registry / @nocobase/cli / 2.1.17

@nocobase/cli@2.1.17

NocoBase Command Line Tool

Static Scan Results

scanned 20d ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 11 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 194 file(s), 1.30 MB of source, external domains: 127.0.0.1, ant.design, cdn.example.com, demo.example.com, esm.sh, github.com, opencode.ai, pkg.nocobase.com, registry.npmjs.org, registry.npmmirror.com

Source & flagged code

4 flagged

bin/run.jsView file

Lines 1-33javascript

1#!/usr/bin/env node

3import { spawnSync } from 'node:child_process';

4import fs from 'node:fs';

5import { createRequire } from 'node:module';

6import path from 'node:path';

7import pc from 'picocolors';

8import { fileURLToPath, pathToFileURL } from 'node:url';

9import { formatUnsupportedNodeVersionMessage, isSupportedNodeVersion } from './node-version.js';

10import { normalizeNodeOptions, normalizeSessionEnv } from './session-env.js';

11import { ensureWindowsAdministrator } from './windows-admin.js';

13const __dirname = path.dirname(fileURLToPath(import.meta.url));

14const requireFromCli = createRequire(import.meta.url);

15const root = path.resolve(__dirname, '..');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/run.jsView on unpkg · L13

16const realRoot = fs.realpathSync(root);

17const isSourcePackage = realRoot.split(path.sep).join('/').endsWith('/packages/core/cli');

18let isDev = isSourcePackage;

19if (process.env.NB_CLI_USE_DIST === '1') {

20 isDev = false;

21}

23if (!isSupportedNodeVersion()) {

24 console.error(pc.red(formatUnsupportedNodeVersionMessage(process.version)));

25 process.exit(1);

26}

28normalizeSessionEnv();

29normalizeNodeOptions();

31ensureWindowsAdministrator();

33/**

dist/lib/runtime-generator.jsView file

Lines 1-26javascript

1/**

2 * This file is part of the NocoBase (R) project.

4 * Authors: NocoBase Team.

5 *

6 * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.

7 * For more information, please refer to: https://www.nocobase.com/agreement.

8 */

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/lib/runtime-generator.jsView on unpkg · L6

dist/lib/session-integration.jsView file

Lines 1-26javascript

1/**

2 * This file is part of the NocoBase (R) project.

4 * Authors: NocoBase Team.

5 *

6 * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.

7 * For more information, please refer to: https://www.nocobase.com/agreement.

8 */

9/**

10 * This file is part of the NocoBase (R) project.

bin/run.cmdView file

•path = bin/run.cmd kind = build_helper sizeBytes = 31 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/run.cmdView on unpkg

Source & flagged code

4 flagged · loading source

bin/run.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code