registry / @levrbet/shared / 0.5.82

@levrbet/shared@0.5.82

⚠ Under review

Shared utilities, components, and types for the LEVR platform...

Static Scan Results

scanned 12h ago · by rust-scanner

Static analysis flagged 15 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 199 file(s), 787 KB of source, external domains: app.dev.levr.bet, app.levr.bet, app.staging.levr.bet, auth-api.dev.levr.bet, auth-api.staging.levr.bet, auth.api.levr.bet, client-dev-promo-bucket.s3.ap-south-1.amazonaws.com, client-prod-promo-bucket.s3.ap-south-1.amazonaws.com, client-staging-promo-bucket.s3.ap-south-1.amazonaws.com, github.com, indexer.dev.hyperindex.xyz, indexer.hyperindex.xyz, lambda.api.levr.bet, lambda.dev.levr.bet, lambda.staging.levr.bet, leaderboard.api.levr.bet, leaderboard.dev.levr.bet, leaderboard.staging.levr.bet, levrbet.squids.live, liquidation-engine.api.levr.bet, liquidation-engine.dev.levr.bet, liquidation-engine.staging.levr.bet, openzeppeline.dev-services-domain, openzeppeline.prod-services-domain, openzeppeline.staging-services-domain, oracle-core.api.levr.bet, oracle-core.dev.levr.bet, oracle-core.staging.levr.bet, oracle-periphery.api.levr.bet, oracle-periphery.dev.levr.bet, oracle-periphery.staging.levr.bet, oracle-processor.api.levr.bet, oracle-processor.dev.levr.bet, oracle-processor.staging.levr.bet, orderbook.api.levr.bet, orderbook.dev.levr.bet, orderbook.staging.levr.bet, referrals.api.levr.bet, referrals.dev.levr.bet, referrals.staging.levr.bet, relayers.dev.levr.bet

Source & flagged code

5 flagged

package.jsonView file

Lines 22-62json

22 "./react": {

23 "types": "./dist/react/index.d.ts",

24 "import": "./dist/react/index.js",

25 "require": "./dist/react/index.js"

26 }

27 },

28 "files": [

29 "dist",

30 "prisma",

31 "scripts"

32 ],

33 "bin": {

34 "levrbet-prisma-setup": "scripts/setup-prisma.js"

35 },

36 "sideEffects": false,

37 "scripts": {

38 "build": "npm run clean && tsgo",

39 "dev": "npm run build && npm pack",

40 "clean": "rm -rf dist .tsbuildinfo",

41 "prepublishOnly": "npm run build",

42 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L42

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L42

43 "test-get-healthy-indexer": "tsx src/core/indexers/indexers.service.ts",

44 "test-update-cache": "tsx src/server/oracle/redis-cache-manager/test.market.update.search.ts",

45 "test-rmq": "tsx src/server/oracle/rmq-manager/test.rmq.connections.ts"

46 },

47 "peerDependencies": {

48 "@prisma/client": "^6.0.0",

49 "@privy-io/react-auth": ">=3.0.0",

50 "@tanstack/react-query": ">=5.0.0",

51 "@types/react": ">=18.0.0",

52 "react": ">=18.0.0",

53 "wagmi": ">=2.0.0"

54 },

55 "peerDependenciesMeta": {

56 "react": {

57 "optional": true

58 },

59 "@types/react": {

60 "optional": true

61 },

62 "@tanstack/react-query": {

scripts/postinstall.jsView file

Lines 1-30javascript

1#!/usr/bin/env node

3/**

4 * Postinstall script for @levrbet/shared

5 * Automatically generates Prisma client using the schema bundled in this package.

6 *

7 * This runs automatically when consumers install @levrbet/shared.

8 * The Prisma schema stays in this package - no files are copied to the consumer.

9 */

11const { execSync } = require

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/postinstall.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @levrbet/shared@0.5.76 matchedIdentity = npm:QGxldnJiZXQvc2hhcmVk:0.5.76 similarity = 0.983 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

scripts/postinstall.jsView on unpkg

10L11: const { execSync } = require("child_process") L12: const fs = require("fs")

High

Child Process

Package source references child process execution.

scripts/postinstall.jsView on unpkg · L10

95// Run from the consumer's project root so @prisma/client is found there L96: execSync(`npx prisma generate --schema="${schemaPath}"`, { L97: stdio: "inherit",

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/postinstall.jsView on unpkg · L95

Findings

1 Critical3 High4 Medium7 Low

CriticalPrevious Version Dangerous Deltascripts/postinstall.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processscripts/postinstall.js

HighRuntime Package Installscripts/postinstall.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEval

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

5 flagged

package.jsonView file

Lines 22-62json

22 "./react": {

23 "types": "./dist/react/index.d.ts",

24 "import": "./dist/react/index.js",

25 "require": "./dist/react/index.js"

26 }

27 },

28 "files": [

29 "dist",

30 "prisma",

31 "scripts"

32 ],

33 "bin": {

34 "levrbet-prisma-setup": "scripts/setup-prisma.js"

35 },

36 "sideEffects": false,

37 "scripts": {

38 "build": "npm run clean && tsgo",

39 "dev": "npm run build && npm pack",

40 "clean": "rm -rf dist .tsbuildinfo",

41 "prepublishOnly": "npm run build",

42 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L42

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L42

43 "test-get-healthy-indexer": "tsx src/core/indexers/indexers.service.ts",

44 "test-update-cache": "tsx src/server/oracle/redis-cache-manager/test.market.update.search.ts",

45 "test-rmq": "tsx src/server/oracle/rmq-manager/test.rmq.connections.ts"

46 },

47 "peerDependencies": {

48 "@prisma/client": "^6.0.0",

49 "@privy-io/react-auth": ">=3.0.0",

50 "@tanstack/react-query": ">=5.0.0",

51 "@types/react": ">=18.0.0",

52 "react": ">=18.0.0",

53 "wagmi": ">=2.0.0"

54 },

55 "peerDependenciesMeta": {

56 "react": {

57 "optional": true

58 },

59 "@types/react": {

60 "optional": true

61 },

62 "@tanstack/react-query": {

scripts/postinstall.jsView file

Lines 1-30javascript

1#!/usr/bin/env node

3/**

4 * Postinstall script for @levrbet/shared

5 * Automatically generates Prisma client using the schema bundled in this package.

6 *

7 * This runs automatically when consumers install @levrbet/shared.

8 * The Prisma schema stays in this package - no files are copied to the consumer.

9 */

11const { execSync } = require

Lines 75-112javascript

75 console.log("[@levrbet/shared] Skipping postinstall (development mode)")

76 return

77 }

79 const projectRoot = findProjectRoot()

80 const packageDir = path.join(__dirname, "..")

81 const schemaPath = path.join(packageDir, "prisma")

83 // Verify schema exists

84 if (!fs.existsSync(schemaPath)) {

85 console.error("[@levrbet/shared] Error: Prisma schema directory not found at", schemaPath)

86 process.exit(1)

87 }

89 console.log("[@levrbet/shared] Generating Prisma client...")

90 console.log(`[@levrbet/shared] Schema: ${schemaPath}`)

91 console.log(`[@levrbet/shared] Project root: ${projectRoot}`)

93 try {

94 // Generate Prisma client using the schema from this package

95 // Run from the consumer's project root so @prisma/client is found there

96 execSync(`npx prisma generate --schema="${schemaPath}"`, {

97 stdio: "inherit",

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/postinstall.jsView on unpkg · L95

98 cwd: projectRoot,

99 })

100 console.log("[@levrbet/shared] Prisma client generated successfully!")

101 } catch (err) {

102 console.error("[@levrbet/shared] Failed to generate Prisma client:", err.message)

103 console.error(

104 "[@levrbet/shared] You may need to run: npx prisma generate --schema=node_modules/@levrbet/shared/prisma"

105 )

106 // Don't exit with error - allow install to complete even if generation fails

107 // This prevents blocking installs when @prisma/client isn't yet installed

108 }

109}

110

111main()

112