registry / @getcoherent/cli / 0.21.0

@getcoherent/cli@0.21.0

CLI interface for Coherent Design Method

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 47 file(s), 1.31 MB of source, external domains: console.anthropic.com, getcoherent.design, github.com, i.pravatar.cc, picsum.photos, platform.openai.com, registry.npmjs.org, ui.shadcn.com, www.linkedin.com

Source & flagged code

4 flagged

dist/chunk-75FWKKIT.jsView file

Lines 1-40javascript

1import {

2 CORE_CONSTRAINTS,

3 getDesignQualityForType,

4 inferPageTypeFromRoute

5} from "./chunk-IBR5MENQ.js";

6import {

7 autoFixCode

8} from "./chunk-6JEQFZAM.js";

10// src/commands/chat/plan-generator.ts

11import { z } from "zod";

12import { existsSync as existsSync2, mkdirSync, readFileSync as readFileSync2, writeFileSync } from "fs";

13import { resolve } from "path";

14import chalk from "chalk";

15import { generateSharedComponent } from "@getcoherent/core";

17// src/utils/self-heal.ts

18import { existsSync, readFileSync } from "fs";

19import { join } from "path";

20import { readdir, readFile } from "fs/promises";

21import { execSync } from "child_process";

22var COHERENT_REQUIRED_PACKAGES = [

High

Child Process

Package source references child process execution.

dist/chunk-75FWKKIT.jsView on unpkg · L20

23 "lucide-react",

24 "class-variance-authority",

25 "clsx",

26 "tailwind-merge",

27 "@radix-ui/react-slot"

28];

29var IMPORT_FROM_REGEX = /from\s+['"]([^'"]+)['"]/g;

30var NODE_BUILTINS = /* @__PURE__ */ new Set([

31 "assert",

32 "async_hooks",

33 "buffer",

34 "child_process",

35 "cluster",

36 "console",

37 "constants",

38 "crypto",

39 "dgram",

40 "diagnostics_channel",

Lines 142-182javascript

142 pkgs.forEach((p) => imported.add(p));

143 }

144 const needed = /* @__PURE__ */ new Set([...required, ...imported]);

145 return [...needed].filter((p) => !installed.

dist/index.jsView file

14733stdio: "inherit", L14734: shell: true L14735: });

High

Shell

Package source references shell execution.

dist/index.jsView on unpkg · L14733

dist/chunk-6JEQFZAM.jsView file

Lines 1689-1729javascript

1689 });

1690 if (hadSelectFix) {

1691 fixes.push("<select> \u2192 shadcn Select");

1692 const selectImport = `import { Select, SelectTrigger, SelectValue, SelectContent, SelectItem } from '@/components/ui/select'`;

1693 if (!/from\s+['"]@\/

Source & flagged code

4 flagged · loading source

dist/chunk-75FWKKIT.jsView file

20import { readdir, readFile } from "fs/promises"; L21: import { execSync } from "child_process"; L22: var COHERENT_REQUIRED_PACKAGES = [

High

Child Process

Package source references child process execution.

dist/chunk-75FWKKIT.jsView on unpkg · L20

162if (hasPnpm) { L163: execSync(`pnpm add ${safe.join(" ")}`, { cwd: projectRoot, stdio: "pipe" }); L164: } else {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/chunk-75FWKKIT.jsView on unpkg · L162

dist/index.jsView file

14733stdio: "inherit", L14734: shell: true L14735: });

High

Shell

Package source references shell execution.

dist/index.jsView on unpkg · L14733

dist/chunk-6JEQFZAM.jsView file

1709try { L1710: const { createRequire } = await import("module"); L1711: const require2 = createRequire(process.cwd() + "/package.json");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/chunk-6JEQFZAM.jsView on unpkg · L1709

Findings

3 High4 Medium4 Low

HighChild Processdist/chunk-75FWKKIT.js

HighShelldist/index.js

HighRuntime Package Installdist/chunk-75FWKKIT.js

MediumDynamic Requiredist/chunk-6JEQFZAM.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

dist/chunk-75FWKKIT.jsView file

Lines 1-40javascript

1import {

2 CORE_CONSTRAINTS,

3 getDesignQualityForType,

4 inferPageTypeFromRoute

5} from "./chunk-IBR5MENQ.js";

6import {

7 autoFixCode

8} from "./chunk-6JEQFZAM.js";

10// src/commands/chat/plan-generator.ts

11import { z } from "zod";

12import { existsSync as existsSync2, mkdirSync, readFileSync as readFileSync2, writeFileSync } from "fs";

13import { resolve } from "path";

14import chalk from "chalk";

15import { generateSharedComponent } from "@getcoherent/core";

17// src/utils/self-heal.ts

18import { existsSync, readFileSync } from "fs";

19import { join } from "path";

20import { readdir, readFile } from "fs/promises";

21import { execSync } from "child_process";

22var COHERENT_REQUIRED_PACKAGES = [

High

Child Process

Package source references child process execution.

dist/chunk-75FWKKIT.jsView on unpkg · L20

23 "lucide-react",

24 "class-variance-authority",

25 "clsx",

26 "tailwind-merge",

27 "@radix-ui/react-slot"

28];

29var IMPORT_FROM_REGEX = /from\s+['"]([^'"]+)['"]/g;

30var NODE_BUILTINS = /* @__PURE__ */ new Set([

31 "assert",

32 "async_hooks",

33 "buffer",

34 "child_process",

35 "cluster",

36 "console",

37 "constants",

38 "crypto",

39 "dgram",

40 "diagnostics_channel",

Lines 142-182javascript

142 pkgs.forEach((p) => imported.add(p));

143 }

144 const needed = /* @__PURE__ */ new Set([...required, ...imported]);

145 return [...needed].filter((p) => !installed.

dist/index.jsView file

14733stdio: "inherit", L14734: shell: true L14735: });

High

Shell

Package source references shell execution.

dist/index.jsView on unpkg · L14733

dist/chunk-6JEQFZAM.jsView file

Lines 1689-1729javascript

1689 });

1690 if (hadSelectFix) {

1691 fixes.push("<select> \u2192 shadcn Select");

1692 const selectImport = `import { Select, SelectTrigger, SelectValue, SelectContent, SelectItem } from '@/components/ui/select'`;

1693 if (!/from\s+['"]@\/