registry / @hatchway/cli / 0.51.23

@hatchway/cli@0.51.23

Hatchway CLI - Build AI-powered apps with Claude. Just run: npx @hatchway/cli runner

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 39 file(s), 2.65 MB of source, external domains: api.github.com, github.com, hatchway.sh, pnpm.io, react.dev

Source & flagged code

3 flagged

bin/hatchway.jsView file

Lines 1-22javascript

1#!/usr/bin/env node

3import { spawn } from 'child_process';

4import { fileURLToPath } from 'url';

High

Child Process

Package source references child process execution.

bin/hatchway.jsView on unpkg · L2

5import { dirname, resolve } from 'path';

7const __filename = fileURLToPath(import.meta.url);

8const __dirname = dirname(__filename);

10// Path relative to this bin script

11const cliPath = resolve(__dirname, '../dist/cli/index.js');

13const child = spawn(

14 process.execPath, // Use the same Node.js binary

15 [cliPath, ...process.argv.slice(2)],

16 {

17 stdio: 'inherit',

18 env: process.env,

19 }

20);

22child.on('close', (code) => {

dist/chunks/auto-update-Ddo5Ntt7.jsView file

Lines 127-167javascript

127 */

128function performAppUpgrade() {

129 const config = configManager.get();

130 const monorepoPath = config.monorepoPath;

131 // No monorepo configured, skip app upgrade

132 if (!

dist/chunks/database-setup-BdXiI4MV.jsView file

Lines 41-81javascript

41 await writeFile(envPath, updated, 'utf-8');

42 }

43 catch (error) {

44 logger.warn('Could not clear DATABASE_URL from .env');

45 }

46}

47/**

48 * Run get-db (formerly neondb) setup to create a database and get the connection string

Source & flagged code

3 flagged · loading source

bin/hatchway.jsView file

2L3: import { spawn } from 'child_process'; L4: import { fileURLToPath } from 'url';

High

Child Process

Package source references child process execution.

bin/hatchway.jsView on unpkg · L2

dist/chunks/auto-update-Ddo5Ntt7.jsView file

147}, L148: shell: true, L149: });

High

Shell

Package source references shell execution.

dist/chunks/auto-update-Ddo5Ntt7.jsView on unpkg · L147

dist/chunks/database-setup-BdXiI4MV.jsView file

61// Use 'get-db' (the renamed neondb package) for database creation L62: const proc = spawn('npx', ['get-db', '-y'], { L63: cwd: monorepoPath, // Run in monorepo root so .env is created there

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/chunks/database-setup-BdXiI4MV.jsView on unpkg · L61

Findings

3 High3 Medium5 Low

HighChild Processbin/hatchway.js

HighShelldist/chunks/auto-update-Ddo5Ntt7.js

HighRuntime Package Installdist/chunks/database-setup-BdXiI4MV.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

3 flagged

bin/hatchway.jsView file

Lines 1-22javascript

1#!/usr/bin/env node

3import { spawn } from 'child_process';

4import { fileURLToPath } from 'url';

High

Child Process

Package source references child process execution.

bin/hatchway.jsView on unpkg · L2

5import { dirname, resolve } from 'path';

7const __filename = fileURLToPath(import.meta.url);

8const __dirname = dirname(__filename);

10// Path relative to this bin script

11const cliPath = resolve(__dirname, '../dist/cli/index.js');

13const child = spawn(

14 process.execPath, // Use the same Node.js binary

15 [cliPath, ...process.argv.slice(2)],

16 {

17 stdio: 'inherit',

18 env: process.env,

19 }

20);

22child.on('close', (code) => {

dist/chunks/auto-update-Ddo5Ntt7.jsView file

Lines 127-167javascript

127 */

128function performAppUpgrade() {

129 const config = configManager.get();

130 const monorepoPath = config.monorepoPath;

131 // No monorepo configured, skip app upgrade

132 if (!

dist/chunks/database-setup-BdXiI4MV.jsView file

Lines 41-81javascript

41 await writeFile(envPath, updated, 'utf-8');

42 }

43 catch (error) {

44 logger.warn('Could not clear DATABASE_URL from .env');

45 }

46}

47/**

48 * Run get-db (formerly neondb) setup to create a database and get the connection string