registry / @elytracms/cli / 0.0.12

@elytracms/cli@0.0.12

The Elytra CLI — run a consuming repo's studio, frontend, and Convex backend under one command.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 8 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 6 file(s), 46.3 KB of source

Source & flagged code

2 flagged

src/run.jsView file

Lines 1-21javascript

1import { spawn } from 'node:child_process'

2import { stdout } from 'node:process'

High

Child Process

Package source references child process execution.

src/run.jsView on unpkg · L1

4/**

5 * Process orchestration for the Elytra CLI (EC-235). We own the lifecycle but

6 * never reimplement Vite/Next/Convex — each step shells out to the underlying

7 * tool and inherits its watch/HMR/build behaviour.

8 */

10const COLORS = ['36', '35', '33', '32', '34'] // cyan, magenta, yellow, green, blue

11const useColor = !process.env.NO_COLOR && stdout.isTTY

13function paint(text, code) {

14 return useColor ? `[${code}m${text}[0m` : text

15}

17/** Prefix every line of a child's output with its labeled, colored tag. */

18function pipePrefixed(stream, label, color) {

19 let buffer = ''

20 const tag = paint(`[${label}]`, color)

21 stream.on('data', (chunk) => {

src/doctor.jsView file

Lines 107-147javascript

107 */

108export function parseEnvListNames(stdout) {

109 const names = []

110 for (const line of String(stdout).split('\n')) {

Source & flagged code

2 flagged · loading source

src/run.jsView file

1import { spawn } from 'node:child_process' L2: import { stdout } from 'node:process'

High

Child Process

Package source references child process execution.

src/run.jsView on unpkg · L1

src/doctor.jsView file

127/** L128: * Enumerate the linked deployment's set env-var NAMES via `npx convex env list` L129: * (read-only; the convex CLI resolves the deployment from `studio/.env.local` / ... L133: export function gatherDeploymentEnvNames({ cwd, exec = defaultConvexExec } = {}) { L134: const { status, stdout, stderr, error } = exec(['env', 'list'], { cwd }) L135: if (status !== 0) {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/doctor.jsView on unpkg · L127

Findings

3 High2 Medium3 Low

HighChild Processsrc/run.js

HighShell

HighRuntime Package Installsrc/doctor.js

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

Source & flagged code

2 flagged

src/run.jsView file

Lines 1-21javascript

1import { spawn } from 'node:child_process'

2import { stdout } from 'node:process'

High

Child Process

Package source references child process execution.

src/run.jsView on unpkg · L1

4/**

5 * Process orchestration for the Elytra CLI (EC-235). We own the lifecycle but

6 * never reimplement Vite/Next/Convex — each step shells out to the underlying

7 * tool and inherits its watch/HMR/build behaviour.

8 */

10const COLORS = ['36', '35', '33', '32', '34'] // cyan, magenta, yellow, green, blue

11const useColor = !process.env.NO_COLOR && stdout.isTTY

13function paint(text, code) {

14 return useColor ? `[${code}m${text}[0m` : text

15}

17/** Prefix every line of a child's output with its labeled, colored tag. */

18function pipePrefixed(stream, label, color) {

19 let buffer = ''

20 const tag = paint(`[${label}]`, color)

21 stream.on('data', (chunk) => {

src/doctor.jsView file

Lines 107-147javascript

107 */

108export function parseEnvListNames(stdout) {

109 const names = []

110 for (const line of String(stdout).split('\n')) {