registry / @lenne.tech/cli / 1.41.0

@lenne.tech/cli@1.41.0

lenne.Tech CLI: lt

Static Scan Results

scanned 16h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 176 file(s), 1.56 MB of source, external domains: 127.0.0.1, api.github.com, caddyserver.com, developers.cloudflare.com, developers.openai.com, docs.anthropic.com, docs.nestjs.com, git-scm.com, github.com, infinitered.github.io, lenne.tech, nodejs.org, raw.githubusercontent.com, regex101.com, registry.npmjs.org, stackblitz.com, www.apple.com

Source & flagged code

5 flagged

package.jsonView file

Lines 7-47json

7 "cli",

8 "lt"

9 ],

10 "author": "Kai Haase",

11 "homepage": "https://lenne.tech",

12 "license": "MIT",

13 "repository": "https://github.com/lenneTech/cli.git",

14 "bugs": {

15 "url": "https://github.com/lenneTech/cli/issues"

16 },

17 "bin": {

18 "lt": "bin/lt"

19 },

20 "scripts": {

21 "c": "npm run check",

22 "cf": "npm run check:fix",

23 "check": "bash scripts/check.sh",

24 "check:audit": "bash scripts/check.sh --audit-only",

25 "check:fix": "npm install && npm audit fix && npm run format && npm run lint:fix && npm run build && npm run check:start",

26 "check:start": "bash scripts/check-cli-start.sh",

27 "postinstall": "node bin/postinstall.js 2>/dev/null || true",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L27

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L27

28 "build": "npm run lint && npm run test && npm run clean-build && npm run compile && npm run copy-templates",

29 "clean-build": "npx rimraf ./build",

30 "compile": "tsc -p .",

31 "copy-templates": "npx shx cp -R ./src/templates ./build/templates && npx shx cp -R ./src/config ./build/config",

32 "coverage": "jest --coverage",

33 "test:vendor-init": "bash scripts/test-vendor-init.sh",

34 "test:frontend-vendor-init": "bash scripts/test-frontend-vendor-init.sh",

35 "test:incremental-fullstack": "bash scripts/test-incremental-fullstack.sh",

36 "test:manual": "jest --testMatch '<rootDir>/*.manual.ts' --testTimeout=60000",

37 "test:e2e:service": "jest --testMatch '<rootDir>/dev-service-e2e.manual.ts' --testTimeout=60000",

38 "format": "prettier --write 'src/**/*.{js,ts,tsx,json}' '!src/templates/**/*'",

39 "lint": "eslint './src/**/*.{ts,js,vue}'",

40 "lint:fix": "eslint './src/**/*.{ts,js,vue}' --fix",

41 "prepublishOnly": "npm run build",

42 "preversion": "npm run lint",

43 "reinit": "npx rimraf package-lock.json && npx rimraf node_modules && npm cache clean --force && npm i && npm run build",

44 "snapupdate": "jest --updateSnapshot",

45 "start": "node bin/lt",

46 "start:build": "npm run build && node bin/lt --compiled-build",

47 "start:compiled": "node bin/lt --compiled-build",

bin/postinstall.jsView file

Lines 1-27javascript

1#!/usr/bin/env node

3/**

4 * Postinstall script for lt CLI

5 * Generates static completion files on install/update (no runtime overhead)

6 */

8const { execSync } = require('child_process');

9const

build/lib/dev-process.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @lenne.tech/cli@1.40.0 matchedIdentity = npm:QGxlbm5lLnRlY2gvY2xp:1.40.0 similarity = 0.967 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

build/lib/dev-process.jsView on unpkg

Source & flagged code

5 flagged · loading source

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code