registry / @hatchway/cli / 0.51.29

@hatchway/cli@0.51.29

Hatchway CLI - Build AI-powered apps with Claude. Just run: npx @hatchway/cli runner

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 39 file(s), 2.65 MB of source, external domains: api.github.com, github.com, hatchway.sh, pnpm.io, react.dev

Source & flagged code

3 flagged

bin/hatchway.jsView file

Lines 1-22javascript

1#!/usr/bin/env node

3import { spawn } from 'child_process';

4import { fileURLToPath } from 'url';

High

Child Process

Package source references child process execution.

bin/hatchway.jsView on unpkg · L2

5import { dirname, resolve } from 'path';

7const __filename = fileURLToPath(import.meta.url);

8const __dirname = dirname(__filename);

10// Path relative to this bin script

11const cliPath = resolve(__dirname, '../dist/cli/index.js');

13const child = spawn(

14 process.execPath, // Use the same Node.js binary

15 [cliPath, ...process.argv.slice(2)],

16 {

17 stdio: 'inherit',

18 env: process.env,

19 }

20);

22child.on('close', (code) => {

dist/chunks/auto-update-Ddo5Ntt7.jsView file

Lines 127-167javascript

127 */

128function performAppUpgrade() {

129 const config = configManager.get();

130 const monorepoPath = config.monorepoPath;

dist/chunks/database-setup-BdXiI4MV.jsView file

Lines 41-81javascript

41 await writeFile(envPath, updated, 'utf-8');

42 }

43 catch (error) {

44 logger.warn('Could not clear DATABASE_URL from .env');

45 }

46}

Source & flagged code

3 flagged · loading source

bin/hatchway.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code