registry  /  @hr-components-dev/cli  /  1.4.3

@hr-components-dev/cli@1.4.3

本项目是江西淮然科技有限公司专门开发的组件化脚手架工具，旨在提升前端开发效率，统一组件开发规范，并支持组件加密保护功能。

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 20 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket
Supply chain
HighEntropyStringsMinifiedObfuscatedProtestwareTelemetryUrlStrings
Manifest
NoLicense
scanned 91 file(s), 13.8 MB of source, external domains: aisuda.bce.baidu.com, atelierbram.github.io, chriskempson.com, clrs.cc, code.visualstudio.com, cors-anywhere.froala.com, cscorley.github.io, docs.oasis-open.org, ethanschoonover.com, example.com, facebook.com, fb.me, feross.org, froala.com, github.com, google.com, hart-dev.com, i.froala.com, jaywcjlove.github.io, kentcdodds.com, mail.google.com, momentjs.com, ns.adobe.com, openoffice.org, play.vidyard.com, player.vimeo.com, purl.eligrey.com, purl.oclc.org, purl.org, railscasts.com, reactjs.org, rutube.ru, schemas.microsoft.com, schemas.openxmlformats.org, sethawright.com, sheetjs.openxmlformats.org, stuk.github.io, twemoji.maxcdn.com, tybenz.com, www.dailymotion.com, www.froala.com, www.monokai.nl, www.tiny.cloud, www.w3.org, www.xfa.org, www.youtube.com
Oversized source lightweight scan
src/assets/amis/sdk/charts.js2.26 MB file, sampled 256 KB
ChildProcessObfuscatedHighEntropyStringsMinifiedUrlStringsgithub.com
src/assets/amis/sdk/rest.js2.77 MB file, sampled 256 KB
HighEntropyStringsMinifiedUrlStringswww.w3.org
src/assets/amis/sdk/thirds/monaco-editor/min/vs/editor/editor.main.js2.66 MB file, sampled 256 KB
ChildProcessObfuscatedHighEntropyStringsMinifiedUrlStringsgithub.comwww.w3.org
src/assets/amis/sdk/thirds/monaco-editor/min/vs/language/typescript/tsWorker.js4.35 MB file, sampled 256 KB
FilesystemNetworkChildProcessEnvironmentVarsMinified

Source & flagged code

9 flagged · loading source
src/assets/amis/sdk/sdk.jsView file
1023this file except in compliance with the License. You may obtain a copy of the L1024: License at http://www.apache.org/licenses/LICENSE-2.0 L1025: ... L1032: and limitations under the License. L1033: ***************************************************************************** */function I(e,t){function n(){this.constructor=e}R(e,t),e.prototype=null===t?Object.create(t):(n.prot... L1034:
High
Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

src/assets/amis/sdk/sdk.jsView on unpkg · L1023
2685patternName = generic_password severity = medium line = 2685 matchedText = amis.def...}));
Medium
Secret Pattern

Package contains a possible secret pattern.

src/assets/amis/sdk/sdk.jsView on unpkg · L2685
633*/ L634: 'use strict';var aa=require("acd86e1"),ca=require("04b1536");function p(a){for(var b="https://reactjs.org/docs/error-decoder.html?invariant="+a,c=1;c<arguments.length;c++)b+="&args... L635: function ha(a,b){ea[a]=b;for(a=0;a<b.length;a++)da.add(b[a])}
Medium
Dynamic Require

Package source references dynamic require/import behavior.

src/assets/amis/sdk/sdk.jsView on unpkg · L633
src/scripts/index.jsView file
5import { existsSync, symlinkSync, unlinkSync } from 'node:fs'; L6: import { spawn } from 'node:child_process'; L7: import consola from 'consola';
High
Child Process

Package source references child process execution.

src/scripts/index.jsView on unpkg · L5
79stdio: 'inherit', L80: shell: true L81: });
High
Shell

Package source references shell execution.

src/scripts/index.jsView on unpkg · L79
76// 启动开发服务器 L77: const viteProcess = spawn('npx', ['vite'], { L78: cwd: targetPackageDir,
High
Runtime Package Install

Package source invokes a package manager install command at runtime.

src/scripts/index.jsView on unpkg · L76
src/amis/components/utils/evalScope.tsView file
44// eslint-disable-next-line no-new-func L45: return new Function('instance', '_', 'axios', 'hiprint', 'hiprintConnect', 'dayjs', 'amis', `return ${express}`); L46: };
Low
Eval

Package source references a known benign dynamic code generation pattern.

src/amis/components/utils/evalScope.tsView on unpkg · L44
src/assets/amis/sdk/iconfont.woffView file
•path = src/assets/amis/sdk/iconfont.woff kind = high_entropy_blob sizeBytes = 115860 magicHex = [redacted]
High
Ships High Entropy Blob

Package ships high-entropy non-source blobs.

src/assets/amis/sdk/iconfont.woffView on unpkg
src/assets/amis/sdk/rest.jsView file
•path = src/assets/amis/sdk/rest.js kind = oversized_source_file sizeBytes = 2900743 magicHex = [redacted]
High
Oversized Source File

Package contains source files above the static scanner size ceiling.

src/assets/amis/sdk/rest.jsView on unpkg

Findings

6 High6 Medium8 Low
HighChild Processsrc/scripts/index.js
HighShellsrc/scripts/index.js
HighSame File Env Network Executionsrc/assets/amis/sdk/sdk.js
HighRuntime Package Installsrc/scripts/index.js
HighShips High Entropy Blobsrc/assets/amis/sdk/iconfont.woff
HighOversized Source Filesrc/assets/amis/sdk/rest.js
MediumSecret Patternsrc/assets/amis/sdk/sdk.js
MediumDynamic Requiresrc/assets/amis/sdk/sdk.js
MediumNetwork
MediumEnvironment Vars
MediumProtestware
MediumStructural Risk Force Deep Review
LowScripts Present
LowEvalsrc/amis/components/utils/evalScope.ts
LowFilesystem
LowObfuscated
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
LowNo License