registry / @fragment-dev/cli / 2026.10.27-6

@fragment-dev/cli@2026.10.27-6

⚠ Under review

FRAGMENT CLI

Static Scan Results

scanned 8d ago · by rust-scanner

Static analysis completed at 72.0% confidence. No malicious behavior was detected; 14 low-signal pattern(s) were surfaced and cleared.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStringsPossibleObfuscationTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 116 file(s), 5.51 MB of source, external domains: 127.0.0.1, api.us-west-2.fragment.dev, auth.fragment.dev, commonmark.org, dashboard.fragment.dev, dev.apollodata.com, en.wikipedia.org, eu-assets.i.posthog.com, eu.i.posthog.com, fleegix.org, fragment.dev, github.com, posthog.com, raw.githubusercontent.com, registry.npmjs.org, sentry.io, us-assets.i.posthog.com, us.i.posthog.com, yarnpkg.com

Source & flagged code

6 flagged

dist/open-SJMVVA3H.jsView file

11import { promisify as promisify5 } from "node:util"; L12: import childProcess from "node:child_process"; L13: import fs5, { constants as fsConstants2 } from "node:fs/promises";

High

Child Process

Package source references child process execution.

dist/open-SJMVVA3H.jsView on unpkg · L11

dist/chunk-VPOARVKJ.jsView file

105Cross-file remote execution chain: dist/chunk-VPOARVKJ.js spawns dist/chunk-QF5EN33L.js; helper contains network access plus dynamic code execution. L105: function isProd() { L106: return !["development", "test"].includes(process.env.NODE_ENV ?? ""); L107: } ... L2227: if (useCache && cache.has(path)) { L2228: return JSON.parse(cache.get(path)); L2229: } ... L2308: L2309: // ../../node_modules/@oclif/core/package.json L2310: var require_package = __commonJS({ ... L2316: author: "Salesforce", L2317: bugs: "https://github.com/oclif/core/issues", L2318: dependencies: {

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/chunk-VPOARVKJ.jsView on unpkg · L105

2187exports.existsSync = existsSync2; L2188: var node_fs_1 = __require("node:fs"); L2189: var promises_1 = __require("node:fs/promises");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/chunk-VPOARVKJ.jsView on unpkg · L2187

2709exports.localsName = _DEFAULT_LOCALS_NAME; L2710: exports.promiseImpl = new Function("return this;")().Promise; L2711: exports.resolveInclude = function(name, filename, isDir) {

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/chunk-VPOARVKJ.jsView on unpkg · L2709

bin/dev.cmdView file

•path = bin/dev.cmd kind = build_helper sizeBytes = 30 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/dev.cmdView on unpkg

dist/chunk-QDAKBUNO.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/chunk-QDAKBUNO.js#virtual:normalized:round1View on unpkg

Findings

3 High5 Medium6 Low

HighChild Processdist/open-SJMVVA3H.js

HighCross File Remote Execution Contextdist/chunk-VPOARVKJ.js

HighSemantic Analysis Limiteddist/chunk-QDAKBUNO.js#virtual:normalized:round1

MediumDynamic Requiredist/chunk-VPOARVKJ.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperbin/dev.cmd

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvaldist/chunk-VPOARVKJ.js

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

Affected versions and remediation

This report applies to @fragment-dev/cli@2026.10.27-6.

See all versions of @fragment-dev/cli for other recorded verdicts.

Review the evidence and your use of @fragment-dev/cli@2026.10.27-6 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-27 21:59:43.144Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

registry / @fragment-dev/cli / 2026.10.27-6

@fragment-dev/cli@2026.10.27-6

⚠ Under review

FRAGMENT CLI

Static Scan Results

scanned 8d ago · by rust-scanner

Static analysis completed at 72.0% confidence. No malicious behavior was detected; 14 low-signal pattern(s) were surfaced and cleared.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStringsPossibleObfuscationTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

Source & flagged code

6 flagged

dist/open-SJMVVA3H.jsView file

11import { promisify as promisify5 } from "node:util"; L12: import childProcess from "node:child_process"; L13: import fs5, { constants as fsConstants2 } from "node:fs/promises";

High

Child Process

Package source references child process execution.

dist/open-SJMVVA3H.jsView on unpkg · L11

dist/chunk-VPOARVKJ.jsView file

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/chunk-VPOARVKJ.jsView on unpkg · L105

2187exports.existsSync = existsSync2; L2188: var node_fs_1 = __require("node:fs"); L2189: var promises_1 = __require("node:fs/promises");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/chunk-VPOARVKJ.jsView on unpkg · L2187

2709exports.localsName = _DEFAULT_LOCALS_NAME; L2710: exports.promiseImpl = new Function("return this;")().Promise; L2711: exports.resolveInclude = function(name, filename, isDir) {

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/chunk-VPOARVKJ.jsView on unpkg · L2709

bin/dev.cmdView file

•path = bin/dev.cmd kind = build_helper sizeBytes = 30 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/dev.cmdView on unpkg

dist/chunk-QDAKBUNO.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/chunk-QDAKBUNO.js#virtual:normalized:round1View on unpkg

Findings

3 High5 Medium6 Low

HighChild Processdist/open-SJMVVA3H.js

HighCross File Remote Execution Contextdist/chunk-VPOARVKJ.js

HighSemantic Analysis Limiteddist/chunk-QDAKBUNO.js#virtual:normalized:round1

MediumDynamic Requiredist/chunk-VPOARVKJ.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperbin/dev.cmd

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvaldist/chunk-VPOARVKJ.js

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

Affected versions and remediation

This report applies to @fragment-dev/cli@2026.10.27-6.

See all versions of @fragment-dev/cli for other recorded verdicts.

Review the evidence and your use of @fragment-dev/cli@2026.10.27-6 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-27 21:59:43.144Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.