registry / @ndnci/translify / 0.0.6

@ndnci/translify@0.0.6

Intelligent i18n CLI — extract, sync, detect, and translate your app

Static Scan Results

scanned 8h ago · by rust-scanner

Static analysis flagged 9 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 320 KB of source, external domains: ndnci.github.io, registry.npmjs.org

Source & flagged code

2 flagged

dist/index.jsView file

Lines 78-118javascript

78 enabled: z.boolean().default(false),

79 /** AI provider to use for translation */

80 provider: z.enum(["openai"]).default("openai"),

81 /** OpenAI API key — required when provider = "openai" */

82 openai_api_key: z.string().optional(),

83 /**

84 * OpenAI model to use.

85 *

86 * Recommended: "gpt-4.1-mini" (fast + affordable)

87 * Higher quality: "gpt-4.1"

88 */

89 model: z.string().default("gpt-4.1-mini"),

90 /** Temperature (0 = deterministic, best for translations) */

91 temperature: z.number().min(0).max(2).default(0),

92 /** Maximum number of keys to translate per API call */

93 batch_size: z.number().int().min(1).max(500).default(50)

94}).superRefine((data, ctx) => {

95 if (data.enabled && data.provider === "openai" && !data.openai_api_key) {

96 ctx.addIssue({

97 code: z.ZodIssueCode.custom,

98 path: ["openai_api_key"],

99 message: 'openai_api_key is required when provider is "openai" and ai_translation is enabled.\nSet it via process.env.OPENAI_API_KEY or directly in your config.'

100 });

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L98

101 }

102});

103var TranslifyConfigSchema = z.object({

104 source: SourceSchema.default({}),

105 translations: TranslationsSchema.default({}),

106 extraction: ExtractionSchema.default({}),

107 detection: DetectionSchema.default({}),

108 ai_translation: AITranslationSchema.default({})

109});

110function relativePath(absolutePath, cwd) {

111 if (absolutePath.startsWith(cwd)) {

112 return absolutePath.slice(cwd.length).replace(/^\//, "");

113 }

114 return absolutePath;

115}

116

117// src/ui/colors.ts

118import chalk from "chalk";

•matchType = previous_version_dangerous_delta matchedPackage = @ndnci/translify@0.0.5 matchedIdentity = npm:QG5kbmNpL3RyYW5zbGlmeQ:0.0.5 similarity = 0.667 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg

Source & flagged code

2 flagged · loading source

dist/index.jsView file

98path: ["openai_api_key"], L99: message: 'openai_api_key is required when provider is "openai" and ai_translation is enabled.\nSet it via process.env.OPENAI_API_KEY or directly in your config.' L100: }); ... L150: if (options.verbose) { L151: process.stderr.write(`${c.dim("debug")} ${c.dim(message)} L152: `); ... L241: ).action(async (opts) => { L242: const cwd = program.opts().cwd ?? process.cwd(); L243: await runInit({ cwd, ...opts.force !== void 0 && { force: opts.force } }, logger); ... L467: const content = readFileSync(resolved.path, "utf8"); L468: return JSON.parse(content); L469: } catch (cause) {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L98

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg

Findings

2 High3 Medium4 Low

HighSandbox Evasion Gated Capabilitydist/index.js

HighPrevious Version Dangerous Deltadist/index.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

dist/index.jsView file

Lines 78-118javascript

78 enabled: z.boolean().default(false),

79 /** AI provider to use for translation */

80 provider: z.enum(["openai"]).default("openai"),

81 /** OpenAI API key — required when provider = "openai" */

82 openai_api_key: z.string().optional(),

83 /**

84 * OpenAI model to use.

85 *

86 * Recommended: "gpt-4.1-mini" (fast + affordable)

87 * Higher quality: "gpt-4.1"

88 */

89 model: z.string().default("gpt-4.1-mini"),

90 /** Temperature (0 = deterministic, best for translations) */

91 temperature: z.number().min(0).max(2).default(0),

92 /** Maximum number of keys to translate per API call */

93 batch_size: z.number().int().min(1).max(500).default(50)

94}).superRefine((data, ctx) => {

95 if (data.enabled && data.provider === "openai" && !data.openai_api_key) {

96 ctx.addIssue({

97 code: z.ZodIssueCode.custom,

98 path: ["openai_api_key"],

99 message: 'openai_api_key is required when provider is "openai" and ai_translation is enabled.\nSet it via process.env.OPENAI_API_KEY or directly in your config.'

100 });

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L98

101 }

102});

103var TranslifyConfigSchema = z.object({

104 source: SourceSchema.default({}),

105 translations: TranslationsSchema.default({}),

106 extraction: ExtractionSchema.default({}),

107 detection: DetectionSchema.default({}),

108 ai_translation: AITranslationSchema.default({})

109});

110function relativePath(absolutePath, cwd) {

111 if (absolutePath.startsWith(cwd)) {

112 return absolutePath.slice(cwd.length).replace(/^\//, "");

113 }

114 return absolutePath;

115}

116

117// src/ui/colors.ts

118import chalk from "chalk";

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg