@nocobase/cli-v1@2.2.0

⚠ Under review

Static Scan Results

scanned 2mo ago · by rust-scanner

Static analysis flagged 12 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 45 file(s), 141 KB of source, external domains: 127.0.0.1, esm.sh, pkg.nocobase.com

Source & flagged code

6 flagged

src/commands/e2e.jsView file

11const { run, isPortReachable, checkDBDialect, storagePathJoin } = require('../util'); L12: const { execSync } = require('node:child_process'); L13: const axios = require('axios');

High

Child Process

Package source references child process execution.

src/commands/e2e.jsView on unpkg · L11

123try { L124: execSync( L125: `npx playwright codegen --load-storage=${authFile} ${process.env.APP_BASE_URL} --save-storage=${authFile}`, L126: commonConfig,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/commands/e2e.jsView on unpkg · L123

src/util.jsView file

Lines 1-31javascript

1/**

2 * This file is part of the NocoBase (R) project.

4 * Authors: NocoBase Team.

5 *

6 * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.

7 * For more information, please refer to: https://www.nocobase.com/agreement.

8 */

10const net = require('net');

11const chalk = require('chalk');

12const execa = require('execa');

13const fg = require('fast-glob');

High

Shell

Package source references shell execution.

src/util.jsView on unpkg · L11

14const { dirname, join, resolve, sep, isAbsolute } = require('path');

15const { readFile, writeFile } = require('fs').promises;

16const { existsSync, mkdirSync, cpSync, writeFileSync } = require('fs');

17const dotenv = require('dotenv');

18const fs = require('fs-extra');

19const os = require('os');

20const moment = require('moment-timezone');

21const { resolvePluginStoragePath } = require('@nocobase/utils/plugin-symlink');

23exports.isPackageValid = (pkg) => {

24 try {

25 require.resolve(pkg);

26 return true;

27 } catch (error) {

28 return false;

29 }

30};

Lines 227-267javascript

227 }

228 console.log(chalk.green('WAIT: ') + 'TypeScript compiling...');

229};

230

231exports.downloadPro = async () => {

232 // 此处不再判定，由pkgg命令处理

bin/index.jsView file

Lines 1-22javascript

1#!/usr/bin/env node

3const chalk = require('chalk');

4const { initEnv, genTsConfigPaths } = require('../src/util');

Medium

src/commands/dev.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @nocobase/cli-v1@2.1.17 matchedIdentity = npm:QG5vY29iYXNlL2NsaS12MQ:2.1.17 similarity = 0.933 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/commands/dev.jsView on unpkg

Source & flagged code

6 flagged · loading source

src/commands/e2e.jsView file

11const { run, isPortReachable, checkDBDialect, storagePathJoin } = require('../util'); L12: const { execSync } = require('node:child_process'); L13: const axios = require('axios');

High

Child Process

Package source references child process execution.

src/commands/e2e.jsView on unpkg · L11

123try { L124: execSync( L125: `npx playwright codegen --load-storage=${authFile} ${process.env.APP_BASE_URL} --save-storage=${authFile}`, L126: commonConfig,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/commands/e2e.jsView on unpkg · L123

src/util.jsView file

11const chalk = require('chalk'); L12: const execa = require('execa'); L13: const fg = require('fast-glob');

High

Shell

Package source references shell execution.

src/util.jsView on unpkg · L11

Findings

1 Critical3 High4 Medium4 Low

CriticalPrevious Version Dangerous Deltasrc/commands/dev.js

HighChild Processsrc/commands/e2e.js

HighShellsrc/util.js

HighRuntime Package Installsrc/commands/e2e.js

MediumDynamic Requirebin/index.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowEvalsrc/util.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @nocobase/cli-v1@2.2.0.

See all versions of @nocobase/cli-v1 for other recorded verdicts.

Review the evidence and your use of @nocobase/cli-v1@2.2.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-08-22 02:09:52.915Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.