registry / @flopod/cli / 0.6.0

@flopod/cli@0.6.0

The Flopod engine + host package. Despite the `cli` name, it ships two things on top of one shared core:

Static Scan Results

scanned 4d ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 25 file(s), 256 KB of source, external domains: fly.io

Source & flagged code

4 flagged

dist/git.jsView file

Lines 1-21javascript

1import { spawnSync } from 'child_process';

2import { existsSync, readFileSync, writeFileSync } from 'fs';

High

Child Process

Package source references child process execution.

dist/git.jsView on unpkg · L1

3import { join } from 'path';

4import { friendlyName } from './draftname.js';

5/** Run a git command in `cwd`, capturing output. Never throws — failure is data. */

6function git(cwd, args) {

7 const r = spawnSync('git', args, { cwd, encoding: 'utf8' });

8 return { ok: !r.error && r.status === 0, out: ((r.stdout ?? '') + (r.stderr ?? '')).trim() };

10/**

11 * Is `cwd` a flopod project's OWN git repo — i.e. does `.git` live at `cwd` itself?

12 *

13 * Deliberately NOT `git rev-parse --is-inside-work-tree`: that returns true when *any ancestor*

14 * is a repo, so a project scaffolded inside a monorepo (or any enclosing repo) would be judged

15 * "already a repo", checkpoints would land in the PARENT's history, and `history()` would show

16 * the parent's log. A flopod project is its own repo iff it has a `.git` at its root.

17 */

18export function isRepo(cwd) {

19 return existsSync(join(cwd, '.git'));

20}

21/** The lines a flopod repo should ignore — derived artifacts and per-env run data, never source. */

Lines 435-475javascript

435 pkg = JSON.parse(text);

436 }

437 catch {

438 return '{}';

439 }

440 const pick = (k) => (pkg[k] ?? {});

441 const merged

dist/providers/fly.jsView file

Lines 1-21javascript

1import { spawnSync } from 'child_process';

2import { existsSync, readFileSync, readdirSync } from 'fs';

3import { homedir } from 'os';

4import { join } from 'path';

5import { resolveDataDir } from '@flopod/runtime';

dist/commands/new.jsView file

Lines 18-58javascript

18 mkdirSync(join(dir, 'src'), { recursive: true });

19 mkdirSync(join(dir, '.vscode'), { recursive: true });

20 for (const skill of BUNDLED_SKILLS) {

21 mkdirSync(join(dir, '.claude'

Source & flagged code

4 flagged · loading source

dist/git.jsView file

1import { spawnSync } from 'child_process'; L2: import { existsSync, readFileSync, writeFileSync } from 'fs';

High

Child Process

Package source references child process execution.

dist/git.jsView on unpkg · L1

455* fast-forwarded; a failed install is a fixable follow-up, not a reason to strand the draft). L456: * `shell: true` is required so Windows can invoke `npm.cmd` — Node 20+ refuses to spawn a `.cmd` L457: * directly (EINVAL) without a shell. The args are fixed (no user input), so the DEP0190 shell-arg

High

Shell

Package source references shell execution.

dist/git.jsView on unpkg · L455

dist/providers/fly.jsView file

1import { spawnSync } from 'child_process'; L2: import { existsSync, readFileSync, readdirSync } from 'fs'; ... L13: function installHint() { L14: const cmd = process.platform === 'win32' L15: ? 'pwsh -Command "iwr https://fly.io/install.ps1 -useb | iex"' L16: : 'curl -L https://fly.io/install.sh | sh'; ... L35: const ext = process.platform === 'win32' ? '.exe' : ''; L36: candidates.push(join(homedir(), '.fly', 'bin', `flyctl${ext}`)); L37: for (const bin of candidates) { ... L48: } L49: /** Run a Fly command quietly and capture stdout (for probes like whoami/status). */ L50: /** Docker `--build-arg` pairs stamping the image's identity (surfaced under Settings → Version):

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/providers/fly.jsView on unpkg · L1

dist/commands/new.jsView file

38console.log('Installing dependencies (flopod + TS types)...'); L39: execSync('npm install --prefer-offline --no-audit --no-fund', { cwd: dir, stdio: 'inherit' }); L40: // A project is its OWN local git repo — the source-control substrate

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/commands/new.jsView on unpkg · L38

Findings

4 High2 Medium5 Low

HighChild Processdist/git.js

HighShelldist/git.js

HighSandbox Evasion Gated Capabilitydist/providers/fly.js

HighRuntime Package Installdist/commands/new.js

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

4 flagged

dist/git.jsView file

Lines 1-21javascript

1import { spawnSync } from 'child_process';

2import { existsSync, readFileSync, writeFileSync } from 'fs';

High

Child Process

Package source references child process execution.

dist/git.jsView on unpkg · L1

3import { join } from 'path';

4import { friendlyName } from './draftname.js';

5/** Run a git command in `cwd`, capturing output. Never throws — failure is data. */

6function git(cwd, args) {

7 const r = spawnSync('git', args, { cwd, encoding: 'utf8' });

8 return { ok: !r.error && r.status === 0, out: ((r.stdout ?? '') + (r.stderr ?? '')).trim() };

10/**

11 * Is `cwd` a flopod project's OWN git repo — i.e. does `.git` live at `cwd` itself?

12 *

13 * Deliberately NOT `git rev-parse --is-inside-work-tree`: that returns true when *any ancestor*

14 * is a repo, so a project scaffolded inside a monorepo (or any enclosing repo) would be judged

15 * "already a repo", checkpoints would land in the PARENT's history, and `history()` would show

16 * the parent's log. A flopod project is its own repo iff it has a `.git` at its root.

17 */

18export function isRepo(cwd) {

19 return existsSync(join(cwd, '.git'));

20}

21/** The lines a flopod repo should ignore — derived artifacts and per-env run data, never source. */

Lines 435-475javascript

435 pkg = JSON.parse(text);

436 }

437 catch {

438 return '{}';

439 }

440 const pick = (k) => (pkg[k] ?? {});

441 const merged

dist/providers/fly.jsView file

Lines 1-21javascript

1import { spawnSync } from 'child_process';

2import { existsSync, readFileSync, readdirSync } from 'fs';

3import { homedir } from 'os';

4import { join } from 'path';

5import { resolveDataDir } from '@flopod/runtime';

dist/commands/new.jsView file

Lines 18-58javascript

18 mkdirSync(join(dir, 'src'), { recursive: true });

19 mkdirSync(join(dir, '.vscode'), { recursive: true });

20 for (const skill of BUNDLED_SKILLS) {

21 mkdirSync(join(dir, '.claude'