registry  /  @elaraai/create-e3  /  1.0.29

@elaraai/create-e3@1.0.29

Scaffold a new e3 project (BSL-1.1, Node + Python, durable execution): npm create @elaraai/e3

Static Scan Results

scanned 2d ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessFilesystemShell
Supply chain
UrlStrings
ManifestNo manifest risk signals triggered.
scanned 14 file(s), 27.4 KB of source, external domains: docs.astral.sh

Source & flagged code

5 flagged · loading source
dist/index.jsView file
5import { join, relative } from "node:path"; L6: import { spawnSync } from "node:child_process"; L7:
High
Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L5
5import { join, relative } from "node:path"; L6: import { spawnSync } from "node:child_process"; L7: ... L58: function transformPackageJson(raw, names, version, manifest, enabled) { L59: const pkg = JSON.parse(raw); L60: pkg.name = `@elaraai/${names.projectName}`; ... L62: pkg.version = "0.0.1"; L63: delete pkg.private; L64: if (manifest) { ... L126: const { kind, name, templateDir, version } = options; L127: const cwd = options.cwd ?? process.cwd(); L128: const log = options.log ?? ((m) => console.log(m));
High
Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L5
201const probe = process.platform === "win32" ? "where" : "which"; L202: return spawnSync(probe, [cmd], { stdio: "ignore" }).status === 0; L203: } ... L207: if (npm.status !== 0) { L208: log("npm install failed \u2014 fix the issue and re-run `npm install`."); L209: return;
High
Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L201
templates/e3/tests/test_unit.pyView file
•path = templates/e3/tests/test_unit.py kind = payload_in_excluded_dir sizeBytes = 3083 magicHex = [redacted]
High
Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

templates/e3/tests/test_unit.pyView on unpkg
•path = templates/e3/tests/test_unit.py kind = build_helper sizeBytes = 3083 magicHex = [redacted]
Medium
Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/e3/tests/test_unit.pyView on unpkg

Findings

5 High2 Medium3 Low
HighChild Processdist/index.js
HighShell
HighSandbox Evasion Gated Capabilitydist/index.js
HighRuntime Package Installdist/index.js
HighPayload In Excluded Dirtemplates/e3/tests/test_unit.py
MediumShips Build Helpertemplates/e3/tests/test_unit.py
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowUrl Strings