registry / @mobrowser/cli / 2.11.0

@mobrowser/cli@2.11.0

MōBrowser CLI for all supported platforms

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNativeBindingsNetworkShell

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 6 file(s), 62.3 KB of source, external domains: github.com, teamdev.com

Source & flagged code

5 flagged

cmake.jsView file

Lines 1-41javascript

1/**

2 * @fileoverview CMake Installation & Resolution for MoBrowser

3 *

4 * This module handles automatic CMake installation and version management.

5 * It checks for system CMake, downloads and caches CMake if needed, and

6 * provides a unified interface for resolving the CMake executable path.

7 */

8import { spawnSync, execSync } from "node:child_process";

9import https from "node:https";

High

Child Process

Package source references child process execution.

cmake.jsView on unpkg · L7

10import http from "node:http";

11import fs from "node:fs";

12import path from "node:path";

13import { createWriteStream, createReadStream } from "node:fs";

14import { createGunzip } from "node:zlib";

15import { fileURLToPath } from "node:url";

17// Check and install dependencies if needed.

18const __dirname = path.dirname(fileURLToPath(import.meta.url));

19const depsInstalled = fs.existsSync(path.join(__dirname, "node_modules", "tar-stream"));

20if (!depsInstalled) {

21 console.log("Installing @mobrowser/cli dependencies...");

22 execSync("npm install --omit=optional --no-save", { cwd: __dirname, stdio: "inherit" });

23}

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

cmake.jsView on unpkg · L21

25// Dynamic imports to allow dependency installation first.

26const { extract: tarExtract } = await import("tar-stream");

27const AdmZipModule = await import("adm-zip");

28const AdmZip = AdmZipModule.default;

30const CMAKE_VERSION = "3.26.4";

31const CMAKE_MIN_VERSION = "3.21";

33const isWindows = process.platform === "win32";

35/**

36 * Finds the node_modules directory by walking up from the project root.

37 */

38function getCacheDir(projectRoot) {

39 // Find node_modules directory by looking up from the project root.

40 let currentDir = projectRoot;

41 let nodeModulesPath = null;

native.jsView file

Lines 157-197javascript

157 `-DCMAKE_MAKE_PROGRAM=${ninjaPath}`,

158 "-DCMAKE_BUILD_TYPE=Release",

159 ];

160

161 const cmakeBuildArgs = [

162 "--build", `${buildDir}`,

163 "--parallel",

164

build.jsView file

Lines 34-74javascript

34 * │ └── index.ts # Main process entry point

35 * └── out/

36 * └── main/ # Output: main bundle and externals manifest

37 * ├── index.js

38 * └── .mobrowser-externals.json

39 * ```

40 */

utils.jsView file

Lines 1-22javascript

1import path from 'node:path';

2import { existsSync, readFileSync } from 'node:fs';

3import { execSync, execFileSync } from 'node:child_process';

4import readline from 'node:readline';

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

utils.jsView on unpkg · L2

Source & flagged code

5 flagged · loading source

cmake.jsView file

7*/ L8: import { spawnSync, execSync } from "node:child_process"; L9: import https from "node:https";

High

Child Process

Package source references child process execution.

cmake.jsView on unpkg · L7

21console.log("Installing @mobrowser/cli dependencies..."); L22: execSync("npm install --omit=optional --no-save", { cwd: __dirname, stdio: "inherit" }); L23: }

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

cmake.jsView on unpkg · L21

native.jsView file

177L178: // Write a temporary .cmd to avoid cmd.exe quoting issues with paths containing spaces. L179: fs.mkdirSync(buildDir, { recursive: true });

High

Shell

Package source references shell execution.

native.jsView on unpkg · L177

build.jsView file

54const projectDir = process.cwd(); L55: const projectRequire = createRequire(path.join(projectDir, 'package.json')); L56: const vitePackagePath = projectRequire.resolve('vite/package.json');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

build.jsView on unpkg · L54

utils.jsView file

2import { existsSync, readFileSync } from 'node:fs'; L3: import { execSync, execFileSync } from 'node:child_process'; L4: import readline from 'node:readline'; ... L38: try { L39: config = JSON.parse(readFileSync(configPath, 'utf-8')); L40: } catch (err) { ... L99: * L100: * @see https://teamdev.[redacted]/ L101: * ... L106: export async function checkAppArmor(projectDir, args) { L107: if (process.platform !== 'linux' || !args.includes('dev')) { L108: return;

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

utils.jsView on unpkg · L2

Findings

4 High4 Medium2 Low

HighChild Processcmake.js

HighShellnative.js

HighSandbox Evasion Gated Capabilityutils.js

HighRuntime Package Installcmake.js

MediumDynamic Requirebuild.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowFilesystem

LowUrl Strings

Source & flagged code

5 flagged

cmake.jsView file

Lines 1-41javascript

1/**

2 * @fileoverview CMake Installation & Resolution for MoBrowser

3 *

4 * This module handles automatic CMake installation and version management.

5 * It checks for system CMake, downloads and caches CMake if needed, and

6 * provides a unified interface for resolving the CMake executable path.

7 */

8import { spawnSync, execSync } from "node:child_process";

9import https from "node:https";

High

Child Process

Package source references child process execution.

cmake.jsView on unpkg · L7

10import http from "node:http";

11import fs from "node:fs";

12import path from "node:path";

13import { createWriteStream, createReadStream } from "node:fs";

14import { createGunzip } from "node:zlib";

15import { fileURLToPath } from "node:url";

17// Check and install dependencies if needed.

18const __dirname = path.dirname(fileURLToPath(import.meta.url));

19const depsInstalled = fs.existsSync(path.join(__dirname, "node_modules", "tar-stream"));

20if (!depsInstalled) {

21 console.log("Installing @mobrowser/cli dependencies...");

22 execSync("npm install --omit=optional --no-save", { cwd: __dirname, stdio: "inherit" });

23}

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

cmake.jsView on unpkg · L21

25// Dynamic imports to allow dependency installation first.

26const { extract: tarExtract } = await import("tar-stream");

27const AdmZipModule = await import("adm-zip");

28const AdmZip = AdmZipModule.default;

30const CMAKE_VERSION = "3.26.4";

31const CMAKE_MIN_VERSION = "3.21";

33const isWindows = process.platform === "win32";

35/**

36 * Finds the node_modules directory by walking up from the project root.

37 */

38function getCacheDir(projectRoot) {

39 // Find node_modules directory by looking up from the project root.

40 let currentDir = projectRoot;

41 let nodeModulesPath = null;

native.jsView file

Lines 157-197javascript

157 `-DCMAKE_MAKE_PROGRAM=${ninjaPath}`,

158 "-DCMAKE_BUILD_TYPE=Release",

159 ];

160

161 const cmakeBuildArgs = [

162 "--build", `${buildDir}`,

163 "--parallel",

164

build.jsView file

Lines 34-74javascript

34 * │ └── index.ts # Main process entry point

35 * └── out/

36 * └── main/ # Output: main bundle and externals manifest

37 * ├── index.js

38 * └── .mobrowser-externals.json

39 * ```

40 */

utils.jsView file

Lines 1-22javascript

1import path from 'node:path';

2import { existsSync, readFileSync } from 'node:fs';

3import { execSync, execFileSync } from 'node:child_process';

4import readline from 'node:readline';

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

utils.jsView on unpkg · L2