registry / @edge-base/cli / 0.4.2

@edge-base/cli@0.4.2

⚠ Under review

CLI for EdgeBase — create, develop, and deploy EdgeBase projects

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 63 file(s), 914 KB of source, external domains: 127.0.0.1, api.cloudflare.com, app.example.com, docs.docker.com, edgebase.fun, www.apple.com

Source & flagged code

7 flagged

dist/lib/node-tools.jsView file

Lines 1-21javascript

1import { execFileSync } from 'node:child_process';

2import { createRequire } from 'node:module';

High

Child Process

Package source references child process execution.

dist/lib/node-tools.jsView on unpkg · L1

3import { buildSync } from 'esbuild';

4import { npxCommand }

Source & flagged code

7 flagged · loading source

dist/lib/node-tools.jsView file

1import { execFileSync } from 'node:child_process'; L2: import { createRequire } from 'node:module';

High

Child Process

Package source references child process execution.

dist/lib/node-tools.jsView on unpkg · L1

dist/lib/pack.jsView file

439if (process.platform === 'win32') { L440: execFileSync('powershell', [ L441: '-NoProfile',

High

Shell

Package source references shell execution.

dist/lib/pack.jsView on unpkg · L439

dist/lib/dev-sidecar.jsView file

284if (!pgModulePromise) { L285: const dynamicImport = new Function('specifier', 'return import(specifier)'); L286: pgModulePromise = dynamicImport('pg').then((mod) => mod);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/lib/dev-sidecar.jsView on unpkg · L284

284if (!pgModulePromise) { L285: const dynamicImport = new Function('specifier', 'return import(specifier)'); L286: pgModulePromise = dynamicImport('pg').then((mod) => mod);

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/lib/dev-sidecar.jsView on unpkg · L284

dist/commands/dev.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @edge-base/cli@0.3.3 matchedIdentity = npm:QGVkZ2UtYmFzZS9jbGk:0.3.3 similarity = 0.677 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/commands/dev.jsView on unpkg

1import { Command, CommanderError } from 'commander'; L2: import { spawn } from 'node:child_process'; L3: import { createHash, randomBytes } from 'node:crypto'; L4: import { createServer } from 'node:net'; L5: import { chmodSync, existsSync, watch, readFileSync, copyFileSync, unlinkSync, readdirSync, mkdirSync, renameSync, writeFileSync, promises as fsPromises, } from 'node:fs'; ... L32: const PORT_RESERVATION_STALE_GRACE_MS = 10_000; L33: const MAX_RECENT_WRANGLER_STDERR_LINES = 12; L34: const WRANGLER_EXIT_GRACE_MS = 2_500; ... L39: const LOCAL_DEV_BUILD_DEFINE = `${LOCAL_DEV_BUILD_MARKER}:true`; L40: const PORT_RESERVATION_DIR = process.env.EDGEBASE_DEV_PORT_RESERVATION_DIR L41: ? resolve(process.env.EDGEBASE_DEV_PORT_RESERVATION_DIR) ... L72: });

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/commands/dev.jsView on unpkg · L1

dist/commands/deploy.jsView file

1Cross-file remote execution chain: dist/commands/deploy.js spawns dist/lib/dev-sidecar.js; helper contains network access plus dynamic code execution. L1: import { Command } from 'commander'; L2: import { spawn, execFileSync } from 'node:child_process'; L3: import { wranglerArgs, wranglerCommand, wranglerHint } from '../lib/wrangler.js'; ... L33: const RELEASE_ENV_HEADER = '# EdgeBase production secrets'; L34: const ANSI_ESCAPE_REGEX = new RegExp(`${String.fromCharCode(27)}\\[[0-9;]*[a-zA-Z]`, 'g'); L35: const DEPLOY_SUBPROCESS_TIMEOUT_MS = 10 * 60 * 1000; ... L90: const record = error; L91: return [record.message, record.stdout, record.stderr] L92: .map((value) => Buffer.isBuffer(value) ? value.toString('utf8') : String(value ?? '')) ... L351: try { L352: const response = await fetch(workerUrl, { L353: redirect: 'manual',

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/commands/deploy.jsView on unpkg · L1

Findings

1 Critical3 High3 Medium6 Low

CriticalPrevious Version Dangerous Deltadist/commands/dev.js

HighChild Processdist/lib/node-tools.js

HighShelldist/lib/pack.js

HighCross File Remote Execution Contextdist/commands/deploy.js

MediumDynamic Requiredist/lib/dev-sidecar.js

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowEvaldist/lib/dev-sidecar.js

LowWeak Cryptodist/commands/dev.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

dist/lib/pack.jsView file

Lines 419-459javascript

419 const resolvedPath = realpathSync(libraryPath);

420 const destinationName = basename(resolvedPath);

421 if (copiedLibraries.has(destinationName))

422 continue;

423 copiedLibraries.add(destinationName);

424 copyFileSync(resolvedPath, join(portableLibDir, destinationName));

425 }

426 }

427}

428export function createArchiveFromPortableArtifact(sourcePath, archivePath) {

429 assertArtifactSymlinksContained(sourcePath);

430 rmSync(archivePath, { force: true, recursive: true });

431 mkdirSync(dirname(archivePath), { recursive: true });

432 if (process.platform === 'darwin') {

433 execFileSync('ditto', ['-c', '-k', '--keepParent', basename(sourcePath), archivePath], {

434 cwd: dirname(sourcePath),

435 stdio: 'pipe',

436 });

437 return 'zip';

438 }

439 if (process.platform === 'win32') {

440 execFileSync('powershell', [

441 '-NoProfile',

High

Shell

Package source references shell execution.

dist/lib/pack.jsView on unpkg · L439

442 '-Command',

443 `Compress-Archive -Path '${sourcePath.replace(/'/g, "''")}' -DestinationPath '${archivePath.replace(/'/g, "''")}' -Force`,

444 ], {

445 stdio: 'pipe',

446 });

447 return 'zip';

448 }

449 execFileSync('tar', ['-czf', archivePath, '-C', dirname(sourcePath), basename(sourcePath)], {

450 stdio: 'pipe',

451 });

452 return 'tar.gz';

453}

454function finalizePackWrangler(projectDir, outputDir) {

455 const configFile = EDGEBASE_CONFIG_FILES

456 .map((name) => join(projectDir, name))

457 .find((path) => existsSync(path));

458 if (!configFile) {

459 throw new Error(`No EdgeBase config file found in ${projectDir}.`);

dist/lib/dev-sidecar.jsView file

Lines 264-304javascript

264 tokenTTL: authConfig.magicLink?.tokenTTL ?? null,

265 },

266 emailOtp: {

267 enabled: !!authConfig.emailOtp?.enabled,

268 autoCreate: authConfig.emailOtp?.autoCreate !== false,

269 },

270 passkeys: {

271 enabled: !!authConfig.passkeys?.enabled,

272 rpName: authConfig.passkeys?.rpName ?? null,

273 rpID: authConfig.passkeys?.rpID ?? null,

274 origin: Array.isArray(authConfig.passkeys?.origin)

275 ? authConfig.passkeys.origin

276 : authConfig.passkeys?.origin

277 ? [authConfig.passkeys.origin]

278 : [],

279 },

280 oauth: oauthEntries,

281 };

282}

283async function loadPgModule() {

284 if (!pgModulePromise) {

285 const dynamicImport = new Function('specifier', 'return import(specifier)');

286 pgModulePromise = dynamicImport('pg').then((mod) => mod);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/lib/dev-sidecar.jsView on unpkg · L284

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/lib/dev-sidecar.jsView on unpkg · L284

287 }

288 return pgModulePromise;

289}

290async function loadPgSchemaInitModule(opts) {

291 if (!pgSchemaInitModulePromise) {

292 const dynamicImport = new Function('specifier', 'return import(specifier)');

293 const moduleUrl = pathToFileURL(resolve(opts.projectDir, 'packages/server/src/lib/postgres-schema-init.ts')).href;

294 pgSchemaInitModulePromise = dynamicImport(moduleUrl).then((mod) => mod);

295 }

296 return pgSchemaInitModulePromise;

297}

298async function getSidecarPostgresPool(connectionString) {

299 let pool = postgresPoolCache.get(connectionString);

300 if (!pool) {

301 const { Pool } = await loadPgModule();

302 pool = new Pool({

303 connectionString,

304 max: 8,

dist/commands/dev.jsView file

Lines 1-21javascript

1import { Command, CommanderError } from 'commander';

2import { spawn } from 'node:child_process';

3import { createHash, randomBytes } from 'node:crypto';

4import { createServer } from 'node:net';

5import { chmodSync, existsSync, watch, readFileSync, copyFileSync, unlinkSync, readdirSync, mkdirSync, renameSync, writeFileSync, promises as fsPromises, } from 'node:fs';

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/commands/dev.jsView on unpkg · L1

6import { tmpdir } from 'node:os';

7import { dirname, relative, resolve, join } from 'node:path';

8import chalk from 'chalk';

9import { loadConfigSafe } from '../lib/load-config.js';

10import { checkWranglerAuth } from '../lib/cf-auth.js';

11import { parseDevVars } from '../lib/dev-sidecar.js';

12import { upsertEnvFile, writeLocalSecrets } from '../lib/local-secrets.js';

13import { resolveWranglerCommand, } from '../lib/runtime-scaffold.js';

14import { resolveLocalDevBindings } from '../lib/project-runtime.js';

15import { generateFunctionRegistry, scanFunctions, validateRouteNames, } from '../lib/function-registry.js';

16import { extractDatabases, generateTempWranglerToml, RUNTIME_PROCESS_ENV_COMPATIBILITY_FLAGS, } from '../lib/deploy-shared.js';

17import { buildSnapshot, loadSnapshot, detectDestructiveChanges, filterAutoPassChanges, handleDestructiveChanges, resetLocalDoState, saveSnapshot, detectProviderChanges, detectAuthProviderChange, } from '../lib/schema-check.js';

18import { dumpCurrentData, restoreToNewProvider, promptMigration, } from '../lib/migrator.js';

19import { isCliStructuredError, raiseCliError } from '../lib/agent-contract.js';

20import { isNonInteractive } from '../lib/cli-context.js';

21import { createAppBundle, syncAppBundle } from '../lib/app-bundle.js';

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/commands/dev.jsView on unpkg

dist/commands/deploy.jsView file

Lines 1-21javascript

1import { Command } from 'commander';

2import { spawn, execFileSync } from 'node:child_process';

3import { wranglerArgs, wranglerCommand, wranglerHint } from '../lib/wrangler.js';

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/commands/deploy.jsView on unpkg · L1

4import { existsSync, mkdirSync, readFileSync, writeFileSync, chmodSync, closeSync, constants as fsConstants, fchmodSync, fstatSync, fsyncSync, lstatSync, openSync, readdirSync, renameSync, statSync, unlinkSync, } from 'node:fs';

5import { resolve, join, basename } from 'node:path';

6import { randomBytes } from 'node:crypto';

7import chalk from 'chalk';

8import { loadConfigSafe } from '../lib/load-config.js';

9import { resolveRateLimitBindings } from '../lib/rate-limit-bindings.js';

10import { buildRouteName, detectExports, generateFunctionRegistry, scanFunctions, validateRouteNames, } from '../lib/function-registry.js';

11import { extractDatabases, generateTempWranglerToml, isSafeWorkerBindingName, mergePluginTables, RUNTIME_PROCESS_ENV_COMPATIBILITY_FLAGS, } from '../lib/deploy-shared.js';

12import { buildSnapshot, loadSnapshot, saveSnapshot, detectDestructiveChanges, filterAutoPassChanges, handleDestructiveChanges, resetLocalDoState, detectProviderChanges, detectAuthProviderChange, } from '../lib/schema-check.js';

13import { dumpCurrentData, restoreToNewProvider, promptMigration, } from '../lib/migrator.js';

14import { isCliStructuredError, raiseCliError, raiseNeedsInput } from '../lib/agent-contract.js';

15import { resolveOptionalServiceKey, resolveServiceKey as resolveServiceKeyFromOptions, } from '../lib/resolve-options.js';

16import { parseDevVars, parseEnvFile } from '../lib/dev-sidecar.js';

17import { ensureCloudflareAuth, ensureWranglerToml, resolveApiToken } from '../lib/cf-auth.js';

18import { spin } from '../lib/spinner.js';

19import { isJson, isNonInteractive, isQuiet } from '../lib/cli-context.js';

20import { promptConfirm } from '../lib/prompts.js';

21import { cleanupLegacyTurnstileWidgets, finalizeTurnstileProvision, injectCaptchaSiteKey, provisionTurnstile, } from '../lib/turnstile-provision.js';