registry / @explorer02/cfm-survey-sdk / 0.9.15

@explorer02/cfm-survey-sdk@0.9.15

Headless React SDK for custom survey UIs. Matches CFM respondent-view behavior (navigation, logic, validation, progress, submission); you own all presentation.

AI Security Review

scanned 3h ago · by lpm-firewall-ai

LPM blocks this version under the AI-agent control-surface policy. Installation mutates the consuming project's AI-agent instruction files without user consent. Default detection writes files for all supported agent targets.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm install of the package as a dependency inside node_modules

Impact

Hijacks or alters Codex, Claude Code, and Cursor instruction surfaces so future agent sessions follow package-supplied guidance.

Mechanism

postinstall writes AI-agent control stubs into the consumer project root

Policy narrative

On dependency installation, the postinstall script identifies the consumer project root via INIT_CWD and detects AI-agent environment variables. If no agent signal exists, it defaults to all targets and creates or merges package-authored instructions into AGENTS.md, CLAUDE.md, and .cursorrules. Those files direct future coding agents to read the installed package's operating contract before making code changes, modifying a broad foreign AI-agent control surface without an explicit user command.

Rationale

This is a concrete, unconsented postinstall mutation of a consuming project's AI-agent control files. The behavior meets the blocking policy regardless of the absence of credential exfiltration.

Evidence

package.jsonpostinstall.jspostinstall/detect-agent.jspostinstall/agent-stubs.jstemplates/AGENT.mdAGENTS.mdCLAUDE.md.cursorrules

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for policy block

`package.json` runs `node postinstall.js` on installation.
`postinstall.js` targets `INIT_CWD` or the consumer project root.
`postinstall/detect-agent.js` defaults to `all` when no agent is detected.
`postinstall.js` writes project-root `AGENTS.md`, `CLAUDE.md`, and `.cursorrules`.
`postinstall/agent-stubs.js` injects instructions directing AI agents to package-controlled documentation.

Evidence against

No credential harvesting, exfiltration, or network request was found in the inspected postinstall path.
CLI shell/package-manager actions are user-invoked commands, not triggered by installation.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

NoLicense

scanned 7 file(s), 469 KB of source, external domains: custom-p0.feedbook.me, distribution-dashboard-three.vercel.app, nodejs.org, raw.githubusercontent.com

Source & flagged code

12 flagged

package.jsonView file

Lines 11-51json

11 "require": "./dist/index.js"

12 }

13 },

14 "bin": {

15 "cfm-sdk": "./dist/cli/index.js"

16 },

17 "files": [

18 "dist",

19 "templates",

20 "postinstall.js",

21 "postinstall"

22 ],

23 "scripts": {

24 "build": "tsup",

25 "build:all": "npm run build",

26 "prepare": "npm run build",

27 "lint": "npm run lint:types && npm run lint:eslint",

28 "lint:types": "tsc --noEmit -p tsconfig.lint.json",

29 "lint:eslint": "eslint src",

30 "lint:fix": "eslint src --fix",

31 "postinstall": "node postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L31

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L31

32 "test": "vitest run",

33 "test:watch": "vitest",

34 "test:coverage": "vitest run --coverage",

35 "docs:sync-manifest": "npx tsx scripts/generate-doc-manifest.ts",

36 "split-survey-ui-config": "npx tsx scripts/split-survey-ui-config.ts",

37 "merge-survey-ui-config": "npx tsx scripts/merge-survey-ui-config.ts",

38 "lint:agent-docs": "bash scripts/lint-agent-docs.sh",

39 "sync-agent-stubs": "node scripts/sync-monorepo-agent-stubs.js",

40 "prepublish:check": "npm run build && npm run test && npm run test:coverage && npm run lint && npm run lint:agent-docs && npm run docs:sync-manifest"

41 },

42 "peerDependencies": {

43 "@tanstack/react-query": "^5.0.0",

44 "react": ">=17.0.0"

45 },

46 "devDependencies": {

47 "@tanstack/react-query": "^5.0.0",

48 "@testing-library/jest-dom": "^6.4.2",

49 "@testing-library/react": "^14.2.1",

50 "@testing-library/user-event": "^14.5.2",

51 "@types/react": "^17.0.0",

dist/cli/index.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2"use strict";var ai=Object.create;var an=Object.defineProperty;var li=Object.getOwnPropertyDescriptor;var ci=Object.getOwnPropertyNames;var ui=Object.getPrototypeOf,pi=Object.prototype.hasOwnProperty;var d=(e,t)=>

postinstall.jsView file

Lines 4-44javascript

4const {

5 NPM_AGENT_PATH,

6 getAgentsMdStub,

7 getCursorRulesStub,

8 getClaudeMdStub,

9 mergeMarkedBlock,

10 canUpdateClaudeMd,

11} = require('./postinstall/agent-stubs'

templates/docs/survey-ui/verify-agent-build.shView file

•path = templates/docs/survey-ui/verify-agent-build.sh kind = build_helper sizeBytes = 12551 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/docs/survey-ui/verify-agent-build.shView on unpkg

dist/cli/index.mjsView file

•matchType = normalized_sha256 matchedPackage = @explorer02/cfm-survey-sdk@0.9.14 matchedPath = dist/cli/index.mjs matchedIdentity = npm:[redacted]:0.9.14 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/index.mjsView on unpkg

dist/index.jsView file

•matchType = normalized_sha256 matchedPackage = @explorer02/cfm-survey-sdk@0.9.14 matchedPath = dist/index.js matchedIdentity = npm:[redacted]:0.9.14 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index.jsView on unpkg

Source & flagged code

12 flagged · loading source

package.jsonView file

•scripts.postinstall = node postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/cli/index.jsView file

High

Child Process

Package source references child process execution.

dist/cli/index.jsView on unpkg · L1

170`),process.exit(1))):(console.log(` L171: \u274C ${u.red}winget package manager is not installed on this system.${u.reset}`),console.log(`${u.bold}\u{1F449} To proceed, please either:${u.reset}`),console.log(" 1. Install... L172: `),process.exit(1)):s?Re("brew")?(console.log(` ... L177: `),process.exit(1))):(console.log(` L178: \u274C ${u.red}Homebrew package manager (brew) is not installed on this system.${u.reset}`),console.log(`${u.bold}\u{1F449} To proceed, please either:${u.reset}`),console.log(" 1... L179: `),process.exit(1)):(console.log(` ... L184: \u26A0\uFE0F ${u.yellow}Global installation failed or permissions restricted.${u.reset}`),console.log(`\u2139 ${u.dim}Falling back: Running Vercel dynamically via npx.${u.reset}`)... L185: ${u.dim}Step 3/4: Checking Vercel Login...${u.reset}`);let t=!!process.env.VERCEL_TOKEN,n=!1;if(t)console.log(`\u2714 ${u.green}VERCEL_TOKEN environment variable detected. Skipping... L186: \u2714 ${u.green}Logged in successfully!${u.reset}`)}return t}M();Se();async function Kn(e,t){console.log(`

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli/index.jsView on unpkg · L170

1#!/usr/bin/env node L2: "use strict";var ai=Object.create;var an=Object.defineProperty;var li=Object.getOwnPropertyDescriptor;var ci=Object.getOwnPropertyNames;var ui=Object.getPrototypeOf,pi=Object.proto... L3: ... L66: L67: Example reply: "yes, AWS" or "no"`,Xn="CFM_NEXT_STEP=ASK_DEPLOY"});function eo(e){return Zn.join(e,Li)}function to(){return process.env.CFM_SKIP_WORKFLOW_GATE==="1"}function be(e){... L68: `,"utf8")}function no(e){let t=be(e);bt(e,{version:1,coreVerifyPassedAt:new Date().toISOString(),layoutVerifyPassedAt:t?.layoutVerifyPassedAt??null,deployConfirmed:t?.deployConfirm... L69: `).length}function At(e,t,n){let o=new Set;if(t==="fastPath"){let s=e.fastPath;for(let r of s?.read??[])o.add(r)}else if(t==="phase"&&n!==void 0){let r=e.phases?.find(i=>String(i.i... ... L82: Source: ${e.source}`),console.log(n),console.log(""),!1}function $t(e,t,n=!1){let o=Ka(t,n);return o.length?Wa({title:"INSTALL SURVEY-TYPE DEPS (run once before Phase 6)",packages:... L83: `)){let o=n.trim();if(!o||o.startsWith("#"))continue;let s=o.indexOf("=");if(s<=0)continue;let r=o.slice(0,s).trim(),i=o.slice(s+1).trim();(i.startsWith('"')&&i.endsWith('"')||i.st... L84: `)}function Ir(e){r

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli/index.jsView on unpkg · L1

177`),process.exit(1))):(console.log(` L178: \u274C ${u.red}Homebrew package manager (brew) is not installed on this system.${u.reset}`),console.log(`${u.bold}\u{1F449} To proceed, please either:${u.reset}`),console.log(" 1... L179: `),process.exit(1)):(console.log(` ... L182: ${u.dim}Step 2/4: Checking Vercel CLI...${u.reset}`);let e="vercel",t=!1;if(Re("vercel"))console.log(`\u2714 ${u.green}Vercel CLI is installed!${u.reset}`);else{console.log(`\u2753... L183: \u{1F4E5} ${u.cyan}Installing Vercel CLI globally... (npm install -g vercel)${u.reset}`),se("npm",["install","-g","vercel"])&&Re("vercel")?console.log(`\u2714 ${u.green}Vercel CLI ... L184: \u26A0\uFE0F ${u.yellow}Global installation failed or permissions restricted.${u.reset}`),console.log(`\u2139 ${u.dim}Falling back: Running Vercel dynamically via npx.${u.reset}`)...

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli/index.jsView on unpkg · L177

•matchType = normalized_sha256 matchedPackage = @explorer02/cfm-survey-sdk@0.9.14 matchedPath = dist/cli/index.js matchedIdentity = npm:[redacted]:0.9.14 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/index.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = a950fc362b2393d4 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @explorer02/cfm-survey-sdk@0.9.14 matchedPath = dist/cli/index.js matchedIdentity = npm:[redacted]:0.9.14 similarity = 1.000 shingleOverlap = 6 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

dist/cli/index.jsView on unpkg

postinstall.jsView file

24Install-time AI-agent control hijack evidence: L34: L35: fs.writeFileSync(filePath, newContent, 'utf8'); L36: } ... L41: function writeClaudeMd(targetDir) { L42: const filePath = path.join(targetDir, 'CLAUDE.md'); L43: const stub = getClaudeMdStub(); ... L47: if (!canUpdateClaudeMd(existing)) { L48: console.log('Skipped CLAUDE.md (custom content outside @AGENTS.md bridge)'); L49: return; ... L51: if (existing.trim() === stub.trim()) { L52: console.log('CLAUDE.md already up to date'); L53: return; Payload evidence from postinstall/detect-agent.js: L24: */ L25: function detectAgent(env = process.env) { L26: const override = env.CFM_SDK_AGENT;

Critical

Ai Agent Control Hijack

Install-time source drops package-supplied AI-agent/MCP control files or instructions.

postinstall.jsView on unpkg · L24

templates/docs/survey-ui/verify-agent-build.shView file

•path = templates/docs/survey-ui/verify-agent-build.sh kind = build_helper sizeBytes = 12551 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/docs/survey-ui/verify-agent-build.shView on unpkg

dist/cli/index.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/index.mjsView on unpkg

dist/index.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index.jsView on unpkg

Findings

1 Critical9 High5 Medium6 Low

CriticalAi Agent Control Hijackpostinstall.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/cli/index.js

HighSame File Env Network Executiondist/cli/index.js

HighSandbox Evasion Gated Capabilitydist/cli/index.js

HighRuntime Package Installdist/cli/index.js

HighKnown Malware Source Similaritydist/cli/index.js

HighKnown Malware Source Similaritydist/cli/index.mjs

HighKnown Malware Source Similaritydist/index.js

HighKnown Malware Source Fingerprint Signaturedist/cli/index.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helpertemplates/docs/survey-ui/verify-agent-build.sh

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

12 flagged

package.jsonView file

Lines 11-51json

11 "require": "./dist/index.js"

12 }

13 },

14 "bin": {

15 "cfm-sdk": "./dist/cli/index.js"

16 },

17 "files": [

18 "dist",

19 "templates",

20 "postinstall.js",

21 "postinstall"

22 ],

23 "scripts": {

24 "build": "tsup",

25 "build:all": "npm run build",

26 "prepare": "npm run build",

27 "lint": "npm run lint:types && npm run lint:eslint",

28 "lint:types": "tsc --noEmit -p tsconfig.lint.json",

29 "lint:eslint": "eslint src",

30 "lint:fix": "eslint src --fix",

31 "postinstall": "node postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L31

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L31

32 "test": "vitest run",

33 "test:watch": "vitest",

34 "test:coverage": "vitest run --coverage",

35 "docs:sync-manifest": "npx tsx scripts/generate-doc-manifest.ts",

36 "split-survey-ui-config": "npx tsx scripts/split-survey-ui-config.ts",

37 "merge-survey-ui-config": "npx tsx scripts/merge-survey-ui-config.ts",

38 "lint:agent-docs": "bash scripts/lint-agent-docs.sh",

39 "sync-agent-stubs": "node scripts/sync-monorepo-agent-stubs.js",

40 "prepublish:check": "npm run build && npm run test && npm run test:coverage && npm run lint && npm run lint:agent-docs && npm run docs:sync-manifest"

41 },

42 "peerDependencies": {

43 "@tanstack/react-query": "^5.0.0",

44 "react": ">=17.0.0"

45 },

46 "devDependencies": {

47 "@tanstack/react-query": "^5.0.0",

48 "@testing-library/jest-dom": "^6.4.2",

49 "@testing-library/react": "^14.2.1",

50 "@testing-library/user-event": "^14.5.2",

51 "@types/react": "^17.0.0",

dist/cli/index.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

postinstall.jsView file

Lines 4-44javascript

4const {

5 NPM_AGENT_PATH,

6 getAgentsMdStub,

7 getCursorRulesStub,

8 getClaudeMdStub,

9 mergeMarkedBlock,

10 canUpdateClaudeMd,

11} = require('./postinstall/agent-stubs'

templates/docs/survey-ui/verify-agent-build.shView file

•path = templates/docs/survey-ui/verify-agent-build.sh kind = build_helper sizeBytes = 12551 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/docs/survey-ui/verify-agent-build.shView on unpkg

dist/cli/index.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/index.mjsView on unpkg

dist/index.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index.jsView on unpkg

Lines 150-197javascript

150${Wn(f)}

151`),0}var S,Wr=d(()=>{"use strict";M();nn();Rt();re();xe();Fe();Oe();S=u});var zr={};oe(zr,{runVerifyInteractions:()=>ic});function ic(e={}){let t=O(e.projectRoot);console.log(`${W.bold}=== CFM SDK \u2014 verify-interactions ===${W.reset}`),console.log(`${W.dim}Project: ${t}${W.reset}

152`);let n=Te(t);if(n.length){console.log(`${W.red}FAIL:${W.reset} Interaction / format contract issues:`);for(let o of n)console.log(` ${o}`);return console.log(`

153${W.dim}Fix: field-binding-map.md \xB7 client-lib-folder.md \xB7 layout-cookbook/mcq.md \xB7 agent-per-type-verification${W.reset}`),1}return console.log(`${W.green}OK:${W.reset} Interaction contracts passed (Likert field names, star icons, MCQ pickers)`),console.log(`${W.dim}Reminder: load dev URL and confirm runtime smoke in client

154`,"utf8"),n}function cc(e={}){let t=O(e.projectRoot),n=ti(t),o=ln(n);return console.log(`${Q.green}deploy.target:${Q.reset} ${n}`),console.log(`${Q.dim}Platform: ${o} (from ${rn})${Q

155${Q.red}Core verify not recorded. Run npx cfm-sdk verify-build successfully before set-deploy-target.${Q.reset}`),1;let s=ni(n,t),r=ln(t);try{so(n)}catch(i){return console.error(`

156${Q.red}${B(i)}${Q.reset}`),1}if(console.log(`${Q.green}OK:${Q.reset} Wrote deploy.target=${t} (${r}) \u2192 ${s}`),t==="aws"){let i=e.surveyId?.trim()||"<survey-id>"

157${xt(i)}

158`),console.log(`${Q.dim}After client pastes key: npx cfm-sdk create-distribution --s3-key=<key>${Q.reset}`)}else console.log(`${Q.dim}After client confirms deploy yes: npx cfm-sdk deploy${Q.reset}`);return 0}var z,Fn,Q,rn,ac,qn=d(()=>{"use strict";z=x(require(

159${xt(A)}

160`),1}try{io(t,r)}catch(A){return console.error(`${ie.red}${B(A)}${ie.reset}`),1}if(!o)throw new Error("Missing OUT_DIR \u2014 set OUT_DIR to the absolute path of out/ or dist/");if(!ye.existsSync(te.join(o,"index.html")))throw new Error(`Missing ${te.join(o,"index.html")} \u2014 run build first`);let{survey:i,apiResponse:l}=await Ie(t,s),a=i.id,p=l.cfmSurveyDTO?.name?.trim()||a,f=mc(),m=yc(o);console.log(`${ie.cyan}\u2192 Creating distribution${ie.reset} for ${p} (${a}, s3Key: ${r})`),console.log(` uploading ${m.length} files from ${o}\u2026`);let b=await Sc(n,s,r,m);await xc(o,b.uploads,m),c ...

161${Jn(C)}

162`),ro(t,r),0}catch(t){return console.error(`${ie.red}\u274C create-distribution failed: ${B(t)}${ie.reset}`),1}}var ye,te,ie,oi,pc,Un,dc,hc,ri=d(()=>{"use strict";ye=x(require("fs")),te=x(require("path"));gt();re();M();ft();xe();Oe();ie=u,oi=500,pc=52428800,Un=3,dc=2e3;hc=e=>new Promise(t=>setTimeout(t,e))});M();M();Se();var jn=x(require("readline/promises")),St=require("process");async function Ee(e){let t=jn.default.createInterface({input:St.stdin,output:St.stdout});try{return(await t.

163`);let t=await Ee("Would you like to install/upgrade Node.js v18+ automatically? (y/N): ");t.toLowerCase()==="y"||t.toLowerCase()==="yes"||(console.log(`

164\u274C ${u.red}Aborted. Please manually upgrade Node.js to v18+ and try again.${u.reset}

165`),process.exit(1));let o=process.platform==="win32",s=process.platform==="darwin";o?Re("winget")?(console.log(`

166\u{1F4E6} ${u.green}winget package manager found! Installing Node.js v18+ in background...${u.reset}`),se("winget",["upgrade","OpenJS.NodeJS","--silent","--accept-package-agreements","--accept-source-agreements"])?(console.log(`

167\u2714 ${u.green}Node.js installation triggered successfully. Please restart your terminal/command-prompt for changes to take effect.${u.reset}

168`),process.exit(0)):(console.log(`

169\u274C ${u.red}winget update failed. Please update Node.js manually at https://nodejs.org/${u.reset}

170`),process.exit(1))):(console.log(`

171\u274C ${u.red}winget package manager is not installed on this system.${u.reset}`),console.log(`${u.bold}\u{1F449} To proceed, please either:${u.reset}`),console.log(" 1. Install winget (App Installer) from the Microsoft Store."),console.log(` 2. Or manually download and install Node.js (v18+) from: https://nodejs.org/

172`),process.exit(1)):s?Re("brew")?(console.log(`

173\u{1F4E6} ${u.green}Homebrew package manager found! Installing Node.js v18+ in background...${u.reset}`),se("brew",["install","node"])?console.log(`

174\u2714 ${u.green}Node.js installed successfully via Homebrew.${u.reset}

175`):(console.log(`

176\u274C ${u.red}Homebrew installation failed. Please install Node.js manually at https://nodejs.org/${u.reset}

177`),process.exit(1))):(console.log(`

178\u274C ${u.red}Homebrew package manager (brew) is not installed on this system.${u.reset}`),console.log(`${u.bold}\u{1F449} To proceed, please either:${u.reset}`),console.log(" 1. Install Homebrew by running the following command in your terminal:"),console.log(` ${u.cyan}/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"${u.reset}`),console.log(` 2. Or manually download and install Node.js (v18+) from: https://nodejs.org/

179`),process.exit(1)):(console.log(`

180\u274C ${u.red}Please install or update Node.js to v18+ using your system's package manager.${u.reset}

181`),process.exit(1))}else console.log(`\u2714 ${u.green}Node.js version (v${e}) is sufficient.${u.reset}`)}M();Se();async function Hn(){console.log(`

182${u.dim}Step 2/4: Checking Vercel CLI...${u.reset}`);let e="vercel",t=!1;if(Re("vercel"))console.log(`\u2714 ${u.green}Vercel CLI is installed!${u.reset}`);else{console.log(`\u2753 ${u.yellow}Vercel CLI was not found on your system.${u.reset}`);let n=await Ee("\u{1F449} Would you like to install Vercel CLI globally? (Y/n): ");n.toLowerCase()==="y"||n===""?(console.log(`

183\u{1F4E5} ${u.cyan}Installing Vercel CLI globally... (npm install -g vercel)${u.reset}`),se("npm",["install","-g","vercel"])&&Re("vercel")?console.log(`\u2714 ${u.green}Vercel CLI installed successfully!${u.reset}`):(console.log(`

184\u26A0\uFE0F ${u.yellow}Global installation failed or permissions restricted.${u.reset}`),console.log(`\u2139 ${u.dim}Falling back: Running Vercel dynamically via npx.${u.reset}`),e="npx --yes vercel",t=!0)):(console.log(`\u2139 ${u.dim}Skipping global installation. Running Vercel dynamically via npx.${u.reset}`),e="npx --yes vercel",t=!0)}return{vercelCmd:e,useNpx:t}}var Vn=require("child_process");M();Se();var mi={stdio:"ignore",shell:process.platform==="win32"?"cmd.exe":"/bin/sh"};async function Gn(e){console.log(`

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli/index.jsView on unpkg · L177

185${u.dim}Step 3/4: Checking Vercel Login...${u.reset}`);let t=!!process.env.VERCEL_TOKEN,n=!1;if(t)console.log(`\u2714 ${u.green}VERCEL_TOKEN environment variable detected. Skipping login check.${u.reset}`),n=!0;else try{(0,Vn.execSync)(e?"npx --yes vercel whoami":"vercel whoami",mi),n=!0,console.log(`\u2714 ${u.green}Logged in!${u.reset}`)}catch{n=!1}if(!n){console.log(`\u{1F511} ${u.yellow}Not logged in to Vercel.${u.reset}`),await Ee("\u{1F449} Press [Enter] to login to Vercel... ");let o=["login"],s=e?"npx":"vercel",r=e?["--yes","vercel",...o]:o;if(await ht(s,r)!==0)throw new Error("Vercel ...

186\u2714 ${u.green}Logged in successfully!${u.reset}`)}return t}M();Se();async function Kn(e,t){console.log(`

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli/index.jsView on unpkg · L170

187${u.dim}Step 4/4: Deploying project to production...${u.reset}`);let n=["--prod","--yes"];t&&n.push("--token",process.env.VERCEL_TOKEN);let o=e?"npx":"vercel",s=e?["--yes","vercel",...n]:n;if(console.

188`),await ht(o,s)!==0)throw new Error("Vercel deployment failed.");console.log(`

189${u.bold}${u.green}\u{1F389} Deployment completed successfully!${u.reset}

190`)}Oe();re();async function lo(){un(O()),console.log(`

191${u.bold}${u.cyan}\u{1F680} Starting CFM Vercel Deployment...${u.reset}

192`),await Bn();let{useNpx:e}=await Hn(),t=await Gn(e);await Kn(e,t)}M();gn();re();var X=x(require("fs")),me=x(require("path"));Fe();function qi(e

193`);let n=vt(t);for(let o of n.warnings)console.log(`${$.yellow}WARN:${$.reset} ${o}`);if(n.errors.length>0){console.log(`${$.red}FAIL:${$.reset} Framework scaffold incomplete (${n.framework}) \u2014 fix all items before authoring components:`);for(let o of n.errors)console.log(` - ${o}`);return console.log(`

194${$.dim}Fix: setup/index.md \xB7 Next: npx cfm-sdk scaffold-check${$.reset}`),1}return n.framework!=="unknown"&&console.log(`${$.green}OK:${$.reset} Framework scaffold verified (${n.framework})`),console.log(`${$.dim}Core deps OK. Survey-type deps print after fill-implementation-plan --from-fetch.${$.reset}`),console.log(`${$.dim}Scaffold complete \u2014 run npx cfm-sdk seed-phase5 next.${$.reset}`),console.log(`

195${$.dim}${mn()}${$.reset}`),console.log(`

196${$.dim}Next: Phase 3\u20134 copy bundle + implementation_plan${$.reset}`),0}var Ot=x(require("fs")),Pt=x(require("path"));M();re();Rt();Se();xe();Oe();ut();var c=u,za=["@tanstack/react-query","@dnd-kit/core"];function Ja(e){let t=Pt.join(e,"survey-ui","verify-agent-build.sh");if(Ot.existsSync(t))return t;let n=Pt.join(__dirname,"..","..","templates","docs","survey-ui","verify-agent-build.sh");return Ot.existsSync(n)?n:null}function Za(e){console.log(`${c.bold}=== CFM SDK \u2014 verify-build --fast (speed tool) ===${c.reset}`),console.log(`${c.dim}Project: ${e}${c.reset}

197`);let t=vt(e);for(let a of t.warnings)console.log(`${c.yellow}WARN:${c.reset} ${a}`);if(!t.ok){console.log(`${c.red}FAIL:${c.reset} Scaffold incomplete:`);for(let a of t.errors)console.log(` - ${a}`);return console.log(`

Long lines were clipped for display.