registry / @gjsify/cli / 0.16.6

@gjsify/cli@0.16.6

⚠ Under review

CLI for Gjsify

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 17 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 101 file(s), 1.08 MB of source, external domains: esbuild.github.io, flathub.org, github.com, raw.githubusercontent.com, registry.npmjs.org, rolldown.rs, www.npmjs.com

Oversized source lightweight scan

dist/cli.gjs.mjs6.23 MB file, sampled 256 KB

FilesystemNetworkChildProcessEnvironmentVarsCryptoObfuscatedHighEntropyStringsMinifiedUrlStringsregistry.npmjs.orgrolldown.rs

Source & flagged code

8 flagged

lib/utils/oxc-resolve.jsView file

Lines 30-70javascript

30// knows exactly which optionalDependency npm failed to place.

31//

32// NATIVE ENGINE (GJS) — `@gjsify/oxfmt-native`

33// ────────────────────────────────────────────

34// Under GJS the Node launcher path is a dead end: there is no Node host to

35// spawn. For oxfmt the dual-engine pick mirrors `bundler-pick.ts`'s

36// native/npm pattern exactly: `shouldUseNativeOxfmt()` prefers the

37// `@gjsify/oxfmt-native` GI bridge (Vala/Rust prebuild wrapping the full

38// pure-Rust oxfmt CLI — config resolution, ignore handling, file walking,

39// --write/--check/--list-different) when running under GJS and the prebuild

40// is loadable, and falls back to spawning the Node launcher otherwise.

41// `GJSIFY_OXFMT=native|npm` is the explicit override (native throws when the

42// prebuild isn't loadable instead of silently switching engines).

43//

44// oxlint has NO native path yet: its JS-plugin host (the internal

45// `gjsify/register-class-order` rule wired via `.oxlintrc.json` jsPlugins)

46// lives in the Node launcher, so a native oxlint bridge could only run the

47// Rust rule subset. Lint stays Node-spawned until that trade-off is decided

48// (tracked in STATUS.md Open TODOs).

49import { existsSync, readFileSync } from 'node:fs';

50import { join, resolve } from 'node:path';

51import { spawn, spawnSync } from 'node:child_process';

52import { createRequire } from 'node:module';

High

Child Process

Package source references child process execution.

lib/utils/oxc-resolve.jsView on unpkg · L50

53import { pathToFileURL } from 'node:url';

54import { findWorkspaceRoot } from './workspace-root.js';

55import { resolveNpmPackage } from './resolve-npm-package.js';

56import { nodeBinary } from './run-node.js';

57import { isGjs } from '@gjsify/rolldown-plugin-gjsify/runtime';

58/**

59 * Map Node.js `process.platform` + `arch` (+ musl on Linux) to the

60 * napi-rs binding-package suffix oxc uses, e.g. `linux-x64-gnu`,

61 * `linux-x64-musl`, `darwin-arm64`, `win32-x64-msvc`.

62 *

63 * Mirrors biome-resolve's platform detection (same musl probe), adapted to

64 * oxc's napi-rs target naming (gnu/musl libc suffix on Linux, -msvc on

65 * Windows).

66 */

67function oxcBindingSuffix() {

68 const platform = process.platform;

69 const arch = process.arch;

70 let plat;

lib/utils/run-lifecycle-script.jsView file

Lines 1-33javascript

1// Run an npm-style lifecycle script (`prepack`, `prepare`, `prepublishOnly`,

2// `postpack`, `postpublish`, …) from inside a `gjsify pack` / `gjsify

3// publish` flow.

4//

5// Why this exists separately from `gjsify run`: `gjsify run <script>` ends

6// with `process.exit(<code>)` so it can be used as a CLI entrypoint that

7// behaves like `yarn run` / `npm run`. That's wrong for the embedded use

8// case where pack/publish needs the lifecycle script to finish, then keep

9// running its own logic. This helper resolves to a Promise that settles

10// when the child exits — no process.exit, no GLib-mainloop intermingling

lib/bundler-pick.jsView file

Lines 17-57javascript

17//

18// Plugin shape conversion: rolldown plugins may declare hooks either

19// as bare functions (`load(id)`) or as `{filter, handler}` objects.

20// Both shapes are translated to `NativePlugin` form. `filter.id`

21// regex/string sources become `idFilter.<hook>` regex strings on the

22// Rust side. `this.resolve()` / `this.warn()` / `this.error()` calls

23// inside hook handlers route through the B.3 nested protocol.

24//

25// Plugins that depend on rolldown context methods we don't implement

26// (`this.parse`, `this.emitFile`, `this.getModuleInfo`, …) will fail

27// at hook-call time. The current gjsify plugin set doesn't use any

lib/commands/pack.jsView file

Lines 1-32javascript

1// `gjsify pack [path] [--pack-destination <dir>] [--json]` — npm-compatible

2// tarball creation for the workspace at `path` (default: cwd).

3//

4// Output shape matches `npm pack --json`:

5// [

6// {

7// "filename": "scope-name-1.2.3.tgz",

8// "name": "@scope/name",

9// "version": "1.2.3",

10// "size": <unpacked bytes>,

11// "unpackedSize": <unpacked bytes>,

12// "shasum": "<sha1 hex>",

lib/utils/install-backend.jsView file

Lines 1-24javascript

1// Install backend abstraction.

2//

3// Default: native backend (resolves packuments via @gjsify/npm-registry,

4// extracts tarballs via @gjsify/tar — no Node, no npm required at runtime).

5// Fallback: `npm install --no-package-lock --no-audit --no-fund --prefix <dir> <specs...>`,

6// for parity with the legacy code path. Switched via

7// `GJSIFY_INSTALL_BACKEND=native|npm`.

8//

9// `gjsify dlx` uses this seam — installing under a cache prefix, with no

10// package.json update to the user's project. The native backend matches that

11// workflow without ever shelling out to Node.

dist/cli.gjs.mjsView file

•path = dist/cli.gjs.mjs kind = oversized_source_file sizeBytes = 6530038 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/cli.gjs.mjsView on unpkg

•path = dist/cli.gjs.mjs kind = oversized_cli_entrypoint sizeBytes = 6530038 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/cli.gjs.mjsView on unpkg

lib/commands/install.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @gjsify/cli@0.15.1 matchedIdentity = npm:QGdqc2lmeS9jbGk:0.15.1 similarity = 0.865 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/commands/install.jsView on unpkg

Source & flagged code

8 flagged · loading source

lib/utils/oxc-resolve.jsView file

50import { join, resolve } from 'node:path'; L51: import { spawn, spawnSync } from 'node:child_process'; L52: import { createRequire } from 'node:module';

High

Child Process

Package source references child process execution.

lib/utils/oxc-resolve.jsView on unpkg · L50

lib/utils/run-lifecycle-script.jsView file

13// Matches yarn / npm script semantics: L14: // - `shell: true` so `&&` / `|` / env-var refs work L15: // - PATH prepended with `<wsDir>/node_modules/.bin` + monorepo-root bin

High

Shell

Package source references shell execution.

lib/utils/run-lifecycle-script.jsView on unpkg · L13

lib/bundler-pick.jsView file

37// it eagerly at module init pulls musl-detection code that does L38: // `require('node:fs')` synchronously — fine on Node, but fatal under GJS L39: // where the createRequire polyfill rejects synchronous builtin loads.

Medium

Dynamic Require

Package source references dynamic require/import behavior.

lib/bundler-pick.jsView on unpkg · L37

lib/commands/pack.jsView file

12// "shasum": "<sha1 hex>", L13: // "integrity": "sha512-<base64>", L14: // "files": [ { path, size, mode }, ... ], ... L19: // File selection mirrors npm pack: explicit `files` field if present, else L20: // the default allowlist (README/LICENSE/package.json + main entry + bin). The L21: // implementation here is conservative — when no `files` field is set we walk ... L45: .option('json', { L46: description: 'Emit pack metadata as JSON on stdout (mirrors `npm pack --json`).', L47: type: 'boolean', ... L62: handler: async (args) => { L63: const wsDir = resolve(args.path ?? process.cwd()); L64: const result = await packWorkspace(wsDir, {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

lib/commands/pack.jsView on unpkg · L12

lib/utils/install-backend.jsView file

4// extracts tarballs via @gjsify/tar — no Node, no npm required at runtime). L5: // Fallback: `npm install --no-package-lock --no-audit --no-fund --prefix <dir> <specs...>`, L6: // for parity with the legacy code path. Switched via ... L14: // already covers reproducibility. `--no-audit --no-fund` cuts ~5s off cold runs. L15: import { spawn } from 'node:child_process'; L16: import { writeFileSync } from 'node:fs';

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

lib/utils/install-backend.jsView on unpkg · L4

dist/cli.gjs.mjsView file

•path = dist/cli.gjs.mjs kind = oversized_source_file sizeBytes = 6530038 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/cli.gjs.mjsView on unpkg

•path = dist/cli.gjs.mjs kind = oversized_cli_entrypoint sizeBytes = 6530038 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/cli.gjs.mjsView on unpkg

lib/commands/install.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/commands/install.jsView on unpkg

Findings

1 Critical4 High5 Medium7 Low

CriticalPrevious Version Dangerous Deltalib/commands/install.js

HighChild Processlib/utils/oxc-resolve.js

HighShelllib/utils/run-lifecycle-script.js

HighRuntime Package Installlib/utils/install-backend.js

HighOversized Source Filedist/cli.gjs.mjs

MediumDynamic Requirelib/bundler-pick.js

MediumNetwork

MediumEnvironment Vars

MediumOversized Cli Entrypointdist/cli.gjs.mjs

MediumStructural Risk Force Deep Review

LowScripts Present

LowEval

LowWeak Cryptolib/commands/pack.js

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings