registry / @happyvertical/smrt-cli / 0.40.16

@happyvertical/smrt-cli@0.40.16

Developer CLI for SMRT framework - introspection, testing, and project management

Static Scan Results

scanned 16h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 6 file(s), 391 KB of source, external domains: bitbucket.org, github.com, gitlab.com

Source & flagged code

4 flagged

bin/smrt.jsView file

Lines 1-22javascript

1#!/usr/bin/env node

3import { spawnSync } from 'node:child_process';

4import { existsSync } from 'node:fs';

High

Child Process

Package source references child process execution.

bin/smrt.jsView on unpkg · L2

5import { dirname, resolve } from 'node:path';

6import { fileURLToPath } from 'node:url';

8const packageRoot = resolve(dirname(fileURLToPath(import.meta.url)), '..');

9const distEntry = resolve(packageRoot, 'dist/index.js');

10const sourceEntry = resolve(packageRoot, 'src/index.ts');

12const command = existsSync(distEntry)

13 ? [distEntry, ...process.argv.slice(2)]

14 : ['--import', 'tsx', sourceEntry, ...process.argv.slice(2)];

16const result = spawnSync(process.execPath, command, { stdio: 'inherit' });

18if (result.error) {

19 throw result.error;

20}

22if (result.signal) {

dist/commands-mHvAZYmi.jsView file

Lines 102-142javascript

102 slot: {

103 type: "string",

104 description: "Export only a specific slot (e.g., sources, settings)",

105 short: "s"

106 },

107 json

Source & flagged code

4 flagged · loading source

bin/smrt.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code