registry / @guren/cli / 1.0.0

@guren/cli@1.0.0

Static Scan Results

scanned 1h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 14 file(s), 2.29 MB of source, external domains: accounts.google.com, api.nodemailer.com, bun.sh, ethereal.email, gist.github.com, github.com, hono.dev, json-schema.org, mail.google.com, mathiasbynens.be, nodemailer.com, openapi.vercel.sh, railway.app, raw.githubusercontent.com, registry.npmjs.org, spec.openapis.org, stackoverflow.com, tools.ietf.org, www.w3.org

Source & flagged code

7 flagged

dist/bin.jsView file

Lines 35-75javascript

35 renderCheckReport,

36 resetDatabase,

37 resolveDatabaseModule,

38 runBlueprint,

39 runCheck,

40 runDatabaseMigrations,

41 runDatabaseSeeders,

42 runDoctor,

43 scaffoldDeploy,

44 upgradeCanary,

45 writeKeyToEnv

46} from "./chunk-IAWGR7B5.js";

47import {

48 kebabCase,

49 scaffoldFile

50} from "./chunk-H65HHNPZ.js";

51import "./chunk-KNOQDHZ5.js";

52import "./chunk-I3ZGYIDU.js";

53import "./chunk-4VNS5WPM.js";

55// src/bin.ts

56import { spawn } from "child_process";

57import { pathToFileURL as pathToFileURL7 } from "url";

High

Child Process

Package source references child process execution.

dist/bin.jsView on unpkg · L55

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/bin.jsView on unpkg · L55

58import { consola as consola11 } from "consola";

59import { defineCommand as defineCommand2, runMain, showUsage } from "citty";

61// src/make-command.ts

62var COMMANDS_DIR = "app/Console/Commands";

63function commandTemplate(className, commandName) {

64 return `import { Command } from '@guren/core'

66export default class ${className} extends Command {

67 static signature = '${commandName}'

68 static description = 'Command description'

70 async handle(): Promise<void> {

71 this.info('Done!')

72 }

73}

74`;

75}

Lines 363-415javascript

363 return;

364 }

365 try {

366 await maybeBoot.call(app);

367 } catch (error) {

368 consola2.warn("Application boot() rejected:", error);

369 }

370}

Lines 1506-1546javascript

1506 string: "The :attribute must be a string.",

1507 numeric: "The :attribute must be a number.",

1508 min: {

1509 string: "The :attribute must be at least :min characters.",

1510 numeric: "The :attribute must be at least :min."

1511 },

dist/chunk-IAWGR7B5.jsView file

17705if (error) { L17706: if (command.name === "exec" && error.message === "EXECABORT Transaction discarded because of previous errors.") { L17707: continue;

High

Shell

Package source references shell execution.

dist/chunk-IAWGR7B5.jsView on unpkg · L17705

25801package = @guren/cli; repositoryIdentity = guren; dependency = @babel/parser L25801: const source = await readFile5(filePath, "utf-8"); L25802: const { parse: parse8 } = await import("@babel/parser"); L25803: let ast;

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/chunk-IAWGR7B5.jsView on unpkg · L25801

Source & flagged code

7 flagged · loading source

dist/bin.jsView file

55// src/bin.ts L56: import { spawn } from "child_process"; L57: import { pathToFileURL as pathToFileURL7 } from "url";

High

Child Process

Package source references child process execution.

dist/bin.jsView on unpkg · L55

55Cross-file remote execution chain: dist/bin.js spawns dist/chunk-IAWGR7B5.js; helper contains network access plus dynamic code execution. L55: // src/bin.ts L56: import { spawn } from "child_process"; L57: import { pathToFileURL as pathToFileURL7 } from "url"; ... L302: async function resolveMainEntry() { L303: const cwd = process.cwd(); L304: for (const candidate of MAIN_ENTRY_CANDIDATES) { ... L471: } L472: const useColors = process.stdout.isTTY; L473: const output = inspect(value, { depth: 4, colors: useColors, breakLength: 80 }); L474: process.stdout.write(`${output} L475: `); ... L994: const content = readFileSync(cacheFile, "utf-8");

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/bin.jsView on unpkg · L55

1526patternName = generic_password severity = medium line = 1526 matchedText = password...t.",

Medium

Secret Pattern

Package contains a possible secret pattern.

Findings

4 High5 Medium5 Low

HighChild Processdist/bin.js

HighShelldist/chunk-IAWGR7B5.js

HighCopied Package Dependency Bridgedist/chunk-IAWGR7B5.js

HighCross File Remote Execution Contextdist/bin.js

MediumSecret Patterndist/bin.js

MediumDynamic Requiredist/bin.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvaldist/bin.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings