registry / @drawcall/market / 0.1.49

@drawcall/market@0.1.49

Typed client, dependency resolver, and CLI for the [Drawcall Market](https://market.drawcall.ai) — an asset marketplace for 3D models, textures, animations, audio, environments, flipbooks, and templates.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 54 file(s), 194 KB of source, external domains: api.market.drawcall.ai, auth.drawcall.ai, github.com

Source & flagged code

2 flagged

dist/install.jsView file

Lines 1-28javascript

1/**

2 * Install resolved assets into a local project.

3 *

4 * 1. Downloads public asset files into ./public/... via the oRPC client.

5 * 2. Merges npm dependencies into package.json.

6 * 3. Runs the package manager to install npm deps.

7 * 4. Installs skill dependencies via the `skills` CLI (`skills add <source>`).

8 *

9 * NOTE: This module uses Node.js APIs (fs, path, nypm, child_process) and is

10 * only used by the CLI binary; it is NOT exported from the package index.

High

Child Process

Package source references child process execution.

dist/install.jsView on unpkg · L8

11 */

12import { execFile } from 'child_process';

13import * as fs from 'fs/promises';

14import * as path from 'path';

15import { unzipSync } from 'fflate';

16import { detectPackageManager, installDependencies } from 'nypm';

17import { readMarketLock, sha256, writeMarketLock } from './market-lock.js';

18import { parsePackageJson } from './package-json.js';

19export async function install(client, resolution, opts = {}) {

20 const log = opts.onProgress ?? (() => { });

21 const installRoot = await findInstallRoot(opts.cwd ?? process.cwd());

22 const metadata = opts.installMetadata ?? {};

23 const download = await downloadAssets(client, resolution, installRoot, {

24 force: opts.force ?? false,

25 log,

26 baseUrl: opts.baseUrl,

27 });

28 await writeInstalledAssetLock(installRoot, download.assets);

Lines 341-372javascript

341 * a remote ref and is passed through untouched.

342 */

343function resolveSkillSource(source, projectRoot) {

344 return isLocalSkillPath(source) ? path.resolve(projectRoot, source) : source;

345}

346function isLocalSkillPath(source) {

347

Source & flagged code

2 flagged · loading source

dist/install.jsView file

8* L9: * NOTE: This module uses Node.js APIs (fs, path, nypm, child_process) and is L10: * only used by the CLI binary; it is NOT exported from the package index.

High

Child Process

Package source references child process execution.

dist/install.jsView on unpkg · L8

361return new Promise((resolve, reject) => { L362: execFile('npx', ['--yes', 'skills', 'add', source, '-y'], { cwd }, (error, _stdout, stderr) => { L363: if (error) {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/install.jsView on unpkg · L361

Findings

3 High3 Medium5 Low

HighChild Processdist/install.js

HighShell

HighRuntime Package Installdist/install.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

2 flagged

dist/install.jsView file

Lines 1-28javascript

1/**

2 * Install resolved assets into a local project.

3 *

4 * 1. Downloads public asset files into ./public/... via the oRPC client.

5 * 2. Merges npm dependencies into package.json.

6 * 3. Runs the package manager to install npm deps.

7 * 4. Installs skill dependencies via the `skills` CLI (`skills add <source>`).

8 *

9 * NOTE: This module uses Node.js APIs (fs, path, nypm, child_process) and is

10 * only used by the CLI binary; it is NOT exported from the package index.

High

Child Process

Package source references child process execution.

dist/install.jsView on unpkg · L8

11 */

12import { execFile } from 'child_process';

13import * as fs from 'fs/promises';

14import * as path from 'path';

15import { unzipSync } from 'fflate';

16import { detectPackageManager, installDependencies } from 'nypm';

17import { readMarketLock, sha256, writeMarketLock } from './market-lock.js';

18import { parsePackageJson } from './package-json.js';

19export async function install(client, resolution, opts = {}) {

20 const log = opts.onProgress ?? (() => { });

21 const installRoot = await findInstallRoot(opts.cwd ?? process.cwd());

22 const metadata = opts.installMetadata ?? {};

23 const download = await downloadAssets(client, resolution, installRoot, {

24 force: opts.force ?? false,

25 log,

26 baseUrl: opts.baseUrl,

27 });

28 await writeInstalledAssetLock(installRoot, download.assets);

Lines 341-372javascript

341 * a remote ref and is passed through untouched.

342 */

343function resolveSkillSource(source, projectRoot) {

344 return isLocalSkillPath(source) ? path.resolve(projectRoot, source) : source;

345}

346function isLocalSkillPath(source) {

347