registry / @kurumera/cli / 0.1.10

@kurumera/cli@0.1.10

Kurumera CLI — login, scaffold, dev, check, push, preview, publish.

Static Scan Results

scanned 3mo ago · by rust-scanner

Static analysis flagged 13 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 40 file(s), 82.3 KB of source, external domains: 127.0.0.1, admin.kurumera.com, kurumera.com, themekit.kurumera.com

Source & flagged code

5 flagged

dist/commands/preview.jsView file

Lines 1-21javascript

1import { spawn } from "node:child_process";

2import { readConfig } from "../util/config.js";

High

Child Process

Package source references child process execution.

dist/commands/preview.jsView on unpkg · L1

3const PUSH_URL = (process.env.KURUMERA_PUSH_URL || "https://themekit.kurumera.com/_push").replace(/\/+$/, "");

4function openBrowser(url) {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/commands/preview.jsView on unpkg · L1

5 try {

6 if (process.platform === "win32") {

7 spawn("cmd", ["/c", "start", "", url.replace(/&/g, "^&")], { stdio: "ignore", detached: true, windowsVerbatimArguments: true }).unref();

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/commands/preview.jsView on unpkg · L1

8 return;

9 }

10 spawn(process.platform === "darwin" ? "open" : "xdg-open", [url], { stdio: "ignore", detached: true }).unref();

11 }

12 catch { /* printed as fallback */ }

13}

14/**

15 * `kurumera theme preview` — poll the latest pushed build; when it's ready, open

16 * the preview URL (the theme rendered against a live store, unpublished).

17 */

18export async function themePreview(args) {

19 const cfg = readConfig();

20 const store = flag(args, "--store") || cfg.defaultStore || "";

21 if (!store) {

•matchType = previous_version_dangerous_delta matchedPackage = @kurumera/cli@0.1.4 matchedIdentity = npm:QGt1cnVtZXJhL2NsaQ:0.1.4 similarity = 0.519 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/commands/preview.jsView on unpkg

dist/commands/dev.jsView file

Lines 13-49javascript

13 }

14 const cfg = readConfig();

15 // Use --store, else the store from `kurumera login`.

16 const store = flag(args, "--store") ||

Source & flagged code

5 flagged · loading source

dist/commands/preview.jsView file

@kurumera/cli@0.1.10

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code