sizeBytes = 1812779 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/shared/icons/icon.icnsView on unpkg