registry / @kusari-lab/saas / 1.3.0

@kusari-lab/saas@1.3.0

`@kusari-lab/saas` is a single public npm package used to create projects from the private `kusari-lab/saas-starter` GitHub template.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 18 file(s), 90.6 KB of source, external domains: api.digitalocean.com, api.doppler.com, api.vercel.com, cli.github.com, console.neon.tech, developer.1password.com, fly.io, github.com, kusari.1password.com, us.i.posthog.com

Source & flagged code

2 flagged

dist/fly/fly.jsView file

Lines 1-21javascript

1import { spawnSync } from "node:child_process";

2function fly(args, token) {

High

Child Process

Package source references child process execution.

dist/fly/fly.jsView on unpkg · L1

3 const result = spawnSync("flyctl"

Source & flagged code

2 flagged · loading source

dist/fly/fly.jsView file

1import { spawnSync } from "node:child_process"; L2: function fly(args, token) {

High

Child Process

Package source references child process execution.

dist/fly/fly.jsView on unpkg · L1

dist/cli.jsView file

34"Examples:", L35: " npx @kusari-lab/saas init", L36: " npx @kusari-lab/saas create my-app", ... L43: function run(command, args) { L44: return spawnSync(command, args, { stdio: "pipe", encoding: "utf8" }); L45: }

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli.jsView on unpkg · L34

Findings

3 High3 Medium4 Low

HighChild Processdist/fly/fly.js

HighShell

HighRuntime Package Installdist/cli.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowHigh Entropy Strings

LowUrl Strings

LowNo License

dist/cli.jsView file

Lines 14-54javascript

14import { logger, setVerbose } from "./utils/logger.js";

15import { addDomainToVercel, addVercelEnv, createVercelProject, getVercelProjectByName, } from "./vercel/vercel.js";

16function printUsage() {

17 logger.instruction([

18 "Usage:",

19 " saas init",

20 " saas create <app-name> [--deployment monolith|fullscale] [--verbose]",

21 " [--skip-neon] [--skip-vercel] [--skip-clerk] [--skip-webhook] [--owner <org>]",

22 " [--clerk-publishable-key <pk>] [--clerk-secret-key <sk>]",

23 " [--clerk-test-publishable-key <pk>] [--clerk-test-secret-key <sk>]",

24 " saas domains <app> <domain|--domain <host>> [--frontend <host>] [--api <host>]",

25 " [--owner <org>] [--timeout-ms <n>]",

26 " saas clerk apply <app> [--owner <org>] [--clerk-* flags]",

27 " saas clerk webhook <app> [--signing-secret <whsec>] [--api-url <url>] [--owner <org>]",

28 "",

29 "Domain pairing (default):",

30 " example.com → FE example.com, API api.example.com",

31 " app.example.com → FE app.example.com, API api.app.example.com",

32 " Override either side with --frontend / --api when needed.",

33 "",

34 "Examples:",

35 " npx @kusari-lab/saas init",

36 " npx @kusari-lab/saas create my-app",

37 " npx @kusari-lab/saas create my-app --deployment fullscale",

38 " npx @kusari-lab/saas domains my-app app.example.com",

39 " npx @kusari-lab/saas domains my-app --domain app.example.com --api api.custom.com",

40 " npx @kusari-lab/saas clerk webhook my-app",

41 ].join("\n"));

42}

43function run(command, args) {

44 return spawnSync(command, args, { stdio: "pipe", encoding: "utf8" });

45}

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli.jsView on unpkg · L34

46function ensureGhCliReady() {

47 const ghVersion = run("gh", ["--version"]);

48 if (ghVersion.status !== 0) {

49 throw new Error("GitHub CLI is required. Install from https://cli.github.com/ then run `gh auth login`.");

50 }

51 const ghAuth = run("gh", ["auth", "status", "-h", "github.com"]);

52 if (ghAuth.status !== 0) {

53 throw new Error("GitHub CLI is not authenticated. Run `gh auth login -h github.com` and retry.");

54 }