registry / @m-kopa/launchpad-cli / 0.54.0

@m-kopa/launchpad-cli@0.54.0

Launchpad CLI — clone / deploy / review / merge against Launchpad-managed apps. Talks to the portal-bot endpoints (SCOPE-M-760 / T4).

Static Scan Results

scanned 23h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 28 file(s), 703 KB of source, external domains: 127.0.0.1, 192.168.1.10, app.localhost, auth.example, auth.launchpad.m-kopa.us, evil.test, launchpad-portal-bot.mkopa-launchpad.workers.dev, marquee-canonical.m-kopa.us, marquee-preview.example.com, marquee.example.com, marquee.launchpad.m-kopa.us, mkopa.cloudflareaccess.com, preview.example.com

Source & flagged code

4 flagged

package.jsonView file

Lines 30-69json

30 "url": "https://github.com/M-KOPA/launchpad-platform/issues"

31 },

32 "license": "UNLICENSED",

33 "dependencies": {

34 "esbuild": "0.28.1",

35 "yaml": "2.9.0",

36 "zod": "4.4.3"

37 },

38 "devDependencies": {

39 "@types/node": "22.18.10",

40 "@typescript-eslint/eslint-plugin": "8.46.4",

41 "@typescript-eslint/parser": "8.46.4",

42 "@vitest/coverage-istanbul": "4.1.5",

43 "eslint": "9.39.4",

44 "typescript": "5.9.3",

45 "vitest": "4.1.5",

46 "@m-kopa/launchpad-engine": "workspace:*"

47 },

48 "scripts": {

49 "build": "rm -rf dist && bun build src/cli.ts src/postinstall.ts --target=node --outdir=dist --external yaml --external zod --external esbuild --external '@m-kopa/platform-auth' && chmod +x dist/cli.js && tsc -p tsconfig.build.json --emitDeclarationOnly --declarationDir dist",

50 "postinstall": "node dist/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L50

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L50

51 "test": "vitest run",

52 "test:watch": "vitest",

53 "lint": "eslint src tests",

54 "typecheck": "tsc --noEmit",

55 "typecheck:catalogue": "tsc -p channel/catalogue/tsconfig.json --noEmit",

56 "build:catalogue": "esbuild channel/catalogue/src/main.ts --bundle --format=esm --minify --target=es2020 --legal-comments=none --outfile=channel/catalogue/dist/app.js",

57 "check:version-sync": "bash scripts/check-version-sync.sh",

58 "check:runtime-deps": "node scripts/check-runtime-deps.mjs",

59 "check:installer-syntax": "bash scripts/check-installer-syntax.sh",

60 "check:skill-contract": "bash scripts/sync-skill-contract.sh --check",

61 "check:skill-bash-dialect": "bash scripts/check-skill-bash-dialect.sh",

62 "check:skill-bash-parse": "bash scripts/check-skill-bash-parse.sh",

63 "check:skills": "bun run check:skill-contract && bun run check:skill-bash-dialect && bun run check:skill-bash-parse",

64 "sync:skill-contract": "bash scripts/sync-skill-contract.sh write",

65 "version:patch": "npm version patch --no-git-tag-version",

66 "version:minor": "npm version minor --no-git-tag-version"

67 }

68}

skills/marquee-share/install.shView file

•path = skills/marquee-share/install.sh kind = build_helper sizeBytes = 3440 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/marquee-share/install.shView on unpkg

dist/cli.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @m-kopa/launchpad-cli@0.53.0 matchedIdentity = npm:QG0ta29wYS9sYXVuY2hwYWQtY2xp:0.53.0 similarity = 0.964 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.jsView on unpkg

Source & flagged code

4 flagged · loading source

package.json

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code