registry / @explorer02/cfm-survey-sdk / 0.9.4

@explorer02/cfm-survey-sdk@0.9.4

Headless React SDK for custom survey UIs. Matches CFM respondent-view behavior (navigation, logic, validation, progress, submission); you own all presentation.

AI Security Review

scanned 3h ago · by lpm-firewall-ai

LPM blocks this version under the AI-agent control-surface policy. Install-time code modifies broad, foreign AI-agent instruction surfaces in the consuming project. By default it targets all supported agent configurations.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm dependency installation in a consumer project

Impact

Can steer Codex, Claude Code, Cursor, or Antigravity behavior through package-supplied instructions.

Mechanism

postinstall agent-instruction file injection

Policy narrative

On installation, `postinstall.js` detects an AI coding environment and writes project-root instruction files. If it cannot identify one, it defaults to writing `AGENTS.md`, `CLAUDE.md`, and `.cursorrules`, each redirecting agents to a contract controlled by the installed package. This is an unconsented install-time mutation of broad AI-agent control surfaces.

Rationale

The package has a concrete, automatic postinstall chain that modifies foreign project-level AI-agent control files and defaults to all targets. No exfiltration was found, but the control-surface mutation alone meets the publish-block boundary.

Evidence

package.jsonpostinstall.jspostinstall/detect-agent.jspostinstall/agent-stubs.jstemplates/docs/00-integration/setup/agent-stubs.mdAGENTS.mdCLAUDE.md.cursorrulesnode_modules/@explorer02/cfm-survey-sdk/templates/AGENT.md

Decision evidence

public snapshot

AI called this Malicious at 98.0% confidence as Malware with low false-positive risk.

Evidence for policy block

`package.json` runs `node postinstall.js` on install.
`postinstall.js` writes project-root `AGENTS.md`, `CLAUDE.md`, and `.cursorrules`.
`postinstall/detect-agent.js` defaults to `all` when no agent signal is present.
`postinstall/agent-stubs.js` injects instructions directing agents to package-controlled `templates/AGENT.md`.
Writes occur automatically for consumer installs, without user confirmation.

Evidence against

No credential harvesting or network use was found in postinstall sources.
Stub writes use markers and preserve much existing content.
`dist/index.js` is a React/query SDK with no import-time filesystem or process execution.
CLI process and network-related features are explicit `cfm-sdk` user commands.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

NoLicense

scanned 7 file(s), 398 KB of source, external domains: custom-p0.feedbook.me, distribution-dashboard-three.vercel.app, nodejs.org, raw.githubusercontent.com

Source & flagged code

12 flagged

package.jsonView file

Lines 11-51json

11 "require": "./dist/index.js"

12 }

13 },

14 "bin": {

15 "cfm-sdk": "./dist/cli/index.js"

16 },

17 "files": [

18 "dist",

19 "templates",

20 "postinstall.js",

21 "postinstall"

22 ],

23 "scripts": {

24 "build": "tsup",

25 "build:all": "npm run build",

26 "prepare": "npm run build",

27 "lint": "npm run lint:types && npm run lint:eslint",

28 "lint:types": "tsc --noEmit -p tsconfig.lint.json",

29 "lint:eslint": "eslint src",

30 "lint:fix": "eslint src --fix",

31 "postinstall": "node postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L31

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L31

32 "test": "vitest run",

33 "test:watch": "vitest",

34 "test:coverage": "vitest run --coverage",

35 "docs:sync-manifest": "npx tsx scripts/generate-doc-manifest.ts",

36 "split-survey-ui-config": "npx tsx scripts/split-survey-ui-config.ts",

37 "merge-survey-ui-config": "npx tsx scripts/merge-survey-ui-config.ts",

38 "lint:agent-docs": "bash scripts/lint-agent-docs.sh",

39 "sync-agent-stubs": "node scripts/sync-monorepo-agent-stubs.js",

40 "prepublish:check": "npm run build && npm run test && npm run test:coverage && npm run lint && npm run lint:agent-docs && npm run docs:sync-manifest"

41 },

42 "peerDependencies": {

43 "@tanstack/react-query": "^5.0.0",

44 "react": ">=17.0.0"

45 },

46 "devDependencies": {

47 "@tanstack/react-query": "^5.0.0",

48 "@testing-library/jest-dom": "^6.4.2",

49 "@testing-library/react": "^14.2.1",

50 "@testing-library/user-event": "^14.5.2",

51 "@types/react": "^17.0.0",

dist/cli/index.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2"use strict";var cr=Object.create;var Ut=Object.defineProperty;var pr=Object.getOwnPropertyDescriptor;var dr=Object.getOwnPropertyNames;var ur=Object.getPrototypeOf,fr=Object.prototype.hasOwnProperty;var f=(e,t)=>

postinstall.jsView file

Lines 4-44javascript

4const {

5 NPM_AGENT_PATH,

6 getAgentsMdStub,

7 getCursorRulesStub,

8 getClaudeMdStub,

9 mergeMarkedBlock,

10 canUpdateClaudeMd,

11} = require('./postinstall/agent-stubs'

templates/docs/survey-ui/verify-agent-build.shView file

•path = templates/docs/survey-ui/verify-agent-build.sh kind = build_helper sizeBytes = 10916 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/docs/survey-ui/verify-agent-build.shView on unpkg

dist/cli/index.mjsView file

•matchType = normalized_sha256 matchedPackage = @explorer02/cfm-survey-sdk@0.9.3 matchedPath = dist/cli/index.mjs matchedIdentity = npm:[redacted]:0.9.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/index.mjsView on unpkg

dist/index.jsView file

•matchType = normalized_sha256 matchedPackage = @explorer02/cfm-survey-sdk@0.9.3 matchedPath = dist/index.js matchedIdentity = npm:[redacted]:0.9.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index.jsView on unpkg

Source & flagged code

12 flagged · loading source

package.jsonView file

•scripts.postinstall = node postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/cli/index.jsView file

High

Child Process

Package source references child process execution.

dist/cli/index.jsView on unpkg · L1

114`),process.exit(1))):(console.log(` L115: \u274C ${c.red}winget package manager is not installed on this system.${c.reset}`),console.log(`${c.bold}\u{1F449} To proceed, please either:${c.reset}`),console.log(" 1. Install... L116: `),process.exit(1)):s?ge("brew")?(console.log(` ... L121: `),process.exit(1))):(console.log(` L122: \u274C ${c.red}Homebrew package manager (brew) is not installed on this system.${c.reset}`),console.log(`${c.bold}\u{1F449} To proceed, please either:${c.reset}`),console.log(" 1... L123: `),process.exit(1)):(console.log(` ... L128: \u26A0\uFE0F ${c.yellow}Global installation failed or permissions restricted.${c.reset}`),console.log(`\u2139 ${c.dim}Falling back: Running Vercel dynamically via npx.${c.reset}`)... L129: ${c.dim}Step 3/4: Checking Vercel Login...${c.reset}`);let t=!!process.env.VERCEL_TOKEN,n=!1;if(t)console.log(`\u2714 ${c.green}VERCEL_TOKEN environment variable detected. Skipping... L130: \u2714 ${c.green}Logged in successfully!${c.reset}`)}return t}k();ae();async function xn(e,t){console.log(`

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli/index.jsView on unpkg · L114

1#!/usr/bin/env node L2: "use strict";var cr=Object.create;var Ut=Object.defineProperty;var pr=Object.getOwnPropertyDescriptor;var dr=Object.getOwnPropertyNames;var ur=Object.getPrototypeOf,fr=Object.proto... L3: ... L64: L65: Example reply: "yes, AWS" or "no"`,Tn="CFM_NEXT_STEP=ASK_DEPLOY"});function bn(e){return In.join(e,wr)}function Rn(){return process.env.CFM_SKIP_WORKFLOW_GATE==="1"}function je(e){... L66: `,"utf8")}function wn(e){Bt(e,{version:1,coreVerifyPassedAt:new Date().toISOString(),deployConfirmed:null,distributionS3Key:null})}function kn(e){let t=je(e);if(!t?.coreVerifyPasse... L67: `).length}function ct(e,t,n){let o=new Set;if(t==="fastPath"){let s=e.fastPath;for(let r of s?.read??[])o.add(r)}else if(t==="phase"&&n!==void 0){let r=e.phases?.find(i=>String(i.i... ... L74: Source: ${e.source}`),console.log(n),console.log(""),!1}function mt(e,t,n=!1){let o=ui(t,n);return o.length?gi({title:"INSTALL SURVEY-TYPE DEPS (run once before Phase 6)",packages:... L75: `)){let o=n.trim();if(!o||o.startsWith("#"))continue;let s=o.indexOf("=");if(s<=0)continue;let r=o.slice(0,s).trim(),i=o.slice(s+1).trim();(i.startsWith('"')&&i.endsWith('"')||i.st... L76: `)}function Vs(e){r

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli/index.jsView on unpkg · L1

121`),process.exit(1))):(console.log(` L122: \u274C ${c.red}Homebrew package manager (brew) is not installed on this system.${c.reset}`),console.log(`${c.bold}\u{1F449} To proceed, please either:${c.reset}`),console.log(" 1... L123: `),process.exit(1)):(console.log(` ... L126: ${c.dim}Step 2/4: Checking Vercel CLI...${c.reset}`);let e="vercel",t=!1;if(ge("vercel"))console.log(`\u2714 ${c.green}Vercel CLI is installed!${c.reset}`);else{console.log(`\u2753... L127: \u{1F4E5} ${c.cyan}Installing Vercel CLI globally... (npm install -g vercel)${c.reset}`),J("npm",["install","-g","vercel"])&&ge("vercel")?console.log(`\u2714 ${c.green}Vercel CLI i... L128: \u26A0\uFE0F ${c.yellow}Global installation failed or permissions restricted.${c.reset}`),console.log(`\u2139 ${c.dim}Falling back: Running Vercel dynamically via npx.${c.reset}`)...

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli/index.jsView on unpkg · L121

•matchType = normalized_sha256 matchedPackage = @explorer02/cfm-survey-sdk@0.9.3 matchedPath = dist/cli/index.js matchedIdentity = npm:[redacted]:0.9.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/index.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 6f53b47cd1f81692 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @explorer02/cfm-survey-sdk@0.9.3 matchedPath = dist/cli/index.js matchedIdentity = npm:[redacted]:0.9.3 similarity = 1.000 shingleOverlap = 6 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

dist/cli/index.jsView on unpkg

postinstall.jsView file

24Install-time AI-agent control hijack evidence: L34: L35: fs.writeFileSync(filePath, newContent, 'utf8'); L36: } ... L41: function writeClaudeMd(targetDir) { L42: const filePath = path.join(targetDir, 'CLAUDE.md'); L43: const stub = getClaudeMdStub(); ... L47: if (!canUpdateClaudeMd(existing)) { L48: console.log('Skipped CLAUDE.md (custom content outside @AGENTS.md bridge)'); L49: return; ... L51: if (existing.trim() === stub.trim()) { L52: console.log('CLAUDE.md already up to date'); L53: return; Payload evidence from postinstall/detect-agent.js: L24: */ L25: function detectAgent(env = process.env) { L26: const override = env.CFM_SDK_AGENT;

Critical

Ai Agent Control Hijack

Install-time source drops package-supplied AI-agent/MCP control files or instructions.

postinstall.jsView on unpkg · L24

templates/docs/survey-ui/verify-agent-build.shView file

•path = templates/docs/survey-ui/verify-agent-build.sh kind = build_helper sizeBytes = 10916 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/docs/survey-ui/verify-agent-build.shView on unpkg

dist/cli/index.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/index.mjsView on unpkg

dist/index.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index.jsView on unpkg

Findings

1 Critical9 High5 Medium6 Low

CriticalAi Agent Control Hijackpostinstall.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/cli/index.js

HighSame File Env Network Executiondist/cli/index.js

HighSandbox Evasion Gated Capabilitydist/cli/index.js

HighRuntime Package Installdist/cli/index.js

HighKnown Malware Source Similaritydist/cli/index.js

HighKnown Malware Source Similaritydist/cli/index.mjs

HighKnown Malware Source Similaritydist/index.js

HighKnown Malware Source Fingerprint Signaturedist/cli/index.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helpertemplates/docs/survey-ui/verify-agent-build.sh

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

12 flagged

package.jsonView file

Lines 11-51json

11 "require": "./dist/index.js"

12 }

13 },

14 "bin": {

15 "cfm-sdk": "./dist/cli/index.js"

16 },

17 "files": [

18 "dist",

19 "templates",

20 "postinstall.js",

21 "postinstall"

22 ],

23 "scripts": {

24 "build": "tsup",

25 "build:all": "npm run build",

26 "prepare": "npm run build",

27 "lint": "npm run lint:types && npm run lint:eslint",

28 "lint:types": "tsc --noEmit -p tsconfig.lint.json",

29 "lint:eslint": "eslint src",

30 "lint:fix": "eslint src --fix",

31 "postinstall": "node postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L31

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L31

32 "test": "vitest run",

33 "test:watch": "vitest",

34 "test:coverage": "vitest run --coverage",

35 "docs:sync-manifest": "npx tsx scripts/generate-doc-manifest.ts",

36 "split-survey-ui-config": "npx tsx scripts/split-survey-ui-config.ts",

37 "merge-survey-ui-config": "npx tsx scripts/merge-survey-ui-config.ts",

38 "lint:agent-docs": "bash scripts/lint-agent-docs.sh",

39 "sync-agent-stubs": "node scripts/sync-monorepo-agent-stubs.js",

40 "prepublish:check": "npm run build && npm run test && npm run test:coverage && npm run lint && npm run lint:agent-docs && npm run docs:sync-manifest"

41 },

42 "peerDependencies": {

43 "@tanstack/react-query": "^5.0.0",

44 "react": ">=17.0.0"

45 },

46 "devDependencies": {

47 "@tanstack/react-query": "^5.0.0",

48 "@testing-library/jest-dom": "^6.4.2",

49 "@testing-library/react": "^14.2.1",

50 "@testing-library/user-event": "^14.5.2",

51 "@types/react": "^17.0.0",

dist/cli/index.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

postinstall.jsView file

Lines 4-44javascript

4const {

5 NPM_AGENT_PATH,

6 getAgentsMdStub,

7 getCursorRulesStub,

8 getClaudeMdStub,

9 mergeMarkedBlock,

10 canUpdateClaudeMd,

11} = require('./postinstall/agent-stubs'

templates/docs/survey-ui/verify-agent-build.shView file

•path = templates/docs/survey-ui/verify-agent-build.sh kind = build_helper sizeBytes = 10916 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/docs/survey-ui/verify-agent-build.shView on unpkg

dist/cli/index.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/index.mjsView on unpkg

dist/index.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index.jsView on unpkg

Lines 94-141javascript

94`);try{let{planPath:n,surveyTypes:o,hasMcqOtherPickers:s}=await Ft({projectRoot:t,instanceIdOverride:e.instanceIdOverride});console.log(`${Q.green}\u2705 Patched ${n} from live fetch (\xA70, \xA73b\u2013\xA73e)${Q.reset}`),mt(t,o,s),console.log(`${Q.dim}Author a component for each fetched type \u2014 read its ui-spec first${Q.reset}`);let r=Fn(t);return console.log(`

95${vn(r)}

96`),console.log(`${Q.dim}Next: npx cfm-sdk verify-build${Q.reset}`),0}catch(n){return console.error(`

97${Q.red}\u274C ${N(n)}${Q.reset}`),console.error(`${Q.dim}Fallback: npx cfm-sdk fill-implementation-plan --from-fetch${Q.reset}`),1}}var Q,er=f(()=>{"use strict";k();Ye();cn();Xe();ne();he();ze();Q=c});var dn={};Ne(dn,{SURVEY_DEPLOY_CONFIG_FILE:()=>Qt,readDeployTarget:()=>or,runGetDeployTarget:()=>Aa,runSetDeployTarget:()=>va,writeDeployTarget:()=>sr});function tr(e){return pn.join(e,Qt)}function nr(e){return pn.join(e,xa)}function Ta(e){let t=tr(e);if(G.existsSync(t))return t;let n=nr(e);return G.existsSync(n)?n:t}function or(e){let t=Ta(e);if(!G.existsSync(t))throw new Error(`${Qt} not found ...

98`,"utf8"),n}function Aa(e={}){let t=_(e.projectRoot),n=or(t),o=jt(n);return console.log(`${M.green}deploy.target:${M.reset} ${n}`),console.log(`${M.dim}Platform: ${o} (from ${Qt})${M.reset}`),0}async function va(e={}){let t=e.target?.toLowerCase().trim();if(t!=="aws"&&t!=="vercel")return console.error(`${M.red}FAIL:${M.reset} Usage: npx cfm-sdk set-deploy-target aws|vercel`),1;let n=_(e.projectRoot);if(!je(n)?.coreVerifyPassedAt)return console.error(`

99${M.red}Core verify not recorded. Run npx cfm-sdk verify-build successfully before set-deploy-target.${M.reset}`),1;let s=sr(n,t),r=jt(t);try{kn(n)}catch(i){return console.error(`

100${M.red}${N(i)}${M.reset}`),1}if(console.log(`${M.green}OK:${M.reset} Wrote deploy.target=${t} (${r}) \u2192 ${s}`),t==="aws"){let i=e.surveyId?.trim()||"<survey-id>",a=process.env.CFM_INSTANCE_ID?.trim();if(a&&i==="<survey-id>")try{let{survey:l}=await ue(n,a);i=l.id}catch{}console.log(`

101${at(i)}

102`),console.log(`${M.dim}After client pastes key: npx cfm-sdk create-distribution --s3-key=<key>${M.reset}`)}else console.log(`${M.dim}After client confirms deploy yes: npx cfm-sdk deploy${M.reset}`);return 0}var G,pn,M,Qt,xa,un=f(()=>{"use strict";G=h(require("fs")),pn=h(require("path"));k();ne();he();qe

103${at(S)}

104`),1}try{Dn(t,r)}catch(S){return console.error(`${Z.red}${N(S)}${Z.reset}`),1}if(!o)throw new Error("Missing OUT_DIR \u2014 set OUT_DIR to the absolute path of out/ or dist/");if(!re.existsSync(W.join(o,"index.html")))throw new Error(`Missing ${W.join(o,"index.html")} \u2014 run build first`);let{survey:i,apiResponse:a}=await ue(t,s),l=i.id,d=a.cfmSurveyDTO?.name?.trim()||l,u=ba(),g=wa(o);console.log(`${Z.cyan}\u2192 Creating distribution${Z.reset} for ${d} (${l}, s3Key: ${r})`),console.log(` uploading ${g.length} files from ${o}\u2026`);let y=await La(n,s,r,g);await Da(o,y.uploads,g),console ...

105${En(R)}

106`),Ln(t,r),0}catch(t){return console.error(`${Z.red}\u274C create-distribution failed: ${N(t)}${Z.reset}`),1}}var re,W,Z,rr,Ca,fn,Ea,ka,ar=f(()=>{"use strict";re=h(require("fs")),W=h(require("path"));Ze();ne();k();ze();he();qe();Z=c,rr=500,Ca=52428800,fn=3,Ea=2e3;ka=e=>new Promise(t=>setTimeout(t,e))});k();k();ae();var mn=h(require("readline/promises")),rt=require("process");async function ye(e){let t=mn.default.createInterface({input:rt.stdin,output:rt.stdout});try{return(await t.question(e

107`);let t=await ye("Would you like to install/upgrade Node.js v18+ automatically? (y/N): ");t.toLowerCase()==="y"||t.toLowerCase()==="yes"||(console.log(`

108\u274C ${c.red}Aborted. Please manually upgrade Node.js to v18+ and try again.${c.reset}

109`),process.exit(1));let o=process.platform==="win32",s=process.platform==="darwin";o?ge("winget")?(console.log(`

110\u{1F4E6} ${c.green}winget package manager found! Installing Node.js v18+ in background...${c.reset}`),J("winget",["upgrade","OpenJS.NodeJS","--silent","--accept-package-agreements","--accept-source-agreements"])?(console.log(`

111\u2714 ${c.green}Node.js installation triggered successfully. Please restart your terminal/command-prompt for changes to take effect.${c.reset}

112`),process.exit(0)):(console.log(`

113\u274C ${c.red}winget update failed. Please update Node.js manually at https://nodejs.org/${c.reset}

114`),process.exit(1))):(console.log(`

115\u274C ${c.red}winget package manager is not installed on this system.${c.reset}`),console.log(`${c.bold}\u{1F449} To proceed, please either:${c.reset}`),console.log(" 1. Install winget (App Installer) from the Microsoft Store."),console.log(` 2. Or manually download and install Node.js (v18+) from: https://nodejs.org/

116`),process.exit(1)):s?ge("brew")?(console.log(`

117\u{1F4E6} ${c.green}Homebrew package manager found! Installing Node.js v18+ in background...${c.reset}`),J("brew",["install","node"])?console.log(`

118\u2714 ${c.green}Node.js installed successfully via Homebrew.${c.reset}

119`):(console.log(`

120\u274C ${c.red}Homebrew installation failed. Please install Node.js manually at https://nodejs.org/${c.reset}

121`),process.exit(1))):(console.log(`

122\u274C ${c.red}Homebrew package manager (brew) is not installed on this system.${c.reset}`),console.log(`${c.bold}\u{1F449} To proceed, please either:${c.reset}`),console.log(" 1. Install Homebrew by running the following command in your terminal:"),console.log(` ${c.cyan}/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"${c.reset}`),console.log(` 2. Or manually download and install Node.js (v18+) from: https://nodejs.org/

123`),process.exit(1)):(console.log(`

124\u274C ${c.red}Please install or update Node.js to v18+ using your system's package manager.${c.reset}

125`),process.exit(1))}else console.log(`\u2714 ${c.green}Node.js version (v${e}) is sufficient.${c.reset}`)}k();ae();async function yn(){console.log(`

126${c.dim}Step 2/4: Checking Vercel CLI...${c.reset}`);let e="vercel",t=!1;if(ge("vercel"))console.log(`\u2714 ${c.green}Vercel CLI is installed!${c.reset}`);else{console.log(`\u2753 ${c.yellow}Vercel CLI was not found on your system.${c.reset}`);let n=await ye("\u{1F449} Would you like to install Vercel CLI globally? (Y/n): ");n.toLowerCase()==="y"||n===""?(console.log(`

127\u{1F4E5} ${c.cyan}Installing Vercel CLI globally... (npm install -g vercel)${c.reset}`),J("npm",["install","-g","vercel"])&&ge("vercel")?console.log(`\u2714 ${c.green}Vercel CLI installed successfully!${c.reset}`):(console.log(`

128\u26A0\uFE0F ${c.yellow}Global installation failed or permissions restricted.${c.reset}`),console.log(`\u2139 ${c.dim}Falling back: Running Vercel dynamically via npx.${c.reset}`),e="npx --yes vercel",t=!0)):(console.log(`\u2139 ${c.dim}Skipping global installation. Running Vercel dynamically via npx.${c.reset}`),e="npx --yes vercel",t=!0)}return{vercelCmd:e,useNpx:t}}var hn=require("child_process");k();ae();var yr={stdio:"ignore",shell:process.platform==="win32"?"cmd.exe":"/bin/sh"};async function Sn(e){console.log(`

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli/index.jsView on unpkg · L121

129${c.dim}Step 3/4: Checking Vercel Login...${c.reset}`);let t=!!process.env.VERCEL_TOKEN,n=!1;if(t)console.log(`\u2714 ${c.green}VERCEL_TOKEN environment variable detected. Skipping login check.${c.reset}`),n=!0;else try{(0,hn.execSync)(e?"npx --yes vercel whoami":"vercel whoami",yr),n=!0,console.log(`\u2714 ${c.green}Logged in!${c.reset}`)}catch{n=!1}if(!n){console.log(`\u{1F511} ${c.yellow}Not logged in to Vercel.${c.reset}`),await ye("\u{1F449} Press [Enter] to login to Vercel... ");let o=["login"],s=e?"npx":"vercel",r=e?["--yes","vercel",...o]:o;if(await st(s,r)!==0)throw new Error("Vercel ...

130\u2714 ${c.green}Logged in successfully!${c.reset}`)}return t}k();ae();async function xn(e,t){console.log(`

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli/index.jsView on unpkg · L114

131${c.dim}Step 4/4: Deploying project to production...${c.reset}`);let n=["--prod","--yes"];t&&n.push("--token",process.env.VERCEL_TOKEN);let o=e?"npx":"vercel",s=e?["--yes","vercel",...n]:n;if(console.log(`${c

132`),await st(o,s)!==0)throw new Error("Vercel deployment failed.");console.log(`

133${c.bold}${c.green}\u{1F389} Deployment completed successfully!${c.reset}

134`)}qe();ne();async function On(){Ht(_()),console.log(`

135${c.bold}${c.cyan}\u{1F680} Starting CFM Vercel Deployment...${c.reset}

136`),await gn();let{useNpx:e}=await yn(),t=await Sn(e);await xn(e,t)}k();Kt();ne();var V=h(require("fs")),oe=h(require("path"));Ye();function Qr(e){let t=oe.join(e,"package.json");if(!V.existsSync(t))return null;try{return JSON.parse(V.readFileSync(t,"utf8"))}catch{return null}}function pt(e,t){for(let n of t){let o=oe.join(e,n);if(V.existsSync(o))return n}return null}function Wt(e,t){return V.readFileSync(oe.join(e,t),"utf8")}function Ur(e){if(process.env.CFM_DEPLOY_TARGET==="aws")return!0;let t=["survey-deploy-config.json","survey-ui-config.json"];for(let n of t){let o=oe.join(e,n);if(V.exists ...

137`);let n=dt(t);for(let o of n.warnings)console.log(`${E.yellow}WARN:${E.reset} ${o}`);if(n.errors.length>0){console.log(`${E.red}FAIL:${E.reset} Framework scaffold incomplete (${n.framework}) \u2014 fix all items before authoring components:`);for(let o of n.errors)console.log(` - ${o}`);return console.log(`

138${E.dim}Fix: setup/index.md \xB7 Next: npx cfm-sdk scaffold-check${E.reset}`),1}return n.framework!=="unknown"&&console.log(`${E.green}OK:${E.reset} Framework scaffold verified (${n.framework})`),console.log(`${E.dim}Core deps OK. Survey-type deps print after fill-implementation-plan --from-fetch.${E.reset}`),console.log(`${E.dim}Scaffold complete \u2014 run npx cfm-sdk seed-phase5 next.${E.reset}`),console.log(`

139${E.dim}${Xt()}${E.reset}`),console.log(`

140${E.dim}Next: Phase 3\u20134 copy bundle + implementation_plan${E.reset}`),0}var gt=h(require("fs")),yt=h(require("path"));k();ne();var I=h(require("fs")),L=h(require("path")),qr=["src","components","app","lib"],Br=["src/components/IntroPage.tsx","components/IntroPage.tsx","app/components/IntroPage.tsx"],Hr=["src/components/SurveyPage.tsx","components/SurveyPage.tsx","app/components/SurveyPage.tsx"],Vr=["src/components/EndPage.tsx","components/EndPage.tsx","app/components/EndPage.tsx"],Vn=["src/components/Question.tsx","components/Question.tsx","app/components/Question.tsx"],zt=["CsatMatrixSca ...

141`);for(let i=0;i<r.length;i++){let a=r[i];Wr(a)||(Xr.test(a)||Kr.test(a))&&t.push(`${n}:${i+1}: hardcoded color \u2014 use survey-ui-config.json + var(--cfm-*)`)}}return t}function Jr(e){let t=[],n=Ge(e,Br);if(!n)return t.push

Long lines were clipped for display.