registry / @ndnci/codabra / 0.1.8

@ndnci/codabra@0.1.8

Codabra CLI — generate and orchestrate applications from config files

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 7 file(s), 116 KB of source, external domains: docs.docker.com, get.docker.com, json-schema.org, registry.npmjs.org, turbo.build

Source & flagged code

3 flagged

dist/chunk-2BUCWWFO.jsView file

Lines 1-36javascript

1import {

2 JSONLoader,

3 buildDynamicModelSchema,

4 buildDynamicRouteSchema,

5 buildDynamicViewSchema,

6 findAppDir,

7 findConfigDir,

8 getOrmAdapter,

9 getProvider,

10 logError,

11 logInfo,

12 logSuccess,

13 logWarn

14} from "./chunk-PN6UGJ7Q.js";

16// src/commands/db.ts

17import { execSync } from "child_process";

18import * as fs2 from "fs";

High

Child Process

Package source references child process execution.

dist/chunk-2BUCWWFO.jsView on unpkg · L16

19import * as path2 from "path";

21// src/commands/generate.ts

22import * as fs from "fs";

23import * as path from "path";

24import { fileURLToPath } from "url";

25import { spawn } from "child_process";

26import ora from "ora";

27var bundledSchemasDir = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../schemas");

28function readProviderConfigs(cwd) {

29 const filePath = path.join(cwd, "codabra.json");

30 if (!fs.existsSync(filePath)) return [];

31 try {

32 const parsed = JSON.parse(fs.readFileSync(filePath, "utf-8"));

33 const providers = parsed.providers;

34 if (!Array.isArray(providers)) return [];

35 return providers.filter((p) => typeof p === "object" && p !== null).map((p) => ({

36 provider: typeof p.provider === "string" ? p.provider : "nextjs",

dist/index.jsView file

Lines 57-97javascript

57 logWarn("Could not start Docker services \u2014 make sure Docker is running.");

58 logWarn("Run 'make dev-up' manually if needed.");

59 }

60 }

61 }

62 logInfo("Generating files from config\u2026");

63 const ok

dist/chunk-PN6UGJ7Q.jsView file

Lines 1734-1774javascript

1734 "flex-end",

1735 "center",

1736 "space-between",

1737 "space-around",

1738 "space-evenly"

1739 ],

1740 default: "flex-start"

1741 },

1742

Source & flagged code

3 flagged · loading source

dist/chunk-2BUCWWFO.jsView file

16// src/commands/db.ts L17: import { execSync } from "child_process"; L18: import * as fs2 from "fs";

High

Child Process

Package source references child process execution.

dist/chunk-2BUCWWFO.jsView on unpkg · L16

dist/index.jsView file

77stdio: "inherit", L78: shell: true L79: });

High

Shell

Package source references shell execution.

dist/index.jsView on unpkg · L77

dist/chunk-PN6UGJ7Q.jsView file

1754// ../providers/dist/index.js L1755: import { execSync } from "child_process"; L1756: var NextjsProviderV16 = class { ... L1758: label = "Next.js 16 (App Router)"; L1759: initCommand = 'npx create-next-app@16.2.3 . --typescript --eslint --tailwind --app --src-dir --import-alias "@/*" --yes'; L1760: async generate(config, appDir, options) {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/chunk-PN6UGJ7Q.jsView on unpkg · L1754

Findings

3 High3 Medium5 Low

HighChild Processdist/chunk-2BUCWWFO.js

HighShelldist/index.js

HighRuntime Package Installdist/chunk-PN6UGJ7Q.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

3 flagged

dist/chunk-2BUCWWFO.jsView file

Lines 1-36javascript

1import {

2 JSONLoader,

3 buildDynamicModelSchema,

4 buildDynamicRouteSchema,

5 buildDynamicViewSchema,

6 findAppDir,

7 findConfigDir,

8 getOrmAdapter,

9 getProvider,

10 logError,

11 logInfo,

12 logSuccess,

13 logWarn

14} from "./chunk-PN6UGJ7Q.js";

16// src/commands/db.ts

17import { execSync } from "child_process";

18import * as fs2 from "fs";

High

Child Process

Package source references child process execution.

dist/chunk-2BUCWWFO.jsView on unpkg · L16

19import * as path2 from "path";

21// src/commands/generate.ts

22import * as fs from "fs";

23import * as path from "path";

24import { fileURLToPath } from "url";

25import { spawn } from "child_process";

26import ora from "ora";

27var bundledSchemasDir = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../schemas");

28function readProviderConfigs(cwd) {

29 const filePath = path.join(cwd, "codabra.json");

30 if (!fs.existsSync(filePath)) return [];

31 try {

32 const parsed = JSON.parse(fs.readFileSync(filePath, "utf-8"));

33 const providers = parsed.providers;

34 if (!Array.isArray(providers)) return [];

35 return providers.filter((p) => typeof p === "object" && p !== null).map((p) => ({

36 provider: typeof p.provider === "string" ? p.provider : "nextjs",

dist/index.jsView file

Lines 57-97javascript

57 logWarn("Could not start Docker services \u2014 make sure Docker is running.");

58 logWarn("Run 'make dev-up' manually if needed.");

59 }

60 }

61 }

62 logInfo("Generating files from config\u2026");

63 const ok

dist/chunk-PN6UGJ7Q.jsView file

Lines 1734-1774javascript

1734 "flex-end",

1735 "center",

1736 "space-between",

1737 "space-around",

1738 "space-evenly"

1739 ],

1740 default: "flex-start"

1741 },

1742