registry / @lesto/cli / 0.1.5

@lesto/cli@0.1.5

Broken under plain Node before 0.1.7; upgrade to ^0.1.7.

Lesto's `lesto` command-line tool — load a project's lesto.app.ts and run, serve, migrate, or inspect routes.

Static Scan Results

scanned 7d ago · by rust-scanner

Static analysis completed at 93.0% confidence. No malicious behavior was detected; 9 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 25 file(s), 337 KB of source, external domains: 127.0.0.1, auth.example.com, issuer.example.com, mcp.example.com

Source & flagged code

3 flagged

src/eval.tsView file

Lines 157-188typescript

157 // call, and a flood of concurrent judge requests would only invite provider rate

158 // limits without making a gate any more correct.

159 for (const declared of evals) {

160 const result = await scoreOne(declared, deps.judge);

161

162 if (result.passed) {

163 deps.out(`eval ${declared.name}: pass (score ${result.score})`);

164 } else {

165 failures += 1;

166

167 // The code is the machine-readable WHY; absent (a plain failing result), the

168 // line still names the eval and its score.

169 const reason = result.code === undefined ? "" : ` [${result.code}]`;

170

171 deps.out(`eval ${declared.name}: fail (score ${result.score})${reason}`);

172 }

173 }

174

175 if (failures > 0) {

176 deps.out(`eval: ${failures} of ${evals.length} failed`);

177

178 throw new CliError("CLI_EVAL_FAILED", `${failures} eval(s) failed.`, {

179 failed: failures,

Low

Eval

Package source references a known benign dynamic code generation pattern.

src/eval.tsView on unpkg · L177

180 total: evals.length,

181 });

182 }

183

184 deps.out(`eval: ${evals.length} passed`);

185

186 return 0;

187}

188

src/bin.tsView file

Lines 219-259typescript

219 await access(path);

220

221 return true;

222 } catch {

223 return false;

224 }

225};

226

227// Scan `app/routes/` with the real `fs.readdir`, yielding the flat DiscoveredFile

228

Source & flagged code

3 flagged · loading source

src/eval.tsView file

177L178: throw new CliError("CLI_EVAL_FAILED", `${failures} eval(s) failed.`, { L179: failed: failures,

Low

Eval

Package source references a known benign dynamic code generation pattern.

src/eval.tsView on unpkg · L177

src/bin.tsView file

•matchType = previous_version_dangerous_delta matchedPackage = @lesto/cli@0.1.2 matchedIdentity = npm:QGxlc3RvL2NsaQ:0.1.2 similarity = 0.880 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/bin.tsView on unpkg

239L240: // Auto-wire file-based routes onto the loaded app: scan `app/routes/`, `import()` L241: // each page/layout, and register them via `@lesto/web`'s applier. The scan and

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/bin.tsView on unpkg · L239

Findings

1 High3 Medium5 Low

HighPrevious Version Dangerous Deltasrc/bin.ts

MediumDynamic Requiresrc/bin.ts

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowEvalsrc/eval.ts

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

src/eval.tsView file

Lines 157-188typescript

157 // call, and a flood of concurrent judge requests would only invite provider rate

158 // limits without making a gate any more correct.

159 for (const declared of evals) {

160 const result = await scoreOne(declared, deps.judge);

161

162 if (result.passed) {

163 deps.out(`eval ${declared.name}: pass (score ${result.score})`);

164 } else {

165 failures += 1;

166

167 // The code is the machine-readable WHY; absent (a plain failing result), the

168 // line still names the eval and its score.

169 const reason = result.code === undefined ? "" : ` [${result.code}]`;

170

171 deps.out(`eval ${declared.name}: fail (score ${result.score})${reason}`);

172 }

173 }

174

175 if (failures > 0) {

176 deps.out(`eval: ${failures} of ${evals.length} failed`);

177

178 throw new CliError("CLI_EVAL_FAILED", `${failures} eval(s) failed.`, {

179 failed: failures,

Low

Eval

Package source references a known benign dynamic code generation pattern.

src/eval.tsView on unpkg · L177

180 total: evals.length,

181 });

182 }

183

184 deps.out(`eval: ${evals.length} passed`);

185

186 return 0;

187}

188

src/bin.tsView file

Lines 219-259typescript

219 await access(path);

220

221 return true;

222 } catch {

223 return false;

224 }

225};

226

227// Scan `app/routes/` with the real `fs.readdir`, yielding the flat DiscoveredFile

228