registry / @metasession.co/devaudit-cli / 0.3.16

@metasession.co/devaudit-cli@0.3.16

DevAudit CLI — installs, syncs, and operates the Metasession SDLC across consumer projects.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 8 file(s), 171 KB of source, external domains: api.github.com, devaudit.metasession.co, github.com, www.conventionalcommits.org

Source & flagged code

5 flagged

sdlc/src/bin/devaudit-sdlc.jsView file

Lines 1-23javascript

1#!/usr/bin/env node

2const fs = require('fs');

3const path = require('path');

4const { spawnSync } = require('child_process');

High

Child Process

Package source references child process execution.

sdlc/src/bin/devaudit-sdlc.jsView on unpkg · L3

6const args = process.argv.slice(2);

7const sentinelPath = path.join(process.cwd(), '.sdlc-implementer-invoked');

8const watchStatePath = path.join(process.cwd(), '.sdlc-pr-watch.json');

9const DEFAULT_POLL_INTERVAL_SECONDS = 30;

10const DEFAULT_MAX_POLLS = 40;

11const DEFAULT_FLAKY_PATTERNS = [

12 'playwright',

13 'e2e',

14 'regression',

15 'smoke',

16 'flaky',

17 'retry',

18];

19const DEFAULT_INTEGRATION_BRANCH = 'develop';

20const DEFAULT_RELEASE_BRANCH = 'main';

21const REQUIRED_RELEASE_CHECKS = [

22 'Quality Gates',

23 'Release Scope Integrity',

dist/index.jsView file

Lines 1-23javascript

1#!/usr/bin/env node

2import { Command, Option } from 'commander';

3import { createConsola } from 'consola';

4import { execa } from 'execa';

5import { join, resolve, basename, dirname, relative } from

scripts/upload-evidence.shView file

•path = scripts/upload-evidence.sh kind = build_helper sizeBytes = 27213 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/upload-evidence.shView on unpkg

Source & flagged code

5 flagged · loading source

sdlc/src/bin/devaudit-sdlc.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code