registry / @gouvfr/dsfr-nexus / 1.2.8

@gouvfr/dsfr-nexus@1.2.8

Le module `dsfr-nexus` est l'interface de ligne de commande (CLI) centrale du Système de Design de l’État - DSFR. Il offre des outils pour gérer et compiler les ressources du DSFR

Static Scan Results

scanned 1h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 167 file(s), 235 KB of source, external domains: github.com, raw.githubusercontent.com, semver.org, www.systeme-de-design.gouv.fr

Source & flagged code

3 flagged

src/configure/dsfr-archive/archive-release.jsView file

Lines 1-21javascript

1import fs from 'fs';

2import { spawnSync } from 'child_process';

3import { VersionParser } from '../dsfr/state/version/version-parser.js';

High

Source & flagged code

3 flagged · loading source

src/configure/dsfr-archive/archive-release.jsView file

1import fs from 'fs'; L2: import { spawnSync } from 'child_process'; L3: import { VersionParser } from '../dsfr/state/version/version-parser.js';

High

Child Process

Package source references child process execution.

src/configure/dsfr-archive/archive-release.jsView on unpkg · L1

src/generate/dsfr/part/part-generator.jsView file

27L28: const module = await import(moduleUrl); L29: const GeneratorConstructor =

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/generate/dsfr/part/part-generator.jsView on unpkg · L27

src/preview/dsfr-root/start/start-previewer.jsView file

11log.info(`${command} (cwd: ${cwd})`); L12: execSync(command, { cwd, stdio: 'inherit' }); L13: }; ... L17: const steps = [ L18: { command: 'yarn install --mode=skip-build', cwd: ROOT }, L19: { command: 'yarn build', cwd: fromRoot('internals/integration/loom') },

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/preview/dsfr-root/start/start-previewer.jsView on unpkg · L11

Findings

3 High3 Medium4 Low

HighChild Processsrc/configure/dsfr-archive/archive-release.js

HighShell

HighRuntime Package Installsrc/preview/dsfr-root/start/start-previewer.js

MediumDynamic Requiresrc/generate/dsfr/part/part-generator.js

MediumNetwork

MediumStructural Risk Force Deep Review

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

src/generate/dsfr/part/part-generator.jsView file

Lines 7-47javascript

7 this._state = state;

8 this._canWrite = false;

9 }

11 get state () {

12 return this._state;

13 }

15 async read () {

16 this._data = readYAMLSync(this._state.configFile('data.yml'));

18 if (!this._data.generation) return;

19 const generation = readYAMLSync(this._data.generation.config);

21 const baseDir = path.dirname('./');

23 this._generators = [];

24 for (const generatorData of generation.generators) {

25 const resolvedPath = path.resolve(baseDir, generatorData.path);

26 const moduleUrl = pathToFileURL(resolvedPath).href;

28 const module = await import(moduleUrl);

29 const GeneratorConstructor =

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/generate/dsfr/part/part-generator.jsView on unpkg · L27

30 module.default ?? module.Generator ?? Object.values(module)[0];

32 const generator = new GeneratorConstructor(generatorData.dest);

33 this._generators.push(generator);

34 }

36 this._canWrite = this._generators.length > 0;

37 }

39 async write () {

40 if (!this._canWrite) return;

41 const outputs = [];

42 for (const generator of this._generators) {

43 outputs.push(... await generator.output());

44 }

46 for (const output of outputs) {

47 createFile(output.filepath, output.content);

src/preview/dsfr-root/start/start-previewer.jsView file

Lines 1-31javascript

1import path from 'path';

2import { execSync } from 'child_process';

3import { log } from '@gouvfr/dsfr-forge';

5const ROOT = process.cwd();

6const fromRoot = (...segments) => path.join(ROOT, ...segments);

8const DSFR_DIR = fromRoot('dsfr');

10const run = (command, cwd) => {

11 log.info(`${command} (cwd: ${cwd})`);

12 execSync(command, { cwd, stdio: 'inherit' });

13};

15class StartPreviewer {

16 get steps () {

17 const steps = [

18 { command: 'yarn install --mode=skip-build', cwd: ROOT },

19 { command: 'yarn build', cwd: fromRoot('internals/integration/loom') },

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/preview/dsfr-root/start/start-previewer.jsView on unpkg · L11

20 { command: 'yarn dsfr configure', cwd: DSFR_DIR },

21 { command: 'yarn dsfr modulate', cwd: DSFR_DIR },

22 { command: 'yarn dsfr compile', cwd: DSFR_DIR },

23 { command: 'yarn dsfr compose', cwd: DSFR_DIR },

24 ];

26 return steps;

27 }

29 async start () {

30 for (const { command, cwd } of this.steps) {

31 run(command, cwd);