registry / @flowlib/cli / 0.0.10

@flowlib/cli@0.0.10

CLI for managing Flowlib database schemas, migrations, and project setup

Static Scan Results

scanned 1h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 7 file(s), 95.3 KB of source, external domains: flowlib.dev

Source & flagged code

4 flagged

dist/index.jsView file

Lines 1-36javascript

1#!/usr/bin/env node

2import {

3 findConfigPath,

4 generateCommand,

5 loadConfig

6} from "./chunk-L2HA4GCW.js";

7import "./chunk-WU6KJKOR.js";

Source & flagged code

4 flagged · loading source

dist/index.jsView file

16import fs from "fs"; L17: import { execSync } from "child_process"; L18: import pc from "picocolors";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L16

377step("Generate Encryption Key"); L378: const crypto2 = await import("crypto"); L379: const encryptionKey = crypto2.randomBytes(32).toString("base64");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L377

dist/chunk-L2HA4GCW.jsView file

686package = @flowlib/cli; repositoryIdentity = flowlib; dependency = @flowlib/db L686: try { L687: const db = await import("@flowlib/db"); L688: coreSchema = db.CORE_SCHEMA;

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/chunk-L2HA4GCW.jsView on unpkg · L686

809const configFile = findDrizzleConfig(); L810: const cmd = configFile ? `npx drizzle-kit generate --config ${configFile}` : "npx drizzle-kit generate"; L811: execSync(cmd, { L812: stdio: ["pipe", "inherit", "inherit"],

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/chunk-L2HA4GCW.jsView on unpkg · L809

Findings

4 High3 Medium4 Low

HighChild Processdist/index.js

HighShell

HighCopied Package Dependency Bridgedist/chunk-L2HA4GCW.js

HighRuntime Package Installdist/chunk-L2HA4GCW.js

MediumDynamic Requiredist/index.js

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Lines 357-397javascript

357 console.log(pc.dim(` ${getInstallCommand(pm, depsToInstall, false)}`));

358 if (devDepsToInstall.length > 0) {

359 console.log(pc.dim(` ${getInstallCommand(pm, devDepsToInstall, true)}`));

360 }

361 debugError("Package installation error", error);

362 }

363 }

364 }

365 step("Create Configuration");

366 const configCode = generateConfigFile(framework, database);

367 const configPath = path.join(process.cwd(), "flowlib.config.ts");

368 if (fs.existsSync(configPath)) {

369 console.log(

370 pc.yellow(` \u26A0 ${path.relative(process.cwd(), configPath)} already exists \u2014 skipping`)

371 );

372 } else {

373 fs.mkdirSync(path.dirname(configPath), { recursive: true });

374 fs.writeFileSync(configPath, configCode, "utf-8");

375 console.log(pc.green(` \u2713 Created ${path.relative(process.cwd(), configPath)}`));

376 }

377 step("Generate Encryption Key");

378 const crypto2 = await import("crypto");

379 const encryptionKey = crypto2.randomBytes(32).toString("base64");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L377

380 const envPath = path.join(process.cwd(), ".env");

381 const envLine = `FLOWLIB_ENCRYPTION_KEY="${encryptionKey}"`;

382 if (fs.existsSync(envPath)) {

383 const envContent = fs.readFileSync(envPath, "utf-8");

384 if (!envContent.includes("FLOWLIB_ENCRYPTION_KEY")) {

385 fs.appendFileSync(envPath, `

386${envLine}

387`);

388 console.log(pc.green(` \u2713 Added FLOWLIB_ENCRYPTION_KEY to .env`));

389 } else {

390 console.log(pc.dim(" \u2139 FLOWLIB_ENCRYPTION_KEY already set in .env"));

391 }

392 } else {

393 fs.writeFileSync(envPath, `${envLine}

394`);

395 console.log(pc.green(` \u2713 Created .env with FLOWLIB_ENCRYPTION_KEY`));

396 }

397 if (schemaTool.id === "drizzle" && !existingDrizzleConfig) {

dist/chunk-L2HA4GCW.jsView file

Lines 666-706javascript

666function printSummaryAlreadyUpToDate() {

667 console.log(pc2.bold(pc2.green("\n\u2713 Schema is already up to date. Nothing to do.\n")));

668}

669async function printSummary(config, stats) {

670 const pluginsWithSchema = config.plugins.filter((p) => p.schema);

671 const pluginsWithRequiredTablesOnly = config.plugins.filter(

672 (p) => !p.schema && Array.isArray(p.requiredTables) && p.requiredTables.length > 0

673 );

674 console.log(

675 pc2.dim(

676 ` Plugins: ${pc2.white(String(config.plugins.length))} loaded` + (pluginsWithSchema.length > 0 ? `, ${pc2.cyan(String(pluginsWithSchema.

677 )

678 );

679 console.log(

680 pc2.dim(

681 ` Tables: ${pc2.white(String(stats.totalTables))} total (${stats.coreTableCount} core` + (stats.pluginTableCount > 0 ? ` + ${pc2.cyan(String(stats.

682 )

683 );

684 if (pluginsWithSchema.length > 0) {

685 let coreSchema;

686 try {

687 const db = await import("@flowlib/db");

688 coreSchema = db.CORE_SCHEMA;

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/chunk-L2HA4GCW.jsView on unpkg · L686

689 } catch {

690 coreSchema = {};

691 }

692 console.log("");

693 for (const plugin of pluginsWithSchema) {

694 const tableNames = Object.keys(plugin.schema);

695 const newTables = tableNames.filter((t) => !(t in coreSchema));

696 const extendedTables = tableNames.filter((t) => t in coreSchema);

697 console.log(pc2.dim(` Plugin ${pc2.cyan(plugin.id)}:`));

698 for (const t of newTables) {

699 const fields = Object.keys(

700 // oxlint-disable-next-line typescript/no-explicit-any -- plugin schema type is abstract Record

701 plugin.schema[t]?.fields || {}

702 );

703 console.log(

704 pc2.green(` + ${t}`) + pc2.dim(` (new table, ${fields.length} field${fields.length !== 1 ? "s" : ""})`)

705 );

706 }

Lines 789-829javascript

789 const existing = process.env.NODE_OPTIONS || "";

790 return {

791 ...process.env,

792 NODE_OPTIONS: existing.includes("--no-deprecation") ? existing :