registry / @elytracms/cli / 0.0.7

@elytracms/cli@0.0.7

The Elytra CLI — run a consuming repo's studio, frontend, and Convex backend under one command.

Static Scan Results

scanned 3d ago · by rust-scanner

Static analysis flagged 8 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 6 file(s), 35.7 KB of source

Source & flagged code

2 flagged

src/run.jsView file

Lines 1-21javascript

1import { spawn } from 'node:child_process'

2import { stdout } from 'node:process'

High

Child Process

Package source references child process execution.

src/run.jsView on unpkg · L1

4/**

5 * Process orchestration for the Elytra CLI (EC-235). We own the lifecycle but

6 * never reimplement Vite/Next/Convex — each step shells out to the underlying

7 * tool and inherits its watch/HMR/build behaviour.

8 */

10const COLORS = ['36', '35', '33', '32', '34'] // cyan, magenta, yellow, green, blue

11const useColor = !process.env.NO_COLOR && stdout.isTTY

13function paint(text, code) {

14 return useColor ? `[${code}m${text}[0m` : text

15}

17/** Prefix every line of a child's output with its labeled, colored tag. */

18function pipePrefixed(stream, label, color) {

19 let buffer = ''

20 const tag = paint(`[${label}]`, color)

21 stream.on('data', (chunk) => {

src/cli.jsView file

Lines 111-151javascript

111 'playground or VITE_CONVEX_URL in studio/.env. See CONNECT.md.'

112 )

113 }

114 return null

115}

116

117function noteMode(project) {

118 const note = describeMode(project)

Source & flagged code

2 flagged · loading source

src/run.jsView file

1import { spawn } from 'node:child_process' L2: import { stdout } from 'node:process'

High

Child Process

Package source references child process execution.

src/run.jsView on unpkg · L1

src/cli.jsView file

131function provisionConvexOnce(studioDir) { L132: const res = spawnSync('npx', ['convex', 'dev', '--once'], { cwd: studioDir, stdio: 'inherit' }) L133: return res.status ?? 1

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/cli.jsView on unpkg · L131

Findings

3 High2 Medium3 Low

HighChild Processsrc/run.js

HighShell

HighRuntime Package Installsrc/cli.js

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

Source & flagged code

2 flagged

src/run.jsView file

Lines 1-21javascript

1import { spawn } from 'node:child_process'

2import { stdout } from 'node:process'

High

Child Process

Package source references child process execution.

src/run.jsView on unpkg · L1

4/**

5 * Process orchestration for the Elytra CLI (EC-235). We own the lifecycle but

6 * never reimplement Vite/Next/Convex — each step shells out to the underlying

7 * tool and inherits its watch/HMR/build behaviour.

8 */

10const COLORS = ['36', '35', '33', '32', '34'] // cyan, magenta, yellow, green, blue

11const useColor = !process.env.NO_COLOR && stdout.isTTY

13function paint(text, code) {

14 return useColor ? `[${code}m${text}[0m` : text

15}

17/** Prefix every line of a child's output with its labeled, colored tag. */

18function pipePrefixed(stream, label, color) {

19 let buffer = ''

20 const tag = paint(`[${label}]`, color)

21 stream.on('data', (chunk) => {

src/cli.jsView file

Lines 111-151javascript

111 'playground or VITE_CONVEX_URL in studio/.env. See CONNECT.md.'

112 )

113 }

114 return null

115}

116

117function noteMode(project) {

118 const note = describeMode(project)