registry  /  @inixiative/config  /  0.1.0

@inixiative/config@0.1.0

Shared toolchain for the inixiative ecosystem: tsconfig/biome/tsup presets, a version manifest (BOM), and a sync/check CLI

Static Scan Results

scanned 15d ago · by rust-scanner

Static analysis flagged 8 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessFilesystemShell
Supply chain
HighEntropyStrings
ManifestNo manifest risk signals triggered.
scanned 2 file(s), 21.4 KB of source

Source & flagged code

2 flagged · loading source
dist/cli.jsView file
3// src/cli.ts L4: import { spawnSync as spawnSync2 } from "child_process"; L5: import { existsSync as existsSync2 } from "fs";
High
Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L3
273level: "error", L274: message: "bun.lock missing \u2192 run bun install and commit the lockfile" L275: }); L276: } else if (spawnSync("git", ["check-ignore", "-q", "bun.lock"], { cwd: dir2 }).status === 0) { L277: findings.push({
High
Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli.jsView on unpkg · L273

Findings

3 High1 Medium4 Low
HighChild Processdist/cli.js
HighShell
HighRuntime Package Installdist/cli.js
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings