registry / @edge-base/cli / 0.3.1

@edge-base/cli@0.3.1

CLI for EdgeBase — create, develop, and deploy EdgeBase projects

Static Scan Results

scanned 9d ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 62 file(s), 752 KB of source, external domains: 127.0.0.1, api.cloudflare.com, docs.docker.com, edgebase.fun, www.apple.com

Source & flagged code

6 flagged

dist/lib/turnstile-provision.jsView file

Lines 1-21javascript

1import { execFileSync } from 'node:child_process';

2import { existsSync, readFileSync, writeFileSync } from 'node:fs';

High

Child Process

Package source references child process execution.

dist/lib/turnstile-provision.jsView on unpkg · L1

3import { join } from 'node:path';

4import chalk from 'chalk';

5import { npxCommand } from './npx.js';

6import { listWranglerSecretNames } from './wrangler-secrets.js';

7/**

8 * Provision Cloudflare Turnstile widget via Management API.

9 * If config.captcha === true: auto-create widget, store secret.

10 * If config.captcha is CaptchaConfig: use provided keys.

11 *

12 * @returns { siteKey, secretKey } or null if captcha not configured.

13 */

14export async function provisionTurnstile(captchaConfig, projectDir, _configJson, knownAccountId) {

15 if (!captchaConfig)

16 return null;

17 if (typeof captchaConfig === 'object') {

18 console.log(chalk.green('✓'), 'Captcha: using manual siteKey/secretKey');

19 return {

20 siteKey: captchaConfig.siteKey,

21 secretKey: captchaConfig.secretKey,

dist/lib/pack.jsView file

Lines 306-346javascript

306 }

307 const resolvedPath = realpathSync(libraryPath);

308 const destinationName = basename(resolvedPath);

309 if (copiedLibraries.has(destinationName))

310 continue;

311 copiedLibraries.

dist/lib/dev-sidecar.jsView file

Lines 264-304javascript

264 tokenTTL: authConfig.magicLink?.tokenTTL ?? null,

265 },

266 emailOtp: {

267 enabled: !!authConfig.emailOtp?.enabled,

268 autoCreate: authConfig.emailOtp?.autoCreate !== false,

269 },

270 passkeys

dist/commands/dev.jsView file

Lines 1-21javascript

1import { Command, CommanderError } from 'commander';

2import { spawn } from 'node:child_process';

3import { createHash, randomBytes } from 'node:crypto';

4import { createServer } from 'node:net';

5import { existsSync, watch, readFileSync, copyFileSync, unlinkSync, readdirSync, mkdirSync, promises as fsPromises, } from

dist/commands/deploy.jsView file

Lines 1-21javascript

1import { Command } from 'commander';

2import { spawn, execFileSync } from 'node:child_process';

3import { wranglerArgs, wranglerCommand, wranglerHint } from '../lib/wrangler.js';

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/commands/deploy.jsView on unpkg · L1

4import { existsSync, mkdirSync, readFileSync, writeFileSync, chmodSync, unlinkSync, } from

Source & flagged code

6 flagged · loading source

dist/lib/turnstile-provision.jsView file

1import { execFileSync } from 'node:child_process'; L2: import { existsSync, readFileSync, writeFileSync } from 'node:fs';

High

Child Process

Package source references child process execution.

dist/lib/turnstile-provision.jsView on unpkg · L1

dist/lib/pack.jsView file

326if (process.platform === 'win32') { L327: execFileSync('powershell', [ L328: '-NoProfile',

High

Shell

Package source references shell execution.

dist/lib/pack.jsView on unpkg · L326

dist/lib/dev-sidecar.jsView file

284if (!pgModulePromise) { L285: const dynamicImport = new Function('specifier', 'return import(specifier)'); L286: pgModulePromise = dynamicImport('pg').then((mod) => mod);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/lib/dev-sidecar.jsView on unpkg · L284

284if (!pgModulePromise) { L285: const dynamicImport = new Function('specifier', 'return import(specifier)'); L286: pgModulePromise = dynamicImport('pg').then((mod) => mod);

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/lib/dev-sidecar.jsView on unpkg · L284

dist/commands/dev.jsView file

1import { Command, CommanderError } from 'commander'; L2: import { spawn } from 'node:child_process'; L3: import { createHash, randomBytes } from 'node:crypto'; L4: import { createServer } from 'node:net'; L5: import { existsSync, watch, readFileSync, copyFileSync, unlinkSync, readdirSync, mkdirSync, promises as fsPromises, } from 'node:fs'; ... L28: const PORT_RESERVATION_STALE_GRACE_MS = 10_000; L29: const MAX_RECENT_WRANGLER_STDERR_LINES = 12; L30: const WRANGLER_EXIT_GRACE_MS = 2_500; L31: const WRANGLER_FORCE_KILL_GRACE_MS = 1_000; L32: const PORT_RESERVATION_DIR = process.env.EDGEBASE_DEV_PORT_RESERVATION_DIR L33: ? resolve(process.env.EDGEBASE_DEV_PORT_RESERVATION_DIR) ... L64: });

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/commands/dev.jsView on unpkg · L1

dist/commands/deploy.jsView file

1Cross-file remote execution chain: dist/commands/deploy.js spawns dist/lib/dev-sidecar.js; helper contains network access plus dynamic code execution. L1: import { Command } from 'commander'; L2: import { spawn, execFileSync } from 'node:child_process'; L3: import { wranglerArgs, wranglerCommand, wranglerHint } from '../lib/wrangler.js'; ... L32: const RELEASE_ENV_HEADER = '# EdgeBase production secrets'; L33: const ANSI_ESCAPE_REGEX = new RegExp(`${String.fromCharCode(27)}\\[[0-9;]*[a-zA-Z]`, 'g'); L34: export function [redacted](output) { ... L45: return ([redacted](deployOutput) L46: || process.env.EDGEBASE_URL L47: || resolveWorkerUrlFromProject(projectDir)); ... L53: try { L54: const response = await fetch(workerUrl, { L55: redirect: 'manual',

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/commands/deploy.jsView on unpkg · L1

Findings

3 High3 Medium6 Low

HighChild Processdist/lib/turnstile-provision.js

HighShelldist/lib/pack.js

HighCross File Remote Execution Contextdist/commands/deploy.js

MediumDynamic Requiredist/lib/dev-sidecar.js

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowEvaldist/lib/dev-sidecar.js

LowWeak Cryptodist/commands/dev.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

6 flagged

dist/lib/turnstile-provision.jsView file

Lines 1-21javascript

1import { execFileSync } from 'node:child_process';

2import { existsSync, readFileSync, writeFileSync } from 'node:fs';

High

Child Process

Package source references child process execution.

dist/lib/turnstile-provision.jsView on unpkg · L1

3import { join } from 'node:path';

4import chalk from 'chalk';

5import { npxCommand } from './npx.js';

6import { listWranglerSecretNames } from './wrangler-secrets.js';

7/**

8 * Provision Cloudflare Turnstile widget via Management API.

9 * If config.captcha === true: auto-create widget, store secret.

10 * If config.captcha is CaptchaConfig: use provided keys.

11 *

12 * @returns { siteKey, secretKey } or null if captcha not configured.

13 */

14export async function provisionTurnstile(captchaConfig, projectDir, _configJson, knownAccountId) {

15 if (!captchaConfig)

16 return null;

17 if (typeof captchaConfig === 'object') {

18 console.log(chalk.green('✓'), 'Captcha: using manual siteKey/secretKey');

19 return {

20 siteKey: captchaConfig.siteKey,

21 secretKey: captchaConfig.secretKey,

dist/lib/pack.jsView file

Lines 306-346javascript

306 }

307 const resolvedPath = realpathSync(libraryPath);

308 const destinationName = basename(resolvedPath);

309 if (copiedLibraries.has(destinationName))

310 continue;

311 copiedLibraries.

dist/lib/dev-sidecar.jsView file

Lines 264-304javascript

264 tokenTTL: authConfig.magicLink?.tokenTTL ?? null,

265 },

266 emailOtp: {

267 enabled: !!authConfig.emailOtp?.enabled,

268 autoCreate: authConfig.emailOtp?.autoCreate !== false,

269 },

270 passkeys

dist/commands/dev.jsView file

Lines 1-21javascript

1import { Command, CommanderError } from 'commander';

2import { spawn } from 'node:child_process';

3import { createHash, randomBytes } from 'node:crypto';

4import { createServer } from 'node:net';

5import { existsSync, watch, readFileSync, copyFileSync, unlinkSync, readdirSync, mkdirSync, promises as fsPromises, } from

dist/commands/deploy.jsView file

Lines 1-21javascript

1import { Command } from 'commander';

2import { spawn, execFileSync } from 'node:child_process';

3import { wranglerArgs, wranglerCommand, wranglerHint } from '../lib/wrangler.js';

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/commands/deploy.jsView on unpkg · L1

4import { existsSync, mkdirSync, readFileSync, writeFileSync, chmodSync, unlinkSync, } from