registry / @metasession.co/devaudit-cli / 0.3.9

@metasession.co/devaudit-cli@0.3.9

DevAudit CLI — installs, syncs, and operates the Metasession SDLC across consumer projects.

Static Scan Results

scanned 8d ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

DynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 8 file(s), 148 KB of source, external domains: api.github.com, devaudit.metasession.co, github.com, www.conventionalcommits.org

Source & flagged code

4 flagged

dist/index.jsView file

Lines 1-23javascript

1#!/usr/bin/env node

2import { Command, Option } from 'commander';

3import { createConsola } from 'consola';

4import { execa } from 'execa';

5import { join, resolve, basename, dirname, relative } from 'path';

High

Shell

Package source references shell execution.

dist/index.jsView on unpkg · L3

6import { promises } from 'fs';

7import envPaths from 'env-paths';

8import { fileURLToPath, pathToFileURL } from 'url';

9import { validateManifest } from '@metasession.co/devaudit-plugin-sdk';

10import * as clack2 from '@clack/prompts';

11import Ajv from 'ajv';

12import { readdir, readFile, writeFile } from 'fs/promises';

14var DEFAULT_OPTIONS = { json: false, verbose: false, noColor: false };

15var currentLogger = build(DEFAULT_OPTIONS);

16var jsonModeActive = false;

17function build(opts) {

18 const level = opts.verbose ? 5 : 3;

19 if (opts.json) {

20 return createConsola({

21 level,

22 reporters: [

23 {

Lines 59-99javascript

59 version: "0.3.9"};

61// src/lib/version.ts

62var CLI_VERSION = package_default.version;

63var paths = envPaths("devaudit", { suffix: "" });

64var CONFIG_DIR = paths.config;

65var AUTH_FILE =

Lines 1715-1755javascript

1715 step: "8/11 Bootstrap hook framework",

1716 status: "warn",

1717 message: "pre-commit not on PATH \u2014 run `pip install pre-commit && pre-commit install` manually"

1718 };

1719 }

1720 await execa("pre-commit", ["install"], { cwd: ctx.projectPath, stdio: "inherit" });

1721 await

scripts/upload-evidence.shView file

•path = scripts/upload-evidence.sh kind = build_helper sizeBytes = 24845 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/upload-evidence.shView on unpkg

Source & flagged code

4 flagged · loading source

dist/index.jsView file

3import { createConsola } from 'consola'; L4: import { execa } from 'execa'; L5: import { join, resolve, basename, dirname, relative } from 'path';

High

Shell

Package source references shell execution.

dist/index.jsView on unpkg · L3

1735} L1736: await execa("npx", ["husky", "init"], { cwd: ctx.projectPath, stdio: "inherit" }); L1737: return { step: "8/11 Bootstrap hook framework", status: "ok", message: ".husky/ bootstrapped" };

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L1735

79const mainPath = resolve(dir, result.main); L80: const mod = await import(toFileUrl(mainPath)); L81: if (!mod.default || typeof mod.default !== "object") {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L79

scripts/upload-evidence.shView file

•path = scripts/upload-evidence.sh kind = build_helper sizeBytes = 24845 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/upload-evidence.shView on unpkg

Findings

2 High5 Medium4 Low

HighShelldist/index.js

HighRuntime Package Installdist/index.js

MediumDynamic Requiredist/index.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperscripts/upload-evidence.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

dist/index.jsView file

Lines 1-23javascript

1#!/usr/bin/env node

2import { Command, Option } from 'commander';

3import { createConsola } from 'consola';

4import { execa } from 'execa';

5import { join, resolve, basename, dirname, relative } from 'path';

High

Shell

Package source references shell execution.

dist/index.jsView on unpkg · L3

6import { promises } from 'fs';

7import envPaths from 'env-paths';

8import { fileURLToPath, pathToFileURL } from 'url';

9import { validateManifest } from '@metasession.co/devaudit-plugin-sdk';

10import * as clack2 from '@clack/prompts';

11import Ajv from 'ajv';

12import { readdir, readFile, writeFile } from 'fs/promises';

14var DEFAULT_OPTIONS = { json: false, verbose: false, noColor: false };

15var currentLogger = build(DEFAULT_OPTIONS);

16var jsonModeActive = false;

17function build(opts) {

18 const level = opts.verbose ? 5 : 3;

19 if (opts.json) {

20 return createConsola({

21 level,

22 reporters: [

23 {

Lines 59-99javascript

59 version: "0.3.9"};

61// src/lib/version.ts

62var CLI_VERSION = package_default.version;

63var paths = envPaths("devaudit", { suffix: "" });

64var CONFIG_DIR = paths.config;

65var AUTH_FILE =

Lines 1715-1755javascript

1715 step: "8/11 Bootstrap hook framework",

1716 status: "warn",

1717 message: "pre-commit not on PATH \u2014 run `pip install pre-commit && pre-commit install` manually"

1718 };

1719 }

1720 await execa("pre-commit", ["install"], { cwd: ctx.projectPath, stdio: "inherit" });

1721 await

scripts/upload-evidence.shView file

•path = scripts/upload-evidence.sh kind = build_helper sizeBytes = 24845 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/upload-evidence.shView on unpkg