registry / @kosdev-code/kos-ui-cli / 3.0.5

@kosdev-code/kos-ui-cli@3.0.5

Static Scan Results

scanned 4d ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 48 file(s), 498 KB of source, external domains: 127.0.0.1, 192.168.1.100

Source & flagged code

4 flagged

src/lib/utils/java-home.mjsView file

Lines 1-21javascript

1import { execSync } from "child_process";

2import { platform } from "os";

High

Child Process

Package source references child process execution.

src/lib/utils/java-home.mjsView on unpkg · L1

3import { join } from "path";

5export function findJavaHome() {

6 const os = platform();

8 if (os === "win32") {

9 return findJavaHomeWindows();

10 } else if (os === "darwin" || os === "linux") {

11 return findJavaHomeUnix();

12 } else {

13 throw new Error("Unsupported operating system: " + os);

14 }

15}

17function findJavaHomeWindows() {

18 try {

19 const output = execSync(

20 'reg query "HKEY_LOCAL_MACHINE\\SOFTWARE\\JavaSoft\\JDK" /s /v JavaHome'

21 );

src/lib/utils/exec.mjsView file

Lines 1-19javascript

1// utils/exec.mjs

2import { exec } from "child_process";

4/**

5 * Executes a shell command and returns a Promise.

6 * @param {string} command

7 * @returns {Promise<void>}

8 */

9export function

src/lib/utils/generator-loader.mjsView file

Lines 8-48javascript

9/**

10 * Recursively finds generator metadata across all generator folders.

11 * @returns {Promise<Record<string, any>>} Mapping of generator key -> metadata

12 */

13export async function getAllGeneratorMetadata() {

14 const metadataMap = {};

src/lib/utils/utils.mjsView file

Lines 14-54javascript

14 const kosConfig = JSON.parse(

15 await readFile(path.join(project.root, ".kos.json"), "utf-8")

16 );

17 if (kosConfig.models) {

18 Object.keys(kosConfig.models).forEach((

Source & flagged code

4 flagged · loading source

src/lib/utils/java-home.mjsView file

1import { execSync } from "child_process"; L2: import { platform } from "os";

High

Child Process

Package source references child process execution.

src/lib/utils/java-home.mjsView on unpkg · L1

src/lib/utils/exec.mjsView file

10return new Promise((resolve, reject) => { L11: const child = exec(command, { shell: true }, (error, stdout, stderr) => { L12: if (stdout) process.stdout.write(stdout);

High

Shell

Package source references shell execution.

src/lib/utils/exec.mjsView on unpkg · L10

src/lib/utils/generator-loader.mjsView file

28try { L29: const module = await import(modulePath); L30:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/lib/utils/generator-loader.mjsView on unpkg · L28

src/lib/utils/utils.mjsView file

34return new Promise((resolve, reject) => { L35: exec("npx nx show projects --json", (error, stdout, stderr) => { L36: if (error) {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/lib/utils/utils.mjsView on unpkg · L34

Findings

3 High4 Medium4 Low

HighChild Processsrc/lib/utils/java-home.mjs

HighShellsrc/lib/utils/exec.mjs

HighRuntime Package Installsrc/lib/utils/utils.mjs

MediumDynamic Requiresrc/lib/utils/generator-loader.mjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

4 flagged

src/lib/utils/java-home.mjsView file

Lines 1-21javascript

1import { execSync } from "child_process";

2import { platform } from "os";

High

Child Process

Package source references child process execution.

src/lib/utils/java-home.mjsView on unpkg · L1

3import { join } from "path";

5export function findJavaHome() {

6 const os = platform();

8 if (os === "win32") {

9 return findJavaHomeWindows();

10 } else if (os === "darwin" || os === "linux") {

11 return findJavaHomeUnix();

12 } else {

13 throw new Error("Unsupported operating system: " + os);

14 }

15}

17function findJavaHomeWindows() {

18 try {

19 const output = execSync(

20 'reg query "HKEY_LOCAL_MACHINE\\SOFTWARE\\JavaSoft\\JDK" /s /v JavaHome'

21 );

src/lib/utils/exec.mjsView file

Lines 1-19javascript

1// utils/exec.mjs

2import { exec } from "child_process";

4/**

5 * Executes a shell command and returns a Promise.

6 * @param {string} command

7 * @returns {Promise<void>}

8 */

9export function

src/lib/utils/generator-loader.mjsView file

Lines 8-48javascript

9/**

10 * Recursively finds generator metadata across all generator folders.

11 * @returns {Promise<Record<string, any>>} Mapping of generator key -> metadata

12 */

13export async function getAllGeneratorMetadata() {

14 const metadataMap = {};

src/lib/utils/utils.mjsView file

Lines 14-54javascript

14 const kosConfig = JSON.parse(

15 await readFile(path.join(project.root, ".kos.json"), "utf-8")

16 );

17 if (kosConfig.models) {

18 Object.keys(kosConfig.models).forEach((