registry / @effo/cli / 1.7.0

@effo/cli@1.7.0

⚠ Under review

Build Effo Apps locally — author, preview, and publish from your terminal

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

WildcardDependency

scanned 10 file(s), 234 KB of source, external domains: github.com, registry.npmjs.org

Source & flagged code

4 flagged

dist/effo.jsView file

Lines 1-29javascript

1#!/usr/bin/env bun

2import{Command as bs}from"commander";import $s from"picocolors";import{existsSync as Er,readFileSync as Tr,writeFileSync as Vn}from"node:fs";import{homedir as Wn}from"node:os";import{dirname as xr,join as L}from"node:path";import{fileURLToPath as ao}from"node:url";import{existsSync as co,mkdirSync as Gn}from"node:fs";var H=Wn(),Z=L(H,".effo");function Ie(e){return L(Z,"profiles",e)}function Ee(e){return L(Ie(e),"credentials.json")}function Ir(e){return L(Ie(e),"config.json")}var Me=L(Z,"active-profile"),rr=L(Z,"update-check.json"),or=L(H,".claude","skills"),P=L(Z,"design-system"),nr="effo-org- ...

3`,{encoding:"utf-8",mode:384})}function Yn(e){let r=Ee(e);if(Er(r))try{let{authUrl:o}=JSON.parse(Tr(r,"utf-8")),n=/^https:\/\/auth\.(.+?)\/?$/.exec(o??"")?.[1];return!n||n===oe||n.endsWith(".localhost")?void 0:n}catch{return}}function we(){let e=_r(),r=Q(e),o=(a,c,l,f)=>a?{value:a,source:"env"}:c?{value:c,source:"profile"}:l?{value:l,source:"credentials"}:{value:f,source:"default"},t=r.baseUrl===void 0?Yn(e):void 0,n=o(process.env.EFFO_BASE_URL,r.baseUrl,t,oe),s=o(process.env.EFFO_APP_BASE_URL,r.appBaseUrl,void 0,ir);return{baseUrl:n.value,appBaseUrl:s.value,sources:{baseUrl:n.source,appBaseUr ...

4`)},success(e){process.stdout.write(`${je.green("\u2713")} ${e}

5`)},warn(e){process.stderr.write(`${je.yellow("\u26A0")} ${e}

6`)},error(e,r){if(process.stderr.write(`${je.red("\u2717")} ${e}

7`),r!==void 0){let o=r instanceof Error?`${r.message}

8${r.stack??""}`:typeof r=="string"?r:JSON.stringify(r,null,2);process.stderr.write(`${je.dim(o)}

9`)}},debug(e){fo&&process.stderr.write(`${je.dim(`[debug] ${e}`)}

10`)},raw(e){process.stdout.write(e)}};import ne from"picocolors";import{existsSync as Rt}from"node:fs";import{basename as xt}from"node:path";import{existsSync as wo,mkdirSync as bo,readdirSync as $o,readFileSync as nt,writeFileSync as qe}from"node:fs";import{join as ye}from"node:path";import{spawnSync

11`,"utf-8")}import{existsSync as uo}from"node:fs";import{basename as rt,join as go}from"node:path";var cr=[{packageName:"react",vendorPath:"/effo-runtime/react.js",version:"19.2.6"},{packageName:"react/jsx-runtime",vendorPath:"/effo-runtime/react-jsx-runtime.js",version:"19.2.6"},{packageName:"react/jsx-dev-runtime",vendorPath:"/effo-runtime/react-jsx-dev-runtime.js",version:"19.2.6"},{packageName:"react-dom",vendorPath:"/effo-runtime/react-dom.js",version:"19.2.6"},{packageName:"react-dom/client",vendorPath:"/effo-runtime/react-dom-client.js",version:"19.2.6"},{packageName:"recharts",vendorPat ...

High

Child Process

Package source references child process execution.

dist/effo.jsView on unpkg · L9

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/effo.jsView on unpkg · L1

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/effo.jsView on unpkg · L1

12`,st=JSON.stringify({compilerOptions:{target:"ES2022",lib:["ES2022","DOM","DOM.Iterable"],module:"ESNext",moduleResolution:"bundler",jsx:"react-jsx",strict:!0,esModuleInterop:!0,skipLibCheck:!0,isolatedModules:!0,resolveJsonModule:!0,noEmit:!0,types:["vite/client"]},include:["src/**/*",".effo/**/*.d.ts","vite.config.ts"],exclude:["node_modules"

13`,at=`node_modules/

14dist/

15.effo/credentials.json

16.effo/cache/

17.effo/routeTree.gen.ts

18src/routeTree.gen.ts

19.claude/skills/effo-org-design-system

20.DS_Store

21`,ct="# Effo App project \u2014 conventions for coding agents\n\nThis folder is an Effo App project (`.effo/manifest.json` links it to the App\non your workspace). Rules for working here:\n\n- **Design system first.** Before writing or changing ANY interface code, read\n `.claude/skills/effo-org-design-system/SKILL.md` \u2014 your organisation's\n design system, linked into this project by `effo sync` (downloaded at\n `effo login`). Build every screen from its tokens and components; never\n invent colours, typography, or spacing. If the folder is missing, run\n `effo sync`.\n- **Commit as ...

22`,{encoding:"utf-8",mode:384})}function D(e){let r=Ee(e);if(!Ao(r))return null;try{return JSON.parse(ut(r,"utf-8"))}catch{return null}}function hr(e,r){O(Ie(e));let o=Ee(e);Ro(o,JSON.stringify(r,null,2)+`

23`,{encoding:"utf-8",mode:384});try{mt(o,384)}catch{}}function xo(e){let r=Ee(e);return Ao(r)?(gt(r),!0):!1}import{writeFileSync as Cr,readFileSync as Uo,readdirSync as wt,rmSync as Ur,existsSync as Or,mkdirSync as yt,lstatSync as bt,readlinkSync as $t,symlinkSync as kt,statSync as vt}from"node:fs";import{join as We,dirname as Co}from"node:path";import{unzipSync as St}from"fflate";import wr from"picocolors";var de=class extends Error{constructor(o,t,n){let s=typeof n=="string"?n:n===void 0?"":JSON.stringify(n);super(`HTTP ${o} from ${t}${s?`: ${s.slice(0,256)}`:""}`);this.status=o;this.url=t;th ...

24`)?"":`

25`)+o+`

26`)}catch{}}function Po(e){e.command("init [name]").description("Scaffold a new Effo App project in the current directory. Pass [name] to override the package.json name (defaults to the directory name).").option("--app <appId>","link to an existing remote App").option("--template <name>","starter template","blank").option("--force","overwrite if conflicting files already exist").option("--no-install","skip installing dependencies after scaffolding").action(async(

27`)});u>0&&process.stderr.write(`

28`);let w=null;try{w=await k(`${s.authUrl}/api/auth/get-session`,{bearer:p.access_token})}catch{}let h=w?.user?.email??null,d=w?.user?.id??null,C=w?.session?.activeOrganizationId??r.org??null;hr(o,{clientId:c.client_id,clientSecret:c.client_secret,sessionToken:p.access_token,authUrl:s.authUrl,userEmail:h,userId:d,organizationId:C,issuedAt:new Date().toISOString()}),mr(o);let x=(process.env.EFFO_ENV??"").toLowerCase()==="dev",G=n.sources.baseUrl!=="default"||n.sources.appBaseUrl!=="default";!x&&G&&(sr(o,{...t,baseUrl:n.baseUrl,appBaseUrl:n.appBaseUrl}),i.info(te.dim(`Pinned tenant for profile "$ ...

29globalThis.__EFFO_RUNTIME__ = { assetBase: "", versionId: null };

Long lines were clipped for display.

•matchType = previous_version_dangerous_delta matchedPackage = @effo/cli@1.2.0 matchedIdentity = npm:QGVmZm8vY2xp:1.2.0 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/effo.jsView on unpkg

Source & flagged code

4 flagged · loading source

dist/effo.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/effo.jsView on unpkg

9`)}},debug(e){fo&&process.stderr.write(`${je.dim(`[debug] ${e}`)} L10: `)},raw(e){process.stdout.write(e)}};import ne from"picocolors";import{existsSync as Rt}from"node:fs";import{basename as xt}from"node:path";import{existsSync as wo,mkdirSync as bo,... L11: `,"utf-8")}import{existsSync as uo}from"node:fs";import{basename as rt,join as go}from"node:path";var cr=[{packageName:"react",vendorPath:"/effo-runtime/react.js",version:"19.2.6"}...

High

Child Process

Package source references child process execution.

dist/effo.jsView on unpkg · L9

1#!/usr/bin/env bun L2: import{Command as bs}from"commander";import $s from"picocolors";import{existsSync as Er,readFileSync as Tr,writeFileSync as Vn}from"node:fs";import{homedir as Wn}from"node:os";impo... L3: `,{encoding:"utf-8",mode:384})}function Yn(e){let r=Ee(e);if(Er(r))try{let{authUrl:o}=JSON.parse(Tr(r,"utf-8")),n=/^https:\/\/auth\.(.+?)\/?$/.exec(o??"")?.[1];return!n||n===oe||n.... ... L9: `)}},debug(e){fo&&process.stderr.write(`${je.dim(`[debug] ${e}`)} L10: `)},raw(e){process.stdout.write(e)}};import ne from"picocolors";import{existsSync as Rt}from"node:fs";import{basename as xt}from"node:path";import{existsSync as wo,mkdirSync as bo,... L11: `,"utf-8")}import{existsSync as uo}from"node:fs";import{basename as rt,join as go}from"node:path";var cr=[{packageName:"react",vendorPath:"/effo-runtime/react.js",version:"19.2.6"}...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/effo.jsView on unpkg · L1

1#!/usr/bin/env bun L2: import{Command as bs}from"commander";import $s from"picocolors";import{existsSync as Er,readFileSync as Tr,writeFileSync as Vn}from"node:fs";import{homedir as Wn}from"node:os";impo... L3: `,{encoding:"utf-8",mode:384})}function Yn(e){let r=Ee(e);if(Er(r))try{let{authUrl:o}=JSON.parse(Tr(r,"utf-8")),n=/^https:\/\/auth\.(.+?)\/?$/.exec(o??"")?.[1];return!n||n===oe||n.... L4: `)},success(e){process.stdout.write(`${je.green("\u2713")} ${e} ... L9: `)}},debug(e){fo&&process.stderr.write(`${je.dim(`[debug] ${e}`)} L10: `)},raw(e){process.stdout.write(e)}};import ne from"picocolors";import{existsSync as Rt}from"node:fs";import{basename as xt}from"node:path";import{existsSync as wo,mkdirSync as bo,... L11: `,"utf-8")}import{existsSync as uo}from"node:fs";import{basename as rt,join as go}from"node:path";var cr=[{packageName:"react",vendorPath:"/effo-runtime/react.js",version:"19.2.6"}...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/effo.jsView on unpkg · L1

Findings

1 Critical3 High4 Medium5 Low

CriticalPrevious Version Dangerous Deltadist/effo.js

HighChild Processdist/effo.js

HighSame File Env Network Executiondist/effo.js

HighCommand Output Exfiltrationdist/effo.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumWildcard Dependency

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

dist/effo.jsView file

Lines 1-29javascript

1#!/usr/bin/env bun

4`)},success(e){process.stdout.write(`${je.green("\u2713")} ${e}

5`)},warn(e){process.stderr.write(`${je.yellow("\u26A0")} ${e}

6`)},error(e,r){if(process.stderr.write(`${je.red("\u2717")} ${e}

7`),r!==void 0){let o=r instanceof Error?`${r.message}

8${r.stack??""}`:typeof r=="string"?r:JSON.stringify(r,null,2);process.stderr.write(`${je.dim(o)}

9`)}},debug(e){fo&&process.stderr.write(`${je.dim(`[debug] ${e}`)}

High

Child Process

Package source references child process execution.

dist/effo.jsView on unpkg · L9

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/effo.jsView on unpkg · L1

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/effo.jsView on unpkg · L1

13`,at=`node_modules/

14dist/

15.effo/credentials.json

16.effo/cache/

17.effo/routeTree.gen.ts

18src/routeTree.gen.ts

19.claude/skills/effo-org-design-system

20.DS_Store

24`)?"":`

25`)+o+`

27`)});u>0&&process.stderr.write(`

29globalThis.__EFFO_RUNTIME__ = { assetBase: "", versionId: null };

Long lines were clipped for display.

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/effo.jsView on unpkg