registry / @m-kopa/launchpad-cli / 0.43.0

@m-kopa/launchpad-cli@0.43.0

Launchpad CLI — clone / deploy / review / merge against Launchpad-managed apps. Talks to the portal-bot endpoints (SCOPE-M-760 / T4).

Static Scan Results

scanned 4h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 28 file(s), 645 KB of source, external domains: 127.0.0.1, 192.168.1.10, app.localhost, auth.example, auth.launchpad.m-kopa.us, evil.test, launchpad-portal-bot.mkopa-launchpad.workers.dev, marquee-canonical.m-kopa.us, marquee-preview.example.com, marquee.example.com, marquee.launchpad.m-kopa.us, mkopa.cloudflareaccess.com, preview.example.com

Source & flagged code

3 flagged

package.jsonView file

Lines 27-66json

27 },

28 "homepage": "https://github.com/M-KOPA/launchpad-platform/tree/main/packages/launchpad-cli#readme",

29 "license": "UNLICENSED",

30 "dependencies": {

31 "esbuild": "0.28.1",

32 "yaml": "2.9.0",

33 "zod": "4.4.3"

34 },

35 "devDependencies": {

36 "@types/node": "22.18.10",

37 "@typescript-eslint/eslint-plugin": "8.46.4",

38 "@typescript-eslint/parser": "8.46.4",

39 "@vitest/coverage-istanbul": "4.1.5",

40 "eslint": "9.39.4",

41 "typescript": "5.9.3",

42 "vitest": "4.1.5",

43 "@m-kopa/launchpad-engine": "workspace:*"

44 },

45 "scripts": {

46 "build": "rm -rf dist && bun build src/cli.ts src/postinstall.ts --target=node --outdir=dist --external yaml --external zod --external esbuild --external '@m-kopa/platform-auth' && chmod +x dist/cli.js && tsc -p tsconfig.build.json --emitDeclarationOnly --declarationDir dist",

47 "postinstall": "node dist/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L47

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L47

48 "test": "vitest run",

49 "test:watch": "vitest",

50 "lint": "eslint src tests",

51 "typecheck": "tsc --noEmit",

52 "typecheck:catalogue": "tsc -p channel/catalogue/tsconfig.json --noEmit",

53 "build:catalogue": "esbuild channel/catalogue/src/main.ts --bundle --format=esm --minify --target=es2020 --legal-comments=none --outfile=channel/catalogue/dist/app.js",

54 "check:version-sync": "bash scripts/check-version-sync.sh",

55 "check:runtime-deps": "node scripts/check-runtime-deps.mjs",

56 "check:installer-syntax": "bash scripts/check-installer-syntax.sh",

57 "check:skill-contract": "bash scripts/sync-skill-contract.sh --check",

58 "check:skill-bash-dialect": "bash scripts/check-skill-bash-dialect.sh",

59 "check:skill-bash-parse": "bash scripts/check-skill-bash-parse.sh",

60 "check:skills": "bun run check:skill-contract && bun run check:skill-bash-dialect && bun run check:skill-bash-parse",

61 "sync:skill-contract": "bash scripts/sync-skill-contract.sh write",

62 "version:patch": "npm version patch --no-git-tag-version",

63 "version:minor": "npm version minor --no-git-tag-version"

64 }

65}

skills/marquee-share/install.shView file

•path = skills/marquee-share/install.sh kind = build_helper sizeBytes = 3440 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/marquee-share/install.shView on unpkg

Source & flagged code

3 flagged · loading source

package.jsonView file

•scripts.postinstall = node dist/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node dist/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

skills/marquee-share/install.shView file

•path = skills/marquee-share/install.sh kind = build_helper sizeBytes = 3440 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/marquee-share/install.shView on unpkg

Findings

1 High5 Medium5 Low

HighInstall Time Lifecycle Scriptspackage.json

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperskills/marquee-share/install.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License