registry / @lenne.tech/cli / 1.35.1

@lenne.tech/cli@1.35.1

lenne.Tech CLI: lt

Static Scan Results

scanned 4h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 171 file(s), 1.44 MB of source, external domains: 127.0.0.1, api.github.com, caddyserver.com, developers.cloudflare.com, developers.openai.com, docs.anthropic.com, docs.nestjs.com, git-scm.com, github.com, infinitered.github.io, lenne.tech, nodejs.org, raw.githubusercontent.com, regex101.com, registry.npmjs.org, stackblitz.com, www.apple.com

Source & flagged code

5 flagged

package.jsonView file

Lines 7-47json

7 "cli",

8 "lt"

9 ],

10 "author": "Kai Haase",

11 "homepage": "https://lenne.tech",

12 "license": "MIT",

13 "repository": "https://github.com/lenneTech/cli.git",

14 "bugs": {

15 "url": "https://github.com/lenneTech/cli/issues"

16 },

17 "bin": {

18 "lt": "bin/lt"

19 },

20 "scripts": {

21 "c": "npm run check",

22 "cf": "npm run check:fix",

23 "check": "bash scripts/check.sh",

24 "check:audit": "bash scripts/check.sh --audit-only",

25 "check:fix": "npm install && npm audit fix && npm run format && npm run lint:fix && npm run build && npm run check:start",

26 "check:start": "bash scripts/check-cli-start.sh",

27 "postinstall": "node bin/postinstall.js 2>/dev/null || true",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L27

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L27

28 "build": "npm run lint && npm run test && npm run clean-build && npm run compile && npm run copy-templates",

29 "clean-build": "npx rimraf ./build",

30 "compile": "tsc -p .",

31 "copy-templates": "npx shx cp -R ./src/templates ./build/templates && npx shx cp -R ./src/config ./build/config",

32 "coverage": "jest --coverage",

33 "test:vendor-init": "bash scripts/test-vendor-init.sh",

34 "test:frontend-vendor-init": "bash scripts/test-frontend-vendor-init.sh",

35 "test:incremental-fullstack": "bash scripts/test-incremental-fullstack.sh",

36 "test:manual": "jest --testMatch '<rootDir>/*.manual.ts' --testTimeout=60000",

37 "test:e2e:service": "jest --testMatch '<rootDir>/dev-service-e2e.manual.ts' --testTimeout=60000",

38 "format": "prettier --write 'src/**/*.{js,ts,tsx,json}' '!src/templates/**/*'",

39 "lint": "eslint './src/**/*.{ts,js,vue}'",

40 "lint:fix": "eslint './src/**/*.{ts,js,vue}' --fix",

41 "prepublishOnly": "npm run build",

42 "preversion": "npm run lint",

43 "reinit": "npx rimraf package-lock.json && npx rimraf node_modules && npm cache clean --force && npm i && npm run build",

44 "snapupdate": "jest --updateSnapshot",

45 "start": "node bin/lt",

46 "start:build": "npm run build && node bin/lt --compiled-build",

47 "start:compiled": "node bin/lt --compiled-build",

bin/postinstall.jsView file

Lines 1-27javascript

1#!/usr/bin/env node

3/**

4 * Postinstall script for lt CLI

5 * Generates static completion files on install/update (no runtime overhead)

6 */

8const { execSync } = require('child_process');

9const { appendFileSync, existsSync, mkdirSync

docs/lt-dev-ticket-workflow.pdfView file

•path = docs/lt-dev-ticket-workflow.pdf kind = high_entropy_blob sizeBytes = 1419322 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

docs/lt-dev-ticket-workflow.pdfView on unpkg

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/postinstall.js 2>/dev/null || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node bin/postinstall.js 2>/dev/null || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/postinstall.jsView file

7L8: const { execSync } = require('child_process'); L9: const { appendFileSync, existsSync, mkdirSync, readFileSync, writeFileSync } = require('fs');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/postinstall.jsView on unpkg · L7

7L8: const { execSync } = require('child_process'); L9: const { appendFileSync, existsSync, mkdirSync, readFileSync, writeFileSync } = require('fs'); ... L30: function detectShell() { L31: const shell = process.env.SHELL || ''; L32: if (shell.includes('zsh')) return 'zsh'; ... L60: function getCompletionPaths(shell) { L61: const home = homedir(); L62: const ltDir = join(home, '.local', 'share', 'lt', 'completions'); ... L73: completionFile: join(ltDir, '_lt'), L74: configFile: join(home, '.zshrc'), L75: // Source the file directly - it uses compdef internally

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

bin/postinstall.jsView on unpkg · L7

docs/lt-dev-ticket-workflow.pdfView file

•path = docs/lt-dev-ticket-workflow.pdf kind = high_entropy_blob sizeBytes = 1419322 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

docs/lt-dev-ticket-workflow.pdfView on unpkg

Findings

2 High6 Medium5 Low

HighInstall Time Lifecycle Scriptspackage.json

HighShips High Entropy Blobdocs/lt-dev-ticket-workflow.pdf

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requirebin/postinstall.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencebin/postinstall.js

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

5 flagged

package.jsonView file

Lines 7-47json

7 "cli",

8 "lt"

9 ],

10 "author": "Kai Haase",

11 "homepage": "https://lenne.tech",

12 "license": "MIT",

13 "repository": "https://github.com/lenneTech/cli.git",

14 "bugs": {

15 "url": "https://github.com/lenneTech/cli/issues"

16 },

17 "bin": {

18 "lt": "bin/lt"

19 },

20 "scripts": {

21 "c": "npm run check",

22 "cf": "npm run check:fix",

23 "check": "bash scripts/check.sh",

24 "check:audit": "bash scripts/check.sh --audit-only",

25 "check:fix": "npm install && npm audit fix && npm run format && npm run lint:fix && npm run build && npm run check:start",

26 "check:start": "bash scripts/check-cli-start.sh",

27 "postinstall": "node bin/postinstall.js 2>/dev/null || true",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L27

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L27

28 "build": "npm run lint && npm run test && npm run clean-build && npm run compile && npm run copy-templates",

29 "clean-build": "npx rimraf ./build",

30 "compile": "tsc -p .",

31 "copy-templates": "npx shx cp -R ./src/templates ./build/templates && npx shx cp -R ./src/config ./build/config",

32 "coverage": "jest --coverage",

33 "test:vendor-init": "bash scripts/test-vendor-init.sh",

34 "test:frontend-vendor-init": "bash scripts/test-frontend-vendor-init.sh",

35 "test:incremental-fullstack": "bash scripts/test-incremental-fullstack.sh",

36 "test:manual": "jest --testMatch '<rootDir>/*.manual.ts' --testTimeout=60000",

37 "test:e2e:service": "jest --testMatch '<rootDir>/dev-service-e2e.manual.ts' --testTimeout=60000",

38 "format": "prettier --write 'src/**/*.{js,ts,tsx,json}' '!src/templates/**/*'",

39 "lint": "eslint './src/**/*.{ts,js,vue}'",

40 "lint:fix": "eslint './src/**/*.{ts,js,vue}' --fix",

41 "prepublishOnly": "npm run build",

42 "preversion": "npm run lint",

43 "reinit": "npx rimraf package-lock.json && npx rimraf node_modules && npm cache clean --force && npm i && npm run build",

44 "snapupdate": "jest --updateSnapshot",

45 "start": "node bin/lt",

46 "start:build": "npm run build && node bin/lt --compiled-build",

47 "start:compiled": "node bin/lt --compiled-build",

bin/postinstall.jsView file

Lines 1-27javascript

1#!/usr/bin/env node

3/**

4 * Postinstall script for lt CLI

5 * Generates static completion files on install/update (no runtime overhead)

6 */

8const { execSync } = require('child_process');

9const { appendFileSync, existsSync, mkdirSync

docs/lt-dev-ticket-workflow.pdfView file

•path = docs/lt-dev-ticket-workflow.pdf kind = high_entropy_blob sizeBytes = 1419322 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

docs/lt-dev-ticket-workflow.pdfView on unpkg