registry / @happyvertical/smrt-cli / 0.37.3

@happyvertical/smrt-cli@0.37.3

Developer CLI for SMRT framework - introspection, testing, and project management

Static Scan Results

scanned 7d ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 6 file(s), 383 KB of source, external domains: bitbucket.org, github.com, gitlab.com

Source & flagged code

4 flagged

bin/smrt.jsView file

Lines 1-22javascript

1#!/usr/bin/env node

3import { spawnSync } from 'node:child_process';

4import { existsSync } from 'node:fs';

High

Child Process

Package source references child process execution.

bin/smrt.jsView on unpkg · L2

5import { dirname, resolve } from 'node:path';

6import { fileURLToPath } from 'node:url';

8const packageRoot = resolve(dirname(fileURLToPath(import.meta.url)), '..');

9const distEntry = resolve(packageRoot, 'dist/index.js');

10const sourceEntry = resolve(packageRoot, 'src/index.ts');

12const command = existsSync(distEntry)

13 ? [distEntry, ...process.argv.slice(2)]

14 : ['--import', 'tsx', sourceEntry, ...process.argv.slice(2)];

16const result = spawnSync(process.execPath, command, { stdio: 'inherit' });

18if (result.error) {

19 throw result.error;

20}

22if (result.signal) {

dist/commands-gnJG0EIL.jsView file

Lines 101-141javascript

101 slot: {

102 type: "string",

103 description: "Export only a specific slot (e.g., sources, settings)",

104 short: "s"

105 },

106 json: {

107 type: "boolean",

Source & flagged code

4 flagged · loading source

bin/smrt.jsView file

2L3: import { spawnSync } from 'node:child_process'; L4: import { existsSync } from 'node:fs';

High

Child Process

Package source references child process execution.

bin/smrt.jsView on unpkg · L2

dist/commands-gnJG0EIL.jsView file

4469* Security: Command and arguments are validated to prevent injection attacks. L4470: * shell: true is NOT used to avoid command injection vulnerabilities. L4471: */

High

Shell

Package source references shell execution.

dist/commands-gnJG0EIL.jsView on unpkg · L4469

3648execSync(`git config ${configScope} merge.smrt-json.name "SMRT JSON merge driver"`, { stdio: "inherit" }); L3649: execSync(`git config ${configScope} merge.smrt-json.driver "npx smrt merge-json %O %A %B"`, { stdio: "inherit" }); L3650: changes.push(`Git merge driver configured (${options.global ? "global" : "local"})`);

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/commands-gnJG0EIL.jsView on unpkg · L3648

121} L122: const { getPackageConfig } = await import("@happyvertical/smrt-config"); L123: const { DEFAULT_CLI_CONFIG } = await import("./config-BwrFRL8L.js");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/commands-gnJG0EIL.jsView on unpkg · L121

Findings

3 High4 Medium4 Low

HighChild Processbin/smrt.js

HighShelldist/commands-gnJG0EIL.js

HighRuntime Package Installdist/commands-gnJG0EIL.js

MediumDynamic Requiredist/commands-gnJG0EIL.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

bin/smrt.jsView file

Lines 1-22javascript

1#!/usr/bin/env node

3import { spawnSync } from 'node:child_process';

4import { existsSync } from 'node:fs';

High

Child Process

Package source references child process execution.

bin/smrt.jsView on unpkg · L2

5import { dirname, resolve } from 'node:path';

6import { fileURLToPath } from 'node:url';

8const packageRoot = resolve(dirname(fileURLToPath(import.meta.url)), '..');

9const distEntry = resolve(packageRoot, 'dist/index.js');

10const sourceEntry = resolve(packageRoot, 'src/index.ts');

12const command = existsSync(distEntry)

13 ? [distEntry, ...process.argv.slice(2)]

14 : ['--import', 'tsx', sourceEntry, ...process.argv.slice(2)];

16const result = spawnSync(process.execPath, command, { stdio: 'inherit' });

18if (result.error) {

19 throw result.error;

20}

22if (result.signal) {

dist/commands-gnJG0EIL.jsView file

Lines 101-141javascript

101 slot: {

102 type: "string",

103 description: "Export only a specific slot (e.g., sources, settings)",

104 short: "s"

105 },

106 json: {

107 type: "boolean",

Lines 3628-3668javascript

3628 },

3629 force: {

3630 type: "boolean",

3631 description: "Overwrite existing configuration",

3632 default: false,

3633 short: "f"

3634 }

3635 },

3636 handler: async (_args, options) => {

3637 console.log("\n🔧 Configuring SMRT JSON merge driver...\n");

3638 if (!isGitRepository()) {

3639 console.error("❌ Not a git repository. Run `git init` first.");

3640 process.exit(1);

3641 }

3642 const gitRoot = getGitRoot();

3643 const patterns = (options.patterns || DEFAULT_DATA_PATTERNS.join(",")).split(",").map((p) => p.trim()).filter(Boolean);

3644 const configScope = options.global ? "--global" : "--local";

3645 const changes = [];

3646 console.log("📝 Configuring git merge driver...");

3647 try {

3648 execSync(`git config ${configScope} merge.smrt-json.name "SMRT JSON merge driver"`, { stdio: "inherit" });

3649 execSync(`git config ${configScope} merge.smrt-json.driver "npx smrt merge-json %O %A %B"`, { stdio: "inherit" });

3650 changes.push(`Git merge driver configured (${options.global ? "global" : "local"})`);

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/commands-gnJG0EIL.jsView on unpkg · L3648

3651 console.log(` ✓ Merge driver "smrt-json" configured`);

3652 } catch (error) {

3653 console.error("❌ Failed to configure git merge driver");

3654 if (error instanceof Error) console.error(` ${error.message}`);

3655 process.exit(1);

3656 }

3657 console.log("\n📄 Updating .gitattributes...");

3658 const gitattributesPath = resolve(gitRoot, ".gitattributes");

3659 let gitattributesContent = "";

3660 if (existsSync(gitattributesPath)) gitattributesContent = readFileSync(gitattributesPath, "utf-8");

3661 const existingPatterns = [];

3662 const lines = gitattributesContent.split("\n");

3663 for (const line of lines) if (line.includes("merge=smrt-json")) {

3664 const pattern = line.split(/\s+/)[0];

3665 if (pattern) existingPatterns.push(pattern);

3666 }

3667 const newPatterns = [];

3668 for (const pattern of patterns) if (!existingPatterns.includes(pattern)) newPatterns.push(pattern);

Lines 4449-4489javascript

4449function validateBaseGenerator(baseGen, outputDir) {

4450 const allowedCommands = [

4451 "npm",

4452 "npx",

4453 "pnpm",

4454 "yarn",

4455 "bun",

4456 "bunx"

4457 ];

4458 if (!allowedCommands.includes(baseGen.command)) throw new Error(`Base generator command "${baseGen.command}" not allowed. Allowed commands: ${allowedCommands.join(", ")}`);

4459 const dangerousChars = /[;&|`$(){}[\]<>'"\\]/;

4460 if (dangerousChars.test(outputDir)) throw new Error(`Output directory contains dangerous characters: ${outputDir}. Only alphanumeric, dash, underscore, dot, and forward slash are allowed.`);

4461 for (const arg of baseGen.args) {

4462 const replacedArg = arg.replace("{DIR}", outputDir);

4463 if (dangerousChars.test(replacedArg)) throw new Error(`Base generator argument contains dangerous characters after placeholder replacement: ${replacedArg}`);

4464 }

4465}

4466/**

4467* Run base project generator (e.g., create-svelte, create-next-app)

4468*

4469* Security: Command and arguments are validated to prevent injection attacks.

4470* shell: true is NOT used to avoid command injection vulnerabilities.

4471*/

High

Shell

Package source references shell execution.

dist/commands-gnJG0EIL.jsView on unpkg · L4469

4472async function runBaseGenerator(baseGen, outputDir) {

4473 validateBaseGenerator(baseGen, outputDir);

4474 const args = baseGen.args.map((arg) => arg.replace("{DIR}", outputDir));

4475 return new Promise((resolve, reject) => {

4476 const proc = spawn(baseGen.command, args, {

4477 stdio: "inherit",

4478 shell: false

4479 });

4480 proc.on("close", (code) => {

4481 if (code === 0) resolve();

4482 else reject(/* @__PURE__ */ new Error(`Base generator exited with code ${code}`));

4483 });

4484 proc.on("error", reject);

4485 });

4486}

4487/**

4488* Overlay template files onto generated project

4489*/