registry / @kurumera/cli / 0.1.14

@kurumera/cli@0.1.14

Kurumera CLI — login, scaffold, dev, check, push, preview, publish.

Static Scan Results

scanned 14h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 40 file(s), 92.3 KB of source, external domains: 127.0.0.1, admin.kurumera.com, kurumera.com, themekit.kurumera.com

Source & flagged code

5 flagged

dist/commands/preview.jsView file

Lines 1-21javascript

1import { spawn } from "node:child_process";

2import { readConfig } from "../util/config.js";

High

Child Process

Package source references child process execution.

dist/commands/preview.jsView on unpkg · L1

3const PUSH_URL = (process.env.KURUMERA_PUSH_URL || "https://themekit.kurumera.com/_push").replace(/\/+$/, "");

4function openBrowser(url) {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/commands/preview.jsView on unpkg · L1

5 try {

6 if (process.platform === "win32") {

7 spawn("cmd", ["/c", "start", "", url.replace(/&/g, "^&")], { stdio: "ignore", detached: true, windowsVerbatimArguments: true }).unref();

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/commands/preview.jsView on unpkg · L1

8 return;

9 }

10 spawn(process.platform === "darwin" ? "open" : "xdg-open", [url], { stdio: "ignore", detached: true }).unref();

11 }

12 catch { /* printed as fallback */ }

13}

14/**

15 * `kurumera theme preview` — poll the latest pushed build; when it's ready, open

16 * the preview URL (the theme rendered against a live store, unpublished).

17 */

18export async function themePreview(args) {

19 const cfg = readConfig();

20 const store = flag(args, "--store") || cfg.defaultStore || "";

21 if (!store) {

dist/commands/dev.jsView file

Lines 19-59javascript

19 (store && cfg.stores?.[store]) ||

20 cfg.token;

21 // Dev convenience: resolve by store slug (X-Tenant-ID) when no token is set.

22 // `--store` doubles as the tenant slug; `--tenant` overrides it explicitly.

23 const tenant = flag(args, "--tenant") ||

Source & flagged code

5 flagged · loading source

dist/commands/preview.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code