registry / @mettlecast/domain-cli / 0.2.72

@mettlecast/domain-cli@0.2.72

⚠ Under review

Local developer toolchain for TIB Domain Module projects. Provides build, validate, test, and dev subcommands.

Static Scan Results

scanned 4h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicenseWildcardDependency

scanned 190 file(s), 1002 KB of source, external domains: api.github.com, lambda-power-tuning.show, mc-scaffold.s3.amazonaws.com

Source & flagged code

4 flagged

dist/commands/reseed-page.jsView file

Lines 1-22javascript

1import { mkdir, writeFile } from 'node:fs/promises';

2import { join, resolve, dirname } from 'node:path';

3import { execSync } from 'node:child_process';

4import { createGunzip } from 'node:zlib';

High

Child Process

Package source references child process execution.

dist/commands/reseed-page.jsView on unpkg · L2

5import { Readable } from 'node:stream';

6import ky from 'ky';

7import { cliLogger } from '../utils/logger.js';

8import { fetchVersionsJson, fetchModulesJson, fetchModuleTarball, } from '../utils/s3-fetch.js';

9import { readManifest } from '../utils/manifest.js';

10import { readScaffoldConfig } from '../utils/scaffold-config.js';

11const SCAFFOLD_BUCKET = 'mc-scaffold';

12// ── Seed page categories ───────────────────────────────────────────────────────

13const SEED_PAGE_CATEGORIES = ['auth', 'account', 'shell', '_errors'];

14const SEED_LAYOUT_DIR = 'layouts';

15// ── Tarball parsing ────────────────────────────────────────────────────────────

16async function parseTarball(buf) {

17 const decompressed = await new Promise((res, rej) => {

18 const gunzip = createGunzip();

19 const chunks = [];

20 const input = Readable.from(buf);

21 input.pipe(gunzip);

22 gunzip.on('data', (chunk) => chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk)));

dist/server/mount-routes.jsView file

Lines 7-47javascript

7 * Mount all API routes from the DomainRegistry onto the Fastify server.

8 *

9 * Issue #4689: the only HTTP endpoint surface in the new registry is

10 * `actions[]` whose `exposure.type === 'api'`. `defineApi` was removed

11 * and `registry.apis`

dist/commands/init.jsView file

Lines 1-25javascript

1/**

2 * init — bootstrap a freshly scaffolded project so it is ready for

3 * local development and CI. Runs npm install, builds the CLI, and

4 * runs a baseline doctor check.

5 *

6 * Usage: npx mc-domain-module init

7 */

8import { execSync } from 'node:child_process';

9import { existsSync } from 'node:fs';

dist/commands/doctor.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @mettlecast/domain-cli@0.2.67 matchedIdentity = npm:QG1ldHRsZWNhc3QvZG9tYWluLWNsaQ:0.2.67 similarity = 0.983 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/commands/doctor.jsView on unpkg

Source & flagged code

4 flagged · loading source

dist/commands/reseed-page.jsView file

2import { join, resolve, dirname } from 'node:path'; L3: import { execSync } from 'node:child_process'; L4: import { createGunzip } from 'node:zlib';

High

Child Process

Package source references child process execution.

dist/commands/reseed-page.jsView on unpkg · L2

dist/server/mount-routes.jsView file

27const fastifyPath = toFastifyPath(exposure.path); L28: const mod = await import(handlerAbsPath); L29: const def = Object.values(mod).find(v => v && typeof v === 'object' && v['id'] === action.id);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/server/mount-routes.jsView on unpkg · L27

dist/commands/init.jsView file

5* L6: * Usage: npx mc-domain-module init L7: */ L8: import { execSync } from 'node:child_process'; L9: import { existsSync } from 'node:fs';

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/commands/init.jsView on unpkg · L5

dist/commands/doctor.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/commands/doctor.jsView on unpkg

Findings

1 Critical3 High5 Medium5 Low

CriticalPrevious Version Dangerous Deltadist/commands/doctor.js

HighChild Processdist/commands/reseed-page.js

HighShell

HighRuntime Package Installdist/commands/init.js

MediumDynamic Requiredist/server/mount-routes.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumWildcard Dependency

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

4 flagged

dist/commands/reseed-page.jsView file

Lines 1-22javascript

1import { mkdir, writeFile } from 'node:fs/promises';

2import { join, resolve, dirname } from 'node:path';

3import { execSync } from 'node:child_process';

4import { createGunzip } from 'node:zlib';

High

Child Process

Package source references child process execution.

dist/commands/reseed-page.jsView on unpkg · L2

5import { Readable } from 'node:stream';

6import ky from 'ky';

7import { cliLogger } from '../utils/logger.js';

8import { fetchVersionsJson, fetchModulesJson, fetchModuleTarball, } from '../utils/s3-fetch.js';

9import { readManifest } from '../utils/manifest.js';

10import { readScaffoldConfig } from '../utils/scaffold-config.js';

11const SCAFFOLD_BUCKET = 'mc-scaffold';

12// ── Seed page categories ───────────────────────────────────────────────────────

13const SEED_PAGE_CATEGORIES = ['auth', 'account', 'shell', '_errors'];

14const SEED_LAYOUT_DIR = 'layouts';

16async function parseTarball(buf) {

17 const decompressed = await new Promise((res, rej) => {

18 const gunzip = createGunzip();

19 const chunks = [];

20 const input = Readable.from(buf);

21 input.pipe(gunzip);

22 gunzip.on('data', (chunk) => chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk)));

dist/server/mount-routes.jsView file

Lines 7-47javascript

7 * Mount all API routes from the DomainRegistry onto the Fastify server.

8 *

9 * Issue #4689: the only HTTP endpoint surface in the new registry is

10 * `actions[]` whose `exposure.type === 'api'`. `defineApi` was removed

11 * and `registry.apis`

dist/commands/init.jsView file

Lines 1-25javascript

1/**

2 * init — bootstrap a freshly scaffolded project so it is ready for

3 * local development and CI. Runs npm install, builds the CLI, and

4 * runs a baseline doctor check.

5 *

6 * Usage: npx mc-domain-module init

7 */

8import { execSync } from 'node:child_process';

9import { existsSync } from 'node:fs';

dist/commands/doctor.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/commands/doctor.jsView on unpkg