registry / @getcoherent/cli / 0.22.9

@getcoherent/cli@0.22.9

CLI interface for Coherent Design Method

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 48 file(s), 1.32 MB of source, external domains: api.anthropic.com, console.anthropic.com, getcoherent.design, github.com, i.pravatar.cc, picsum.photos, platform.openai.com, registry.npmjs.org, ui.shadcn.com, www.linkedin.com

Source & flagged code

4 flagged

dist/chunk-75FWKKIT.jsView file

Lines 1-40javascript

1import {

2 CORE_CONSTRAINTS,

3 getDesignQualityForType,

4 inferPageTypeFromRoute

5} from "./chunk-IBR5MENQ.js";

6import {

7 autoFixCode

8} from "./chunk-6JEQFZAM.js";

10// src/commands/chat/plan-generator.ts

11import { z } from "zod";

12import { existsSync as existsSync2, mkdirSync, readFileSync as readFileSync2, writeFileSync } from "fs";

13import { resolve } from "path";

14import chalk from "chalk";

15import { generateSharedComponent } from "@getcoherent/core";

17// src/utils/self-heal.ts

18import { existsSync, readFileSync } from "fs";

19import { join } from "path";

20import { readdir, readFile } from "fs/promises";

21import { execSync } from "child_process";

22var COHERENT_REQUIRED_PACKAGES = [

High

Child Process

Package source references child process execution.

dist/chunk-75FWKKIT.jsView on unpkg · L20

23 "lucide-react",

24 "class-variance-authority",

25 "clsx",

26 "tailwind-merge",

27 "@radix-ui/react-slot"

28];

29var IMPORT_FROM_REGEX = /from\s+['"]([^'"]+)['"]/g;

30var NODE_BUILTINS = /* @__PURE__ */ new Set([

31 "assert",

32 "async_hooks",

33 "buffer",

34 "child_process",

35 "cluster",

36 "console",

37 "constants",

38 "crypto",

39 "dgram",

40 "diagnostics_channel",

Lines 142-182javascript

142 pkgs.forEach((p) => imported.add(p));

143 }

144 const needed = /* @__PURE__ */ new Set([...required, ...imported]);

145

dist/index.jsView file

14761stdio: "inherit", L14762: shell: true L14763: });

High

Shell

Package source references shell execution.

dist/index.jsView on unpkg · L14761

dist/chunk-6JEQFZAM.jsView file

Lines 1689-1729javascript

1689 });

1690 if (hadSelectFix) {

1691 fixes.push("<select> \u2192 shadcn Select");

1692 const selectImport = `import { Select, SelectTrigger, SelectValue, SelectContent, SelectItem } from '@/components/ui/select'`;

1693

Source & flagged code

4 flagged · loading source

dist/chunk-75FWKKIT.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code