registry / @livx.cc/appwrap / 0.42.2

@livx.cc/appwrap@0.42.2

Wrap any PWA into a native app with native capabilities (appwrap runtime + @livx.cc/native-kit).

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 57 file(s), 590 KB of source, external domains: app.example.com, appwrap.local, www.apple.com

Source & flagged code

3 flagged

src/cli.tsView file

Lines 1-30typescript

1#!/usr/bin/env bun

2/**

3 * appwrap CLI v0 — scaffold a native wrapper around a built PWA.

4 *

5 * appwrap init [--config <path>] [--out native] # from the PWA project dir

6 * appwrap sync [--config <path>] [--out native] # re-copy PWA dist into the wrapper

7 *

8 * Config (TS preferred, JSON fallback) — probed in order: appwrap.config.ts → .js → appwrap.json.

9 * Shape: { id, name, version, entry?, backgroundColor?, statusBarStyle?, pwaDist }. See config.ts.

10 */

11import { execFileSync, spawn } from 'child_process';

12import { cpSync, existsSync, mkdirSync, openSync, closeSync, readdirSync, readFileSync, readSync, rmSync, statSync, writeFileSync, writeSync } from 'fs';

High

Child Process

Package source references child process execution.

src/cli.tsView on unpkg · L10

13import { networkInterfaces, tmpdir } from 'os';

14import { dirname, join, resolve } from 'path';

15import { pathToFileURL } from 'url';

16// PURE-DATA capability manifest (no NativeScript globals) — type-only import (erased at runtime);

17// the VALUES are loaded dynamically below from the resolved runtime so the CLI works both in the

18// monorepo and from a published tarball (where runtime/ is bundled at the package root).

19import type * as CapManifest from '../../../runtime/app/shell/capabilities.manifest';

20// Config shape lives in its own import-safe module so a `appwrap.config.ts` file can import the

21// type + `defineConfig` helper without pulling in (and running) the CLI dispatch.

22import type { AppwrapConfig } from './config';

23import { unknownConfigKeys } from './config';

24import {

25 androidScreenOrientation,

26 applyBuildNumberFlag,

27 iosOrientations,

28 mergeManifest,

29 resolveBuildNumber,

30 stampAndroidOrientation,

Lines 1769-1809typescript

1769 return candidates.find((d) => existsSync(join(d, 'platform-tools')) || existsSync(join(d, 'platforms')));

1770}

1771

1772/** Build the env for an `ns` invocation in `outDir` (auto-detect Android SDK, ensure bun-installed deps).

1773 * Shared by the blocking `runNs` (sim) and the non-blocking spawn in `dev` (device livesync). */

1774function prepareNsEnv(outDir:

runtime/app/shell/handlers-extended.tsView file

Lines 167-207typescript

167 bridge.register('clipboard.copy', ({ text }: { text: string }) => {

168 if (isIOS) {

169 UIPasteboard.generalPasteboard.string = String(text ?? '');

170 } else if

Source & flagged code

3 flagged · loading source

src/cli.tsView file

10*/ L11: import { execFileSync, spawn } from 'child_process'; L12: import { cpSync, existsSync, mkdirSync, openSync, closeSync, readdirSync, readFileSync, readSync, rmSync, statSync, writeFileSync, writeSync } from 'fs';

High

Child Process

Package source references child process execution.

src/cli.tsView on unpkg · L10

1789if (!existsSync(join(outDir, 'node_modules'))) { L1790: console.log(`▶ bun install (cwd: ${outDir})`); L1791: execFileSync('bun', ['install'], { cwd: outDir, stdio: 'inherit', env }); L1792: }

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/cli.tsView on unpkg · L1789

runtime/app/shell/handlers-extended.tsView file

187// ── secure storage (Keychain/Keystore via @nativescript/secure-storage) ── L188: const secure = new (require('@nativescript/secure-storage').SecureStorage)(); L189: bridge.register('storage.secure.get', async ({ key }: { key: string }) =>

Medium

Dynamic Require

Package source references dynamic require/import behavior.

runtime/app/shell/handlers-extended.tsView on unpkg · L187

Findings

3 High3 Medium4 Low

HighChild Processsrc/cli.ts

HighShell

HighRuntime Package Installsrc/cli.ts

MediumDynamic Requireruntime/app/shell/handlers-extended.ts

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

src/cli.tsView file

Lines 1-30typescript

1#!/usr/bin/env bun

2/**

3 * appwrap CLI v0 — scaffold a native wrapper around a built PWA.

4 *

5 * appwrap init [--config <path>] [--out native] # from the PWA project dir

6 * appwrap sync [--config <path>] [--out native] # re-copy PWA dist into the wrapper

7 *

8 * Config (TS preferred, JSON fallback) — probed in order: appwrap.config.ts → .js → appwrap.json.

9 * Shape: { id, name, version, entry?, backgroundColor?, statusBarStyle?, pwaDist }. See config.ts.

10 */

11import { execFileSync, spawn } from 'child_process';

12import { cpSync, existsSync, mkdirSync, openSync, closeSync, readdirSync, readFileSync, readSync, rmSync, statSync, writeFileSync, writeSync } from 'fs';

High

Child Process

Package source references child process execution.

src/cli.tsView on unpkg · L10

13import { networkInterfaces, tmpdir } from 'os';

14import { dirname, join, resolve } from 'path';

15import { pathToFileURL } from 'url';

16// PURE-DATA capability manifest (no NativeScript globals) — type-only import (erased at runtime);

17// the VALUES are loaded dynamically below from the resolved runtime so the CLI works both in the

18// monorepo and from a published tarball (where runtime/ is bundled at the package root).

19import type * as CapManifest from '../../../runtime/app/shell/capabilities.manifest';

20// Config shape lives in its own import-safe module so a `appwrap.config.ts` file can import the

21// type + `defineConfig` helper without pulling in (and running) the CLI dispatch.

22import type { AppwrapConfig } from './config';

23import { unknownConfigKeys } from './config';

24import {

25 androidScreenOrientation,

26 applyBuildNumberFlag,

27 iosOrientations,

28 mergeManifest,

29 resolveBuildNumber,

30 stampAndroidOrientation,

Lines 1769-1809typescript

1769 return candidates.find((d) => existsSync(join(d, 'platform-tools')) || existsSync(join(d, 'platforms')));

1770}

1771

1772/** Build the env for an `ns` invocation in `outDir` (auto-detect Android SDK, ensure bun-installed deps).

1773 * Shared by the blocking `runNs` (sim) and the non-blocking spawn in `dev` (device livesync). */

1774function prepareNsEnv(outDir:

runtime/app/shell/handlers-extended.tsView file

Lines 167-207typescript

167 bridge.register('clipboard.copy', ({ text }: { text: string }) => {

168 if (isIOS) {

169 UIPasteboard.generalPasteboard.string = String(text ?? '');

170 } else if