registry / @explorer02/cfm-survey-sdk / 0.9.6

@explorer02/cfm-survey-sdk@0.9.6

Headless React SDK for custom survey UIs. Matches CFM respondent-view behavior (navigation, logic, validation, progress, submission); you own all presentation.

AI Security Review

scanned 2h ago · by lpm-firewall-ai

LPM blocks this version under the AI-agent control-surface policy. Install-time code modifies broad AI coding-agent instruction/control files in the consuming project. It selects targets using agent-specific environment signals and injects package-authored guidance.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm installation as a dependency in `node_modules`.

Impact

Can steer Codex, Cursor, Claude Code, or Antigravity behavior in the consumer project without user consent.

Mechanism

Automatic project-root AI-agent instruction-file injection.

Policy narrative

The `postinstall` lifecycle hook runs automatically after consumer installation. It detects installed AI-agent environments, then writes or merges package-supplied directives into project-root `AGENTS.md`, `.cursorrules`, and `CLAUDE.md`. Those directives cause coding agents to read package-controlled operating documentation before modifying project code, creating an unconsented, broad agent-control-surface mutation.

Rationale

This is a concrete unconsented postinstall mutation of foreign AI-agent control files, meeting the firewall block boundary. The user-invoked CLI capabilities do not mitigate the install-time control-surface hijack.

Evidence

package.jsonpostinstall.jspostinstall/detect-agent.jspostinstall/agent-stubs.jsAGENTS.mdCLAUDE.md.cursorrules

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for policy block

`package.json` runs `node postinstall.js` on install.
`postinstall.js` writes `AGENTS.md`, `.cursorrules`, and `CLAUDE.md` into `INIT_CWD` or the consumer project root.
`postinstall/detect-agent.js` fingerprints Codex, Cursor, Claude, and Antigravity environment variables.
`postinstall/agent-stubs.js` injects instructions directing agents to package-controlled documentation.
The install mutation occurs automatically for consumer installs under `node_modules`.

Evidence against

Postinstall source contains no network, credential-harvesting, shell-execution, or payload-download behavior.
`CLAUDE.md` updates are guarded against unrelated custom content.
CLI network and package-manager operations in `dist/cli/index.js` require explicit user command execution.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

NoLicense

scanned 7 file(s), 400 KB of source, external domains: custom-p0.feedbook.me, distribution-dashboard-three.vercel.app, nodejs.org, raw.githubusercontent.com

Source & flagged code

9 flagged

package.jsonView file

Lines 11-51json

11 "require": "./dist/index.js"

12 }

13 },

14 "bin": {

15 "cfm-sdk": "./dist/cli/index.js"

16 },

17 "files": [

18 "dist",

19 "templates",

20 "postinstall.js",

21 "postinstall"

22 ],

23 "scripts": {

24 "build": "tsup",

25 "build:all": "npm run build",

26 "prepare": "npm run build",

27 "lint": "npm run lint:types && npm run lint:eslint",

28 "lint:types": "tsc --noEmit -p tsconfig.lint.json",

29 "lint:eslint": "eslint src",

30 "lint:fix": "eslint src --fix",

31 "postinstall": "node postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L31

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L31

32 "test": "vitest run",

33 "test:watch": "vitest",

34 "test:coverage": "vitest run --coverage",

35 "docs:sync-manifest": "npx tsx scripts/generate-doc-manifest.ts",

36 "split-survey-ui-config": "npx tsx scripts/split-survey-ui-config.ts",

37 "merge-survey-ui-config": "npx tsx scripts/merge-survey-ui-config.ts",

38 "lint:agent-docs": "bash scripts/lint-agent-docs.sh",

39 "sync-agent-stubs": "node scripts/sync-monorepo-agent-stubs.js",

40 "prepublish:check": "npm run build && npm run test && npm run test:coverage && npm run lint && npm run lint:agent-docs && npm run docs:sync-manifest"

41 },

42 "peerDependencies": {

43 "@tanstack/react-query": "^5.0.0",

44 "react": ">=17.0.0"

45 },

46 "devDependencies": {

47 "@tanstack/react-query": "^5.0.0",

48 "@testing-library/jest-dom": "^6.4.2",

49 "@testing-library/react": "^14.2.1",

50 "@testing-library/user-event": "^14.5.2",

51 "@types/react": "^17.0.0",

dist/cli/index.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2"use strict";var us=Object.create;var Ut=Object.defineProperty;var fs=Object.getOwnPropertyDescriptor;var ms=Object.getOwnPropertyNames;var gs=Object.getPrototypeOf,ys=Object.prototype.hasOwnProperty;var f=(e,t)=>

postinstall.jsView file

Lines 4-44javascript

4const {

5 NPM_AGENT_PATH,

6 getAgentsMdStub,

7 getCursorRulesStub,

8 getClaudeMdStub,

9 mergeMarkedBlock,

10 canUpdateClaudeMd,

11} = require('./postinstall/agent-stubs'

templates/docs/survey-ui/verify-agent-build.shView file

•path = templates/docs/survey-ui/verify-agent-build.sh kind = build_helper sizeBytes = 10916 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/docs/survey-ui/verify-agent-build.shView on unpkg

dist/index.jsView file

•matchType = normalized_sha256 matchedPackage = @explorer02/cfm-survey-sdk@0.9.5 matchedPath = dist/index.js matchedIdentity = npm:[redacted]:0.9.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index.jsView on unpkg

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/cli/index.jsView file

High

Child Process

Package source references child process execution.

dist/cli/index.jsView on unpkg · L1

114`),process.exit(1))):(console.log(` L115: \u274C ${c.red}winget package manager is not installed on this system.${c.reset}`),console.log(`${c.bold}\u{1F449} To proceed, please either:${c.reset}`),console.log(" 1. Install... L116: `),process.exit(1)):r?ye("brew")?(console.log(` ... L121: `),process.exit(1))):(console.log(` L122: \u274C ${c.red}Homebrew package manager (brew) is not installed on this system.${c.reset}`),console.log(`${c.bold}\u{1F449} To proceed, please either:${c.reset}`),console.log(" 1... L123: `),process.exit(1)):(console.log(` ... L128: \u26A0\uFE0F ${c.yellow}Global installation failed or permissions restricted.${c.reset}`),console.log(`\u2139 ${c.dim}Falling back: Running Vercel dynamically via npx.${c.reset}`)... L129: ${c.dim}Step 3/4: Checking Vercel Login...${c.reset}`);let t=!!process.env.VERCEL_TOKEN,n=!1;if(t)console.log(`\u2714 ${c.green}VERCEL_TOKEN environment variable detected. Skipping... L130: \u2714 ${c.green}Logged in successfully!${c.reset}`)}return t}k();le();async function xn(e,t){console.log(`

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli/index.jsView on unpkg · L114

1#!/usr/bin/env node L2: "use strict";var us=Object.create;var Ut=Object.defineProperty;var fs=Object.getOwnPropertyDescriptor;var ms=Object.getOwnPropertyNames;var gs=Object.getPrototypeOf,ys=Object.proto... L3: ... L64: L65: Example reply: "yes, AWS" or "no"`,Tn="CFM_NEXT_STEP=ASK_DEPLOY"});function In(e){return bn.join(e,Ps)}function Rn(){return process.env.CFM_SKIP_WORKFLOW_GATE==="1"}function Be(e){... L66: `,"utf8")}function wn(e){Bt(e,{version:1,coreVerifyPassedAt:new Date().toISOString(),deployConfirmed:null,distributionS3Key:null})}function kn(e){let t=Be(e);if(!t?.coreVerifyPasse... L67: `).length}function ct(e,t,n){let o=new Set;if(t==="fastPath"){let r=e.fastPath;for(let s of r?.read??[])o.add(s)}else if(t==="phase"&&n!==void 0){let s=e.phases?.find(i=>String(i.i... ... L74: Source: ${e.source}`),console.log(n),console.log(""),!1}function mt(e,t,n=!1){let o=hi(t,n);return o.length?Ti({title:"INSTALL SURVEY-TYPE DEPS (run once before Phase 6)",packages:... L75: `)){let o=n.trim();if(!o||o.startsWith("#"))continue;let r=o.indexOf("=");if(r<=0)continue;let s=o.slice(0,r).trim(),i=o.slice(r+1).trim();(i.startsWith('"')&&i.endsWith('"')||i.st... L76: `)}function Xr(e){r

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli/index.jsView on unpkg · L1

121`),process.exit(1))):(console.log(` L122: \u274C ${c.red}Homebrew package manager (brew) is not installed on this system.${c.reset}`),console.log(`${c.bold}\u{1F449} To proceed, please either:${c.reset}`),console.log(" 1... L123: `),process.exit(1)):(console.log(` ... L126: ${c.dim}Step 2/4: Checking Vercel CLI...${c.reset}`);let e="vercel",t=!1;if(ye("vercel"))console.log(`\u2714 ${c.green}Vercel CLI is installed!${c.reset}`);else{console.log(`\u2753... L127: \u{1F4E5} ${c.cyan}Installing Vercel CLI globally... (npm install -g vercel)${c.reset}`),J("npm",["install","-g","vercel"])&&ye("vercel")?console.log(`\u2714 ${c.green}Vercel CLI i... L128: \u26A0\uFE0F ${c.yellow}Global installation failed or permissions restricted.${c.reset}`),console.log(`\u2139 ${c.dim}Falling back: Running Vercel dynamically via npx.${c.reset}`)...

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli/index.jsView on unpkg · L121

postinstall.jsView file

24Install-time AI-agent control hijack evidence: L34: L35: fs.writeFileSync(filePath, newContent, 'utf8'); L36: } ... L41: function writeClaudeMd(targetDir) { L42: const filePath = path.join(targetDir, 'CLAUDE.md'); L43: const stub = getClaudeMdStub(); ... L47: if (!canUpdateClaudeMd(existing)) { L48: console.log('Skipped CLAUDE.md (custom content outside @AGENTS.md bridge)'); L49: return; ... L51: if (existing.trim() === stub.trim()) { L52: console.log('CLAUDE.md already up to date'); L53: return; Payload evidence from postinstall/detect-agent.js: L24: */ L25: function detectAgent(env = process.env) { L26: const override = env.CFM_SDK_AGENT;

Critical

Ai Agent Control Hijack

Install-time source drops package-supplied AI-agent/MCP control files or instructions.

postinstall.jsView on unpkg · L24

templates/docs/survey-ui/verify-agent-build.shView file

•path = templates/docs/survey-ui/verify-agent-build.sh kind = build_helper sizeBytes = 10916 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/docs/survey-ui/verify-agent-build.shView on unpkg

dist/index.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index.jsView on unpkg

Findings

1 Critical6 High5 Medium6 Low

CriticalAi Agent Control Hijackpostinstall.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/cli/index.js

HighSame File Env Network Executiondist/cli/index.js

HighSandbox Evasion Gated Capabilitydist/cli/index.js

HighRuntime Package Installdist/cli/index.js

HighKnown Malware Source Similaritydist/index.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helpertemplates/docs/survey-ui/verify-agent-build.sh

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

9 flagged

package.jsonView file

Lines 11-51json

11 "require": "./dist/index.js"

12 }

13 },

14 "bin": {

15 "cfm-sdk": "./dist/cli/index.js"

16 },

17 "files": [

18 "dist",

19 "templates",

20 "postinstall.js",

21 "postinstall"

22 ],

23 "scripts": {

24 "build": "tsup",

25 "build:all": "npm run build",

26 "prepare": "npm run build",

27 "lint": "npm run lint:types && npm run lint:eslint",

28 "lint:types": "tsc --noEmit -p tsconfig.lint.json",

29 "lint:eslint": "eslint src",

30 "lint:fix": "eslint src --fix",

31 "postinstall": "node postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L31

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L31

32 "test": "vitest run",

33 "test:watch": "vitest",

34 "test:coverage": "vitest run --coverage",

35 "docs:sync-manifest": "npx tsx scripts/generate-doc-manifest.ts",

36 "split-survey-ui-config": "npx tsx scripts/split-survey-ui-config.ts",

37 "merge-survey-ui-config": "npx tsx scripts/merge-survey-ui-config.ts",

38 "lint:agent-docs": "bash scripts/lint-agent-docs.sh",

39 "sync-agent-stubs": "node scripts/sync-monorepo-agent-stubs.js",

40 "prepublish:check": "npm run build && npm run test && npm run test:coverage && npm run lint && npm run lint:agent-docs && npm run docs:sync-manifest"

41 },

42 "peerDependencies": {

43 "@tanstack/react-query": "^5.0.0",

44 "react": ">=17.0.0"

45 },

46 "devDependencies": {

47 "@tanstack/react-query": "^5.0.0",

48 "@testing-library/jest-dom": "^6.4.2",

49 "@testing-library/react": "^14.2.1",

50 "@testing-library/user-event": "^14.5.2",

51 "@types/react": "^17.0.0",

dist/cli/index.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

postinstall.jsView file

Lines 4-44javascript

4const {

5 NPM_AGENT_PATH,

6 getAgentsMdStub,

7 getCursorRulesStub,

8 getClaudeMdStub,

9 mergeMarkedBlock,

10 canUpdateClaudeMd,

11} = require('./postinstall/agent-stubs'

templates/docs/survey-ui/verify-agent-build.shView file

•path = templates/docs/survey-ui/verify-agent-build.sh kind = build_helper sizeBytes = 10916 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/docs/survey-ui/verify-agent-build.shView on unpkg

dist/index.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index.jsView on unpkg

Lines 94-141javascript

94`);try{let{planPath:n,surveyTypes:o,hasMcqOtherPickers:r}=await Ft({projectRoot:t,instanceIdOverride:e.instanceIdOverride});console.log(`${M.green}\u2705 Patched ${n} from live fetch (\xA70, \xA73b\u2013\xA73e)${M.reset}`),mt(t,o,r),console.log(`${M.dim}Author a component for each fetched type \u2014 read its ui-spec first${M.reset}`);let{url:s,warning:i}=await jn(t);return i&&console.log(`${M.yellow}\u26A0\uFE0F ${i}${M.reset}`),console.log(`

95${vn(s)}

96`),console.log(`${M.dim}Next: npx cfm-sdk verify-build${M.reset}`),0}catch(n){return console.error(`

97${M.red}\u274C ${F(n)}${M.reset}`),console.error(`${M.dim}Fallback: npx cfm-sdk fill-implementation-plan --from-fetch${M.reset}`),1}}var M,os=f(()=>{"use strict";k();Ye();cn();Xe();ne();Se();ze();M=c});var dn={};Qe(dn,{SURVEY_DEPLOY_CONFIG_FILE:()=>Qt,readDeployTarget:()=>is,runGetDeployTarget:()=>Ia,runSetDeployTarget:()=>Ra,writeDeployTarget:()=>as});function rs(e){return pn.join(e,Qt)}function ss(e){return pn.join(e,Ea)}function ba(e){let t=rs(e);if(G.existsSync(t))return t;let n=ss(e);return G.existsSync(n)?n:t}function is(e){let t=ba(e);if(!G.existsSync(t))throw new Error(`${Qt} not found ...

98`,"utf8"),n}function Ia(e={}){let t=_(e.projectRoot),n=is(t),o=jt(n);return console.log(`${$.green}deploy.target:${$.reset} ${n}`),console.log(`${$.dim}Platform: ${o} (from ${Qt})${$.reset}`),0}async function Ra(e={}){let t=e.target?.toLowerCase().trim();if(t!=="aws"&&t!=="vercel")return console.error(`${$.red}FAIL:${$.reset} Usage: npx cfm-sdk set-deploy-target aws|vercel`),1;let n=_(e.projectRoot);if(!Be(n)?.coreVerifyPassedAt)return console.error(`

99${$.red}Core verify not recorded. Run npx cfm-sdk verify-build successfully before set-deploy-target.${$.reset}`),1;let r=as(n,t),s=jt(t);try{kn(n)}catch(i){return console.error(`

100${$.red}${F(i)}${$.reset}`),1}if(console.log(`${$.green}OK:${$.reset} Wrote deploy.target=${t} (${s}) \u2192 ${r}`),t==="aws"){let i=e.surveyId?.trim()||"<survey-id>",a=process.env.CFM_INSTANCE_ID?.trim();if(a&&i==="<survey-id>")try{let{survey:l}=await fe(n,a);i=l.id}catch{}console.log(`

101${at(i)}

102`),console.log(`${$.dim}After client pastes key: npx cfm-sdk create-distribution --s3-key=<key>${$.reset}`)}else console.log(`${$.dim}After client confirms deploy yes: npx cfm-sdk deploy${$.reset}`);return 0}var G,pn,$,Qt,Ea,un=f(()=>{"use strict";G=h(require("fs")),pn=h(require("path"));k();ne();Se();He();Ze();ze();$=c,Qt

103${at(S)}

104`),1}try{Pn(t,s)}catch(S){return console.error(`${Z.red}${F(S)}${Z.reset}`),1}if(!o)throw new Error("Missing OUT_DIR \u2014 set OUT_DIR to the absolute path of out/ or dist/");if(!ie.existsSync(W.join(o,"index.html")))throw new Error(`Missing ${W.join(o,"index.html")} \u2014 run build first`);let{survey:i,apiResponse:a}=await fe(t,r),l=i.id,d=a.cfmSurveyDTO?.name?.trim()||l,u=Pa(),g=Oa(o);console.log(`${Z.cyan}\u2192 Creating distribution${Z.reset} for ${d} (${l}, s3Key: ${s})`),console.log(` uploading ${g.length} files from ${o}\u2026`);let y=await $a(n,r,s,g);await _a(o,y.uploads,g),console ...

105${En(R)}

106`),Ln(t,s),0}catch(t){return console.error(`${Z.red}\u274C create-distribution failed: ${F(t)}${Z.reset}`),1}}var ie,W,Z,ls,wa,fn,ka,Ma,ps=f(()=>{"use strict";ie=h(require("fs")),W=h(require("path"));Ze();ne();k();ze();Se();He();Z=c,ls=500,wa=52428800,fn=3,ka=2e3;Ma=e=>new Promise(t=>setTimeout(t,e))});k();k();le();var mn=h(require("readline/promises")),st=require("process");async function he(e){let t=mn.default.createInterface({input:st.stdin,output:st.stdout});try{return(await t.question(e

107`);let t=await he("Would you like to install/upgrade Node.js v18+ automatically? (y/N): ");t.toLowerCase()==="y"||t.toLowerCase()==="yes"||(console.log(`

108\u274C ${c.red}Aborted. Please manually upgrade Node.js to v18+ and try again.${c.reset}

109`),process.exit(1));let o=process.platform==="win32",r=process.platform==="darwin";o?ye("winget")?(console.log(`

110\u{1F4E6} ${c.green}winget package manager found! Installing Node.js v18+ in background...${c.reset}`),J("winget",["upgrade","OpenJS.NodeJS","--silent","--accept-package-agreements","--accept-source-agreements"])?(console.log(`

111\u2714 ${c.green}Node.js installation triggered successfully. Please restart your terminal/command-prompt for changes to take effect.${c.reset}

112`),process.exit(0)):(console.log(`

113\u274C ${c.red}winget update failed. Please update Node.js manually at https://nodejs.org/${c.reset}

114`),process.exit(1))):(console.log(`

115\u274C ${c.red}winget package manager is not installed on this system.${c.reset}`),console.log(`${c.bold}\u{1F449} To proceed, please either:${c.reset}`),console.log(" 1. Install winget (App Installer) from the Microsoft Store."),console.log(` 2. Or manually download and install Node.js (v18+) from: https://nodejs.org/

116`),process.exit(1)):r?ye("brew")?(console.log(`

117\u{1F4E6} ${c.green}Homebrew package manager found! Installing Node.js v18+ in background...${c.reset}`),J("brew",["install","node"])?console.log(`

118\u2714 ${c.green}Node.js installed successfully via Homebrew.${c.reset}

119`):(console.log(`

120\u274C ${c.red}Homebrew installation failed. Please install Node.js manually at https://nodejs.org/${c.reset}

121`),process.exit(1))):(console.log(`

122\u274C ${c.red}Homebrew package manager (brew) is not installed on this system.${c.reset}`),console.log(`${c.bold}\u{1F449} To proceed, please either:${c.reset}`),console.log(" 1. Install Homebrew by running the following command in your terminal:"),console.log(` ${c.cyan}/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"${c.reset}`),console.log(` 2. Or manually download and install Node.js (v18+) from: https://nodejs.org/

123`),process.exit(1)):(console.log(`

124\u274C ${c.red}Please install or update Node.js to v18+ using your system's package manager.${c.reset}

125`),process.exit(1))}else console.log(`\u2714 ${c.green}Node.js version (v${e}) is sufficient.${c.reset}`)}k();le();async function yn(){console.log(`

126${c.dim}Step 2/4: Checking Vercel CLI...${c.reset}`);let e="vercel",t=!1;if(ye("vercel"))console.log(`\u2714 ${c.green}Vercel CLI is installed!${c.reset}`);else{console.log(`\u2753 ${c.yellow}Vercel CLI was not found on your system.${c.reset}`);let n=await he("\u{1F449} Would you like to install Vercel CLI globally? (Y/n): ");n.toLowerCase()==="y"||n===""?(console.log(`

127\u{1F4E5} ${c.cyan}Installing Vercel CLI globally... (npm install -g vercel)${c.reset}`),J("npm",["install","-g","vercel"])&&ye("vercel")?console.log(`\u2714 ${c.green}Vercel CLI installed successfully!${c.reset}`):(console.log(`

128\u26A0\uFE0F ${c.yellow}Global installation failed or permissions restricted.${c.reset}`),console.log(`\u2139 ${c.dim}Falling back: Running Vercel dynamically via npx.${c.reset}`),e="npx --yes vercel",t=!0)):(console.log(`\u2139 ${c.dim}Skipping global installation. Running Vercel dynamically via npx.${c.reset}`),e="npx --yes vercel",t=!0)}return{vercelCmd:e,useNpx:t}}var hn=require("child_process");k();le();var xs={stdio:"ignore",shell:process.platform==="win32"?"cmd.exe":"/bin/sh"};async function Sn(e){console.log(`

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli/index.jsView on unpkg · L121

129${c.dim}Step 3/4: Checking Vercel Login...${c.reset}`);let t=!!process.env.VERCEL_TOKEN,n=!1;if(t)console.log(`\u2714 ${c.green}VERCEL_TOKEN environment variable detected. Skipping login check.${c.reset}`),n=!0;else try{(0,hn.execSync)(e?"npx --yes vercel whoami":"vercel whoami",xs),n=!0,console.log(`\u2714 ${c.green}Logged in!${c.reset}`)}catch{n=!1}if(!n){console.log(`\u{1F511} ${c.yellow}Not logged in to Vercel.${c.reset}`),await he("\u{1F449} Press [Enter] to login to Vercel... ");let o=["login"],r=e?"npx":"vercel",s=e?["--yes","vercel",...o]:o;if(await rt(r,s)!==0)throw new Error("Vercel ...

130\u2714 ${c.green}Logged in successfully!${c.reset}`)}return t}k();le();async function xn(e,t){console.log(`

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli/index.jsView on unpkg · L114

131${c.dim}Step 4/4: Deploying project to production...${c.reset}`);let n=["--prod","--yes"];t&&n.push("--token",process.env.VERCEL_TOKEN);let o=e?"npx":"vercel",r=e?["--yes","vercel",...n]:n;if(console.log(`${c

132`),await rt(o,r)!==0)throw new Error("Vercel deployment failed.");console.log(`

133${c.bold}${c.green}\u{1F389} Deployment completed successfully!${c.reset}

134`)}He();ne();async function On(){Ht(_()),console.log(`

135${c.bold}${c.cyan}\u{1F680} Starting CFM Vercel Deployment...${c.reset}

136`),await gn();let{useNpx:e}=await yn(),t=await Sn(e);await xn(e,t)}k();Kt();ne();var V=h(require("fs")),re=h(require("path"));Ye();function Hs(e){let t=re.join(e,"package.json");if(!V.existsSync(t))return null;try{return JSON.parse(V.readFileSync(t,"utf8"))}catch{return null}}function pt(e,t){for(let n of t){let o=re.join(e,n);if(V.existsSync(o))return n}return null}function Wt(e,t){return V.readFileSync(re.join(e,t),"utf8")}function Vs(e){if(process.env.CFM_DEPLOY_TARGET==="aws")return!0;let t=["survey-deploy-config.json","survey-ui-config.json"];for(let n of t){let o=re.join(e,n);if(V.exists ...

137`);let n=dt(t);for(let o of n.warnings)console.log(`${E.yellow}WARN:${E.reset} ${o}`);if(n.errors.length>0){console.log(`${E.red}FAIL:${E.reset} Framework scaffold incomplete (${n.framework}) \u2014 fix all items before authoring components:`);for(let o of n.errors)console.log(` - ${o}`);return console.log(`

138${E.dim}Fix: setup/index.md \xB7 Next: npx cfm-sdk scaffold-check${E.reset}`),1}return n.framework!=="unknown"&&console.log(`${E.green}OK:${E.reset} Framework scaffold verified (${n.framework})`),console.log(`${E.dim}Core deps OK. Survey-type deps print after fill-implementation-plan --from-fetch.${E.reset}`),console.log(`${E.dim}Scaffold complete \u2014 run npx cfm-sdk seed-phase5 next.${E.reset}`),console.log(`

139${E.dim}${Xt()}${E.reset}`),console.log(`

140${E.dim}Next: Phase 3\u20134 copy bundle + implementation_plan${E.reset}`),0}var gt=h(require("fs")),yt=h(require("path"));k();ne();var b=h(require("fs")),L=h(require("path")),Gs=["src","components","app","lib"],Xs=["src/components/IntroPage.tsx","components/IntroPage.tsx","app/components/IntroPage.tsx"],Ks=["src/components/SurveyPage.tsx","components/SurveyPage.tsx","app/components/SurveyPage.tsx"],Ws=["src/components/EndPage.tsx","components/EndPage.tsx","app/components/EndPage.tsx"],Xn=["src/components/Question.tsx","components/Question.tsx","app/components/Question.tsx"],zt=["CsatMatrixSca ...

141`);for(let i=0;i<s.length;i++){let a=s[i];ti(a)||(Zs.test(a)||ei.test(a))&&t.push(`${n}:${i+1}: hardcoded color \u2014 use survey-ui-config.json + var(--cfm-*)`)}}return t}function oi(e){let t=[],n=Ge(e,Xs);if(!n)return t.push

Long lines were clipped for display.