registry / @mintlify/cli / 4.0.1263

@mintlify/cli@4.0.1263

The Mintlify CLI

Static Scan Results

scanned 5d ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 82 file(s), 307 KB of source, external domains: a.com, api.github.com, api.stytch.com, app.mintlify.com, b.com, c.com, example.com, github.com, leaves.mintlify.com, mintlify.com, petstore3.swagger.io, ph.mintlify.com, swagger.io, tailwindcss.com, test.stytch.com, www.w3.org

Source & flagged code

1 flagged

bin/helpers.jsView file

Lines 1-38javascript

1var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {

2 function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }

3 return new (P || (P = Promise))(function (resolve, reject) {

4 function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }

5 function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }

6 function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }

7 step((generator = generator.apply(thisArg, _arguments || [])).next());

8 });

9};

10import { jsx as _jsx } from "react/jsx-runtime";

11import { getConfigPath } from '@mintlify/prebuild';

12import { MintConfigUpdater } from '@mintlify/prebuild';

13import { addLog, ErrorLog, getClientVersion, SuccessLog, InfoLog, SpinnerLog, removeLastLog, LOCAL_LINKED_CLI_VERSION, WarningLog, } from '@mintlify/previewing';

14import { upgradeToDocsConfig, validatePathWithinCwd } from '@mintlify/validation';

15import detect from 'detect-port';

16import fse from 'fs-extra';

17import inquirer from 'inquirer';

18import yaml from 'js-yaml';

19import { execFile, execFileSync } from 'node:child_process';

20import { readFileSync } from 'node:fs';

21import fs from 'node:fs/promises';

22import { createRequire } from 'node:module';

23import { fileURLToPath } from 'node:url';

24import { promisify } from 'node:util';

25import path from 'path';

26import { shutdownPostHog } from './telemetry/client.js';

27export const CMD_EXEC_PATH = process.cwd();

28export const checkPort = (argv) => __awaiter(void 0, void 0, void 0, function* () {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/helpers.jsView on unpkg · L18

29 const initialPort = typeof argv.port === 'number' ? argv.port : 3000;

30 if (initialPort === (yield detect(initialPort)))

31 return initialPort;

32 for (let port = initialPort + 1; port < initialPort + 10; port++) {

33 addLog(_jsx(InfoLog, { message: `port ${port - 1} is already in use. trying ${port} instead` }));

34 if (port === (yield detect(port)))

35 return port;

36 }

37});

38export const checkNodeVersion = () => __awaiter(void 0, void 0, void 0, function* () {

Source & flagged code

1 flagged · loading source

bin/helpers.jsView file

18import yaml from 'js-yaml'; L19: import { execFile, execFileSync } from 'node:child_process'; L20: import { readFileSync } from 'node:fs'; ... L26: import { shutdownPostHog } from './telemetry/client.js'; L27: export const CMD_EXEC_PATH = process.cwd(); L28: export const checkPort = (argv) => __awaiter(void 0, void 0, void 0, function* () { ... L125: try { L126: const pkgPath = require.resolve(`${packageName}/package.json`); L127: const pkg = JSON.parse(readFileSync(pkgPath, 'utf8')); L128: return typeof pkg.version === 'string' ? pkg.version : undefined; ... L135: var _a; L136: if (packageName === void 0) { packageName = (_a = process.env.MINTLIFY_PACKAGE_NAME) !== null && _a !== void 0 ? _a : 'mint'; }

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/helpers.jsView on unpkg · L18

Findings

1 High3 Medium6 Low

HighSandbox Evasion Gated Capabilitybin/helpers.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

Source & flagged code

1 flagged

bin/helpers.jsView file

Lines 1-38javascript

1var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {

2 function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }

3 return new (P || (P = Promise))(function (resolve, reject) {

4 function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }

5 function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }

6 function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }

7 step((generator = generator.apply(thisArg, _arguments || [])).next());

8 });

9};

10import { jsx as _jsx } from "react/jsx-runtime";

11import { getConfigPath } from '@mintlify/prebuild';

12import { MintConfigUpdater } from '@mintlify/prebuild';

13import { addLog, ErrorLog, getClientVersion, SuccessLog, InfoLog, SpinnerLog, removeLastLog, LOCAL_LINKED_CLI_VERSION, WarningLog, } from '@mintlify/previewing';

14import { upgradeToDocsConfig, validatePathWithinCwd } from '@mintlify/validation';

15import detect from 'detect-port';

16import fse from 'fs-extra';

17import inquirer from 'inquirer';

18import yaml from 'js-yaml';

19import { execFile, execFileSync } from 'node:child_process';

20import { readFileSync } from 'node:fs';

21import fs from 'node:fs/promises';

22import { createRequire } from 'node:module';

23import { fileURLToPath } from 'node:url';

24import { promisify } from 'node:util';

25import path from 'path';

26import { shutdownPostHog } from './telemetry/client.js';

27export const CMD_EXEC_PATH = process.cwd();

28export const checkPort = (argv) => __awaiter(void 0, void 0, void 0, function* () {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/helpers.jsView on unpkg · L18

29 const initialPort = typeof argv.port === 'number' ? argv.port : 3000;

30 if (initialPort === (yield detect(initialPort)))

31 return initialPort;

32 for (let port = initialPort + 1; port < initialPort + 10; port++) {

33 addLog(_jsx(InfoLog, { message: `port ${port - 1} is already in use. trying ${port} instead` }));

34 if (port === (yield detect(port)))

35 return port;

36 }

37});

38export const checkNodeVersion = () => __awaiter(void 0, void 0, void 0, function* () {