registry / @metasession.co/devaudit-cli / 0.3.11

@metasession.co/devaudit-cli@0.3.11

⚠ Under review

DevAudit CLI — installs, syncs, and operates the Metasession SDLC across consumer projects.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 8 file(s), 165 KB of source, external domains: api.github.com, devaudit.metasession.co, github.com, www.conventionalcommits.org

Source & flagged code

6 flagged

sdlc/src/bin/devaudit-sdlc.jsView file

Lines 1-23javascript

1#!/usr/bin/env node

2const fs = require('fs');

3const path = require('path');

4const { spawnSync } = require(

Source & flagged code

6 flagged · loading source

sdlc/src/bin/devaudit-sdlc.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @metasession.co/devaudit-cli@0.3.9 matchedIdentity = npm:[redacted]:0.3.9 similarity = 0.750 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

sdlc/src/bin/devaudit-sdlc.jsView on unpkg

3const path = require('path'); L4: const { spawnSync } = require('child_process'); L5:

High

Child Process

Package source references child process execution.

sdlc/src/bin/devaudit-sdlc.jsView on unpkg · L3

dist/index.jsView file

3import { createConsola } from 'consola'; L4: import { execa } from 'execa'; L5: import { join, resolve, basename, dirname, relative } from 'path';

High

Shell

Package source references shell execution.

dist/index.jsView on unpkg · L3

1782} L1783: await execa("npx", ["husky", "init"], { cwd: ctx.projectPath, stdio: "inherit" }); L1784: return { step: "8/11 Bootstrap hook framework", status: "ok", message: ".husky/ bootstrapped" };

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L1782

79const mainPath = resolve(dir, result.main); L80: const mod = await import(toFileUrl(mainPath)); L81: if (!mod.default || typeof mod.default !== "object") {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L79

scripts/upload-evidence.shView file

•path = scripts/upload-evidence.sh kind = build_helper sizeBytes = 24845 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/upload-evidence.shView on unpkg

Findings

1 Critical3 High5 Medium4 Low

CriticalPrevious Version Dangerous Deltasdlc/src/bin/devaudit-sdlc.js

HighChild Processsdlc/src/bin/devaudit-sdlc.js

HighShelldist/index.js

HighRuntime Package Installdist/index.js

MediumDynamic Requiredist/index.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperscripts/upload-evidence.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

dist/index.jsView file

Lines 1-23javascript

1#!/usr/bin/env node

2import { Command, Option } from 'commander';

3import { createConsola } from 'consola';

4import { execa } from 'execa';

5import { join, resolve, basename, dirname, relative } from 'path';

High

Shell

Package source references shell execution.

dist/index.jsView on unpkg · L3

6import { promises, openAsBlob } from 'fs';

7import envPaths from 'env-paths';

8import { fileURLToPath, pathToFileURL } from 'url';

9import { validateManifest } from '@metasession.co/devaudit-plugin-sdk';

10import * as clack2 from '@clack/prompts';

11import Ajv from 'ajv';

12import { readdir, readFile, writeFile } from 'fs/promises';

14var DEFAULT_OPTIONS = { json: false, verbose: false, noColor: false };

15var currentLogger = build(DEFAULT_OPTIONS);

16var jsonModeActive = false;

17function build(opts) {

18 const level = opts.verbose ? 5 : 3;

19 if (opts.json) {

20 return createConsola({

21 level,

22 reporters: [

23 {

Lines 59-99javascript

59 version: "0.3.11"};

61// src/lib/version.ts

62var CLI_VERSION = package_default.version;

63var paths = envPaths("devaudit", { suffix: "" });

64var CONFIG_DIR = paths.config;

65var AUTH_FILE =

Lines 1762-1802javascript

1762 step: "8/11 Bootstrap hook framework",

1763 status: "warn",

1764 message: "pre-commit not on PATH \u2014 run `pip install pre-commit && pre-commit install` manually"

1765 };

1766 }

1767 await execa("pre-commit", ["install"], { cwd: ctx.projectPath, stdio: "inherit" });

1768 await