registry / @lark-apaas/miaoda-cli / 0.1.20

@lark-apaas/miaoda-cli@0.1.20

Miaoda 平台命令行工具，面向 Agent 调用

Static Scan Results

scanned 12d ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 160 file(s), 785 KB of source, external domains: miaoda.feishu.cn, registry.npmmirror.com

Source & flagged code

5 flagged

upgrade/templates/nestjs-react-fullstack/templates/scripts/dev.jsView file

Lines 1-25javascript

1#!/usr/bin/env node

2'use strict';

4const fs = require('fs');

5const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

upgrade/templates/nestjs-react-fullstack/templates/scripts/dev.jsView on unpkg · L3

6const { spawn, execSync } = require('child_process');

7const readline = require('readline');

High

Child Process

Package source references child process execution.

upgrade/templates/nestjs-react-fullstack/templates/scripts/dev.jsView on unpkg · L5

9// ── Project root ──────────────────────────────────────────────────────────────

10const PROJECT_ROOT = path.resolve(__dirname, '..');

11process.chdir(PROJECT_ROOT);

13// ── Load .env ─────────────────────────────────────────────────────────────────

14function loadEnv() {

15 const envPath = path.join(PROJECT_ROOT, '.env');

16 if (!fs.existsSync(envPath)) return;

17 const lines = fs.readFileSync(envPath, 'utf8').split('\n');

18 for (const line of lines) {

19 const trimmed = line.trim();

20 if (!trimmed || trimmed.startsWith('#')) continue;

21 const eqIdx = trimmed.indexOf('=');

22 if (eqIdx === -1) continue;

23 const key = trimmed.slice(0, eqIdx).trim();

24 const value = trimmed.slice(eqIdx + 1).trim();

25 if (!(key in process.env)) {

Lines 101-141javascript

101 return new Promise((resolve) => setTimeout(resolve, ms));

102}

103

104/**

105 * Start and supervise a process with auto-restart and log piping.

106 * Returns a promise that resolves when the process loop ends.

107 */

108function startProcess({ name, command, args, cleanupPort

upgrade/templates/nestjs-react-fullstack/templates/scripts/hooks/run-precommit.jsView file

Lines 25-65javascript

25 const res = spawnSync(

26 'git',

27 ['diff', '--cached', '--diff-filter=ACMR', '--', 'package-lock.json'],

28 { stdio: ['ignore', 'pipe', 'pipe'], env: process.env },

upgrade/templates/nestjs-react-fullstack/templates/scripts/dev.shView file

•path = upgrade/templates/nestjs-react-fullstack/templates/scripts/dev.sh kind = build_helper sizeBytes = 1244 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

upgrade/templates/nestjs-react-fullstack/templates/scripts/dev.shView on unpkg

Source & flagged code

5 flagged · loading source

upgrade/templates/nestjs-react-fullstack/templates/scripts/dev.jsView file

5const path = require('path'); L6: const { spawn, execSync } = require('child_process'); L7: const readline = require('readline');

High

Child Process

Package source references child process execution.

upgrade/templates/nestjs-react-fullstack/templates/scripts/dev.jsView on unpkg · L5

121stdio: ['ignore', 'pipe', 'pipe'], L122: shell: true, L123: cwd: PROJECT_ROOT,

High

Shell

Package source references shell execution.

upgrade/templates/nestjs-react-fullstack/templates/scripts/dev.jsView on unpkg · L121

3L4: const fs = require('fs'); L5: const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

upgrade/templates/nestjs-react-fullstack/templates/scripts/dev.jsView on unpkg · L3

upgrade/templates/nestjs-react-fullstack/templates/scripts/hooks/run-precommit.jsView file

45[ L46: '线上构建环境无法访问内网镜像源，将导致部署阶段 npm install 失败。', L47: '请使用公共镜像源重新生成 lockfile：', ... L56: const cwd = process.cwd(); L57: const res = spawnSync('npm', ['run', 'lint'], { L58: cwd,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

upgrade/templates/nestjs-react-fullstack/templates/scripts/hooks/run-precommit.jsView on unpkg · L45

upgrade/templates/nestjs-react-fullstack/templates/scripts/dev.shView file

•path = upgrade/templates/nestjs-react-fullstack/templates/scripts/dev.sh kind = build_helper sizeBytes = 1244 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

upgrade/templates/nestjs-react-fullstack/templates/scripts/dev.shView on unpkg

Findings

3 High5 Medium4 Low

HighChild Processupgrade/templates/nestjs-react-fullstack/templates/scripts/dev.js

HighShellupgrade/templates/nestjs-react-fullstack/templates/scripts/dev.js

HighRuntime Package Installupgrade/templates/nestjs-react-fullstack/templates/scripts/hooks/run-precommit.js

MediumDynamic Requireupgrade/templates/nestjs-react-fullstack/templates/scripts/dev.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperupgrade/templates/nestjs-react-fullstack/templates/scripts/dev.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

5 flagged

upgrade/templates/nestjs-react-fullstack/templates/scripts/dev.jsView file

Lines 1-25javascript

1#!/usr/bin/env node

2'use strict';

4const fs = require('fs');

5const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

upgrade/templates/nestjs-react-fullstack/templates/scripts/dev.jsView on unpkg · L3

6const { spawn, execSync } = require('child_process');

7const readline = require('readline');

High

Child Process

Package source references child process execution.

upgrade/templates/nestjs-react-fullstack/templates/scripts/dev.jsView on unpkg · L5

10const PROJECT_ROOT = path.resolve(__dirname, '..');

11process.chdir(PROJECT_ROOT);

14function loadEnv() {

15 const envPath = path.join(PROJECT_ROOT, '.env');

16 if (!fs.existsSync(envPath)) return;

17 const lines = fs.readFileSync(envPath, 'utf8').split('\n');

18 for (const line of lines) {

19 const trimmed = line.trim();

20 if (!trimmed || trimmed.startsWith('#')) continue;

21 const eqIdx = trimmed.indexOf('=');

22 if (eqIdx === -1) continue;

23 const key = trimmed.slice(0, eqIdx).trim();

24 const value = trimmed.slice(eqIdx + 1).trim();

25 if (!(key in process.env)) {

Lines 101-141javascript

101 return new Promise((resolve) => setTimeout(resolve, ms));

102}

103

104/**

105 * Start and supervise a process with auto-restart and log piping.

106 * Returns a promise that resolves when the process loop ends.

107 */

108function startProcess({ name, command, args, cleanupPort

upgrade/templates/nestjs-react-fullstack/templates/scripts/hooks/run-precommit.jsView file

Lines 25-65javascript

25 const res = spawnSync(

26 'git',

27 ['diff', '--cached', '--diff-filter=ACMR', '--', 'package-lock.json'],

28 { stdio: ['ignore', 'pipe', 'pipe'], env: process.env },

upgrade/templates/nestjs-react-fullstack/templates/scripts/dev.shView file

•path = upgrade/templates/nestjs-react-fullstack/templates/scripts/dev.sh kind = build_helper sizeBytes = 1244 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

upgrade/templates/nestjs-react-fullstack/templates/scripts/dev.shView on unpkg