registry / @oondemand/oon-core-front / 0.3.12

@oondemand/oon-core-front@0.3.12

Core de frontend para Centrais Oon: shell, providers, roteamento por metadata, SDK REST do /core/*, RBAC e componentes Core* (Coleção, Documento, Esteira, Multi-moedas, Assistente, Dashboard).

Static Scan Results

scanned 4h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chainNo supply-chain packaging signals triggered.

Manifest

NoLicense

scanned 2 file(s), 167 KB of source

Source & flagged code

3 flagged

bin/cli.jsView file

Lines 1-38javascript

1#!/usr/bin/env node

3/**

4 * CLI do @oondemand/oon-core-front (Fase 3 — Seção 4.5).

5 *

6 * oonCore-front dev Sobe o Vite em modo dev.

7 * oonCore-front build Build de produção (vite build).

8 * oonCore-front preview Serve o build (vite preview).

9 * oonCore-front sync:metadata Baixa /core/metadata do back e cacheia em

10 * src/.oon/metadata.json para tipos/dev offline.

11 *

12 * O Core não impõe Vite ao consumidor: ele apenas encaminha para o binário

13 * local do projeto. `sync:metadata` lê a URL do back de OON_API_URL /

14 * VITE_API_URL no .env do projeto.

15 */

17import path from "node:path";

18import fs from "node:fs";

19import { spawnSync } from "node:child_process";

High

Child Process

Package source references child process execution.

bin/cli.jsView on unpkg · L18

21const cmd = process.argv[2];

22const cwd = process.cwd();

24function runVite(args) {

25 const bin = path.join(cwd, "node_modules", ".bin", process.platform === "win32" ? "vite.cmd" : "vite");

26 const exec = fs.existsSync(bin) ? bin : "vite";

27 const r = spawnSync(exec, args, { stdio: "inherit", cwd });

28 if (r.error) {

29 console.error("Falha ao executar vite:", r.error.message);

30 console.error("Instale o vite no projeto da Central: npm i -D vite");

31 process.exit(1);

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/cli.jsView on unpkg · L18

32 }

33 process.exit(r.status || 0);

34}

36function readEnv(name) {

37 if (process.env[name]) return process.env[name];

38 const envPath = path.join(cwd, ".env");

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

bin/cli.jsView on unpkg · L18

Source & flagged code

3 flagged · loading source

bin/cli.jsView file

18import fs from "node:fs"; L19: import { spawnSync } from "node:child_process"; L20:

High

Child Process

Package source references child process execution.

bin/cli.jsView on unpkg · L18

18Manifest entrypoint (manifest.bin) carries capability families absent from dist/build output: environment+network, sensitive-file+network, execution+network L18: import fs from "node:fs"; L19: import { spawnSync } from "node:child_process"; L20: L21: const cmd = process.argv[2]; L22: const cwd = process.cwd(); L23: L24: function runVite(args) { L25: const bin = path.join(cwd, "node_modules", ".bin", process.platform === "win32" ? "vite.cmd" : "vite"); L26: const exec = fs.existsSync(bin) ? bin : "vite"; ... L36: function readEnv(name) { L37: if (process.env[name]) return process.env[name]; L38: const envPath = path.join(cwd, ".env");

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

bin/cli.jsView on unpkg · L18

18import fs from "node:fs"; L19: import { spawnSync } from "node:child_process"; L20: ... L29: console.error("Falha ao executar vite:", r.error.message); L30: console.error("Instale o vite no projeto da Central: npm i -D vite"); L31: process.exit(1);

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/cli.jsView on unpkg · L18

Findings

4 High3 Medium4 Low

HighChild Processbin/cli.js

HighShell

HighEntrypoint Build Divergencebin/cli.js

HighRuntime Package Installbin/cli.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowNo License

Source & flagged code

3 flagged

bin/cli.jsView file

Lines 1-38javascript

1#!/usr/bin/env node

3/**

4 * CLI do @oondemand/oon-core-front (Fase 3 — Seção 4.5).

5 *

6 * oonCore-front dev Sobe o Vite em modo dev.

7 * oonCore-front build Build de produção (vite build).

8 * oonCore-front preview Serve o build (vite preview).

9 * oonCore-front sync:metadata Baixa /core/metadata do back e cacheia em

10 * src/.oon/metadata.json para tipos/dev offline.

11 *

12 * O Core não impõe Vite ao consumidor: ele apenas encaminha para o binário

13 * local do projeto. `sync:metadata` lê a URL do back de OON_API_URL /

14 * VITE_API_URL no .env do projeto.

15 */

17import path from "node:path";

18import fs from "node:fs";

19import { spawnSync } from "node:child_process";

High

Child Process

Package source references child process execution.

bin/cli.jsView on unpkg · L18

21const cmd = process.argv[2];

22const cwd = process.cwd();

24function runVite(args) {

25 const bin = path.join(cwd, "node_modules", ".bin", process.platform === "win32" ? "vite.cmd" : "vite");

26 const exec = fs.existsSync(bin) ? bin : "vite";

27 const r = spawnSync(exec, args, { stdio: "inherit", cwd });

28 if (r.error) {

29 console.error("Falha ao executar vite:", r.error.message);

30 console.error("Instale o vite no projeto da Central: npm i -D vite");

31 process.exit(1);

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/cli.jsView on unpkg · L18

32 }

33 process.exit(r.status || 0);

34}

36function readEnv(name) {

37 if (process.env[name]) return process.env[name];

38 const envPath = path.join(cwd, ".env");

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

bin/cli.jsView on unpkg · L18