registry / @ndnci/translify / 0.0.5

@ndnci/translify@0.0.5

Intelligent i18n CLI — extract, sync, detect, and translate your app

Static Scan Results

scanned 23h ago · by rust-scanner

Static analysis flagged 8 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 319 KB of source, external domains: ndnci.github.io, registry.npmjs.org

Source & flagged code

1 flagged

dist/index.jsView file

Lines 78-118javascript

78 enabled: z.boolean().default(false),

79 /** AI provider to use for translation */

80 provider: z.enum(["openai"]).default("openai"),

81 /** OpenAI API key — required when provider = "openai" */

82 openai_api_key: z.string().optional(),

83 /**

84 * OpenAI model to use.

85 *

86 * Recommended: "gpt-4.1-mini" (fast + affordable)

87 * Higher quality: "gpt-4.1"

88 */

89 model: z.string().default("gpt-4.1-mini"),

90 /** Temperature (0 = deterministic, best for translations) */

91 temperature: z.number().min(0).max(2).default(0),

92 /** Maximum number of keys to translate per API call */

93 batch_size: z.number().int().min(1).max(500).default(50)

94}).superRefine((data, ctx) => {

95 if (data.enabled && data.provider === "openai" && !data.openai_api_key) {

96 ctx.addIssue({

97 code: z.ZodIssueCode.custom,

98 path: ["openai_api_key"],

99 message: 'openai_api_key is required when provider is "openai" and ai_translation is enabled.\nSet it via process.env.OPENAI_API_KEY or directly in your config.'

100 });

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L98

101 }

102});

103var TranslifyConfigSchema = z.object({

104 source: SourceSchema.default({}),

105 translations: TranslationsSchema.default({}),

106 extraction: ExtractionSchema.default({}),

107 detection: DetectionSchema.default({}),

108 ai_translation: AITranslationSchema.default({})

109});

110function relativePath(absolutePath, cwd) {

111 if (absolutePath.startsWith(cwd)) {

112 return absolutePath.slice(cwd.length).replace(/^\//, "");

113 }

114 return absolutePath;

115}

116

117// src/ui/colors.ts

118import chalk from "chalk";

Source & flagged code

1 flagged · loading source

dist/index.jsView file

98path: ["openai_api_key"], L99: message: 'openai_api_key is required when provider is "openai" and ai_translation is enabled.\nSet it via process.env.OPENAI_API_KEY or directly in your config.' L100: }); ... L150: if (options.verbose) { L151: process.stderr.write(`${c.dim("debug")} ${c.dim(message)} L152: `); ... L239: ).action(async (opts) => { L240: const cwd = program.opts().cwd ?? process.cwd(); L241: await runInit({ cwd, ...opts.force !== void 0 && { force: opts.force } }, logger); ... L456: const content = readFileSync(resolved.path, "utf8"); L457: return JSON.parse(content); L458: } catch (cause) {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L98

Findings

1 High3 Medium4 Low

HighSandbox Evasion Gated Capabilitydist/index.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

1 flagged

dist/index.jsView file

Lines 78-118javascript

78 enabled: z.boolean().default(false),

79 /** AI provider to use for translation */

80 provider: z.enum(["openai"]).default("openai"),

81 /** OpenAI API key — required when provider = "openai" */

82 openai_api_key: z.string().optional(),

83 /**

84 * OpenAI model to use.

85 *

86 * Recommended: "gpt-4.1-mini" (fast + affordable)

87 * Higher quality: "gpt-4.1"

88 */

89 model: z.string().default("gpt-4.1-mini"),

90 /** Temperature (0 = deterministic, best for translations) */

91 temperature: z.number().min(0).max(2).default(0),

92 /** Maximum number of keys to translate per API call */

93 batch_size: z.number().int().min(1).max(500).default(50)

94}).superRefine((data, ctx) => {

95 if (data.enabled && data.provider === "openai" && !data.openai_api_key) {

96 ctx.addIssue({

97 code: z.ZodIssueCode.custom,

98 path: ["openai_api_key"],

99 message: 'openai_api_key is required when provider is "openai" and ai_translation is enabled.\nSet it via process.env.OPENAI_API_KEY or directly in your config.'

100 });

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L98

101 }

102});

103var TranslifyConfigSchema = z.object({

104 source: SourceSchema.default({}),

105 translations: TranslationsSchema.default({}),

106 extraction: ExtractionSchema.default({}),

107 detection: DetectionSchema.default({}),

108 ai_translation: AITranslationSchema.default({})

109});

110function relativePath(absolutePath, cwd) {

111 if (absolutePath.startsWith(cwd)) {

112 return absolutePath.slice(cwd.length).replace(/^\//, "");

113 }

114 return absolutePath;

115}

116

117// src/ui/colors.ts

118import chalk from "chalk";