registry / @explorer02/cfm-survey-sdk / 0.2.4

@explorer02/cfm-survey-sdk@0.2.4

⚠ Under review

Static Scan Results

scanned 1d ago · by rust-scanner

Static analysis flagged 18 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

Manifest

NoLicense

scanned 37 file(s), 757 KB of source, external domains: 43.204.26.213, custom-p0.feedbook.me, example.com, nodejs.org, placehold.co, raw.githubusercontent.com, react.dev, www.aprimo.com, www.w3.org

Source & flagged code

9 flagged

package.jsonView file

Lines 1-40json

2 "name": "@explorer02/cfm-survey-sdk",

3 "version": "0.2.4",

4 "main": "dist/index.js",

5 "module": "dist/index.mjs",

6 "types": "dist/index.d.ts",

7 "bin": {

8 "cfm-sdk": "./dist/cli/index.js"

9 },

10 "files": [

11 "dist",

12 "templates",

13 "postinstall.js"

14 ],

15 "scripts": {

16 "build": "tsup",

17 "build:wizard": "npm run build --workspace=@repo/survey-wizard",

18 "build:all": "npm run build:wizard && npm run build",

19 "lint": "tsc --noEmit",

20 "postinstall": "node postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L20

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L20

21 "test": "vitest run",

22 "test:watch": "vitest",

23 "test:coverage": "vitest run --coverage",

24 "docs:sync-manifest": "npx tsx scripts/generate-doc-manifest.ts"

25 },

26 "peerDependencies": {

27 "react": ">=17.0.0"

28 },

29 "devDependencies": {

30 "@tailwindcss/vite": "^4.3.0",

31 "@testing-library/jest-dom": "^6.4.2",

32 "@testing-library/react": "^14.2.1",

33 "@testing-library/user-event": "^14.5.2",

34 "@vitejs/plugin-react": "^4.5.2",

35 "@vitest/coverage-v8": "^1.3.1",

36 "@types/react": "^17.0.0",

37 "@tanstack/react-query": "^5.0.0",

38 "jsdom": "^24.0.0",

39 "react": "^19.1.0",

40 "react-dom": "^19.1.0",

dist/cli/index.jsView file

Lines 1-25javascript

1#!/usr/bin/env node

2"use strict";var _o=Object.create;var Ie=Object.defineProperty;var Do=Object.getOwnPropertyDescriptor;var Oo=Object.getOwnPropertyNames;var Lo=Object.getPrototypeOf,Mo=Object.prototype.hasOwnProperty;var W=(e,o)=>

dist/index.jsView file

Lines 1-2javascript

1"use strict";var kt=Object.defineProperty;var qo=Object.getOwnPropertyDescriptor;var Bo=Object.getOwnPropertyNames;var Ho=Object.prototype.hasOwnProperty;var Xo=(e,t)=>{for(var r in t)kt(e,r,{get:t[r],enumerable:!

templates/docs/templates/verify-agent-build.shView file

•path = templates/docs/templates/verify-agent-build.sh kind = build_helper sizeBytes = 7848 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/docs/templates/verify-agent-build.shView on unpkg

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/cli/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @explorer02/cfm-survey-sdk@0.2.3 matchedIdentity = npm:[redacted]:0.2.3 similarity = 0.545 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli/index.jsView on unpkg

5`),console.log(Te(s)),e.diffOnly){H.writeFileSync(t.diffJsonPath,JSON.stringify(s,null,2),"utf8"),H.writeFileSync(t.diffMdPath,Te(s),"utf8"),console.log(`${z.dim} Updated ${t.dif... L6: ${M.green}\u2705 Fetched final config (review mode)${M.reset}`),console.log(`${M.green} Final: ${r.finalPath}${M.reset}`),console.log(`${M.green} Diff: ${r.diffMdPath}${M.rese... L7: `);let o=await oe("Would you like to install/upgrade Node.js v18+ automatically? (y/N): ");o.toLowerCase()==="y"||o.toLowerCase()==="yes"||(console.log(`

High

Child Process

Package source references child process execution.

dist/cli/index.jsView on unpkg · L5

1#!/usr/bin/env node L2: "use strict";var _o=Object.create;var Ie=Object.defineProperty;var Do=Object.getOwnPropertyDescriptor;var Oo=Object.getOwnPropertyNames;var Lo=Object.getPrototypeOf,Mo=Object.proto... L3: `)}function K(e){return{seedPath:le.join(e,"survey-ui-config.seed.json"),finalPath:le.join(e,"survey-ui-config.final.json"),diffJsonPath:le.join(e,"survey-ui-config.diff.json"),dif... L4: ${z.bold}${z.cyan}\u{1F4CB} UI config review${z.reset} L5: `),console.log(Te(s)),e.diffOnly){H.writeFileSync(t.diffJsonPath,JSON.stringify(s,null,2),"utf8"),H.writeFileSync(t.diffMdPath,Te(s),"utf8"),console.log(`${z.dim} Updated ${t.dif... L6: ${M.green}\u2705 Fetched final config (review mode)${M.reset}`),console.log(`${M.green} Final: ${r.finalPath}${M.reset}`),console.log(`${M.green} Diff: ${r.diffMdPath}${M.rese... L7: `);let o=await oe("Would you like to install/upgrade Node.js v18+ automatically? (y/N): ");o.toLowerCase()==="y"||o.toLowerCase()==="yes"||(console.log(`

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli/index.jsView on unpkg · L1

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/cli/index.jsView on unpkg · L1

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli/index.jsView on unpkg · L5

dist/index.jsView file

1"use strict";var kt=Object.defineProperty;var qo=Object.getOwnPropertyDescriptor;var Bo=Object.getOwnPropertyNames;var Ho=Object.prototype.hasOwnProperty;var Xo=(e,t)=>{for(var r i...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L1

templates/docs/templates/verify-agent-build.shView file

•path = templates/docs/templates/verify-agent-build.sh kind = build_helper sizeBytes = 7848 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/docs/templates/verify-agent-build.shView on unpkg

Findings

1 Critical5 High6 Medium6 Low

CriticalPrevious Version Dangerous Deltadist/cli/index.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/cli/index.js

HighSame File Env Network Executiondist/cli/index.js

HighCommand Output Exfiltrationdist/cli/index.js

HighRuntime Package Installdist/cli/index.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requiredist/index.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helpertemplates/docs/templates/verify-agent-build.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

9 flagged

package.jsonView file

Lines 1-40json

2 "name": "@explorer02/cfm-survey-sdk",

3 "version": "0.2.4",

4 "main": "dist/index.js",

5 "module": "dist/index.mjs",

6 "types": "dist/index.d.ts",

7 "bin": {

8 "cfm-sdk": "./dist/cli/index.js"

9 },

10 "files": [

11 "dist",

12 "templates",

13 "postinstall.js"

14 ],

15 "scripts": {

16 "build": "tsup",

17 "build:wizard": "npm run build --workspace=@repo/survey-wizard",

18 "build:all": "npm run build:wizard && npm run build",

19 "lint": "tsc --noEmit",

20 "postinstall": "node postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L20

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L20

21 "test": "vitest run",

22 "test:watch": "vitest",

23 "test:coverage": "vitest run --coverage",

24 "docs:sync-manifest": "npx tsx scripts/generate-doc-manifest.ts"

25 },

26 "peerDependencies": {

27 "react": ">=17.0.0"

28 },

29 "devDependencies": {

30 "@tailwindcss/vite": "^4.3.0",

31 "@testing-library/jest-dom": "^6.4.2",

32 "@testing-library/react": "^14.2.1",

33 "@testing-library/user-event": "^14.5.2",

34 "@vitejs/plugin-react": "^4.5.2",

35 "@vitest/coverage-v8": "^1.3.1",

36 "@types/react": "^17.0.0",

37 "@tanstack/react-query": "^5.0.0",

38 "jsdom": "^24.0.0",

39 "react": "^19.1.0",

40 "react-dom": "^19.1.0",

dist/cli/index.jsView file

Lines 1-25javascript

1#!/usr/bin/env node

dist/index.jsView file

Lines 1-2javascript

templates/docs/templates/verify-agent-build.shView file

•path = templates/docs/templates/verify-agent-build.sh kind = build_helper sizeBytes = 7848 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/docs/templates/verify-agent-build.shView on unpkg