registry / @pc-nexus/cli / 0.5.0

@pc-nexus/cli@0.5.0

A command line interface for PC Nexus platform

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 251 KB of source, external domains: developer-rc.pingcode.com, fetch.localhost, gateway.localhost

Source & flagged code

5 flagged

index.jsView file

Lines 3284-3324javascript

3284 return this.lintResult;

3285 }

3286};

3287var typescriptLinter = new TypeScriptLinter();

3288

3289// src/features/lint/linters/eslint/eslint.linter.ts

3290import fs16 from "fs-extra";

3291import path16 from "path";

3292var CONFIG_FILES = ["eslint.config.js", "eslint.config.mjs", "eslint.config.cjs", ".eslintrc.json", ".eslintrc.js", ".eslintrc.cjs"];

3293var ESLintLinter = class extends BaseLinter {

3294 id = "eslint-lint";

3295 hasConfig(workingDir) {

3296 return CONFIG_FILES.some((configFile) => fs16.existsSync(path16.resolve(workingDir, configFile)));

3297 }

3298 async check(ctx) {

3299 this.bootstrap(ctx);

3300 const workingDir = ctx.workspaceDir;

3301 if (!this.hasConfig(workingDir)) {

3302 return this.lintResult;

3303 }

3304 try {

3305 const { execSync } = await import("child_process");

3306 const eslintCommand = `npx eslint src/**/*.ts --format json`;

High

Child Process

Package source references child process execution.

index.jsView on unpkg · L3304

3307 const output = execSync(eslintCommand, {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

index.jsView on unpkg · L3304

3308 cwd: workingDir,

3309 stdio: "pipe",

3310 encoding: "utf8"

3311 });

3312 this.parseESLintResults(output);

3313 } catch (error) {

3314 const execError = error;

3315 if (execError.stdout) {

3316 this.parseESLintResults(execError.stdout.toString());

3317 }

3318 }

3319 return this.lintResult;

3320 }

3321 async fix(ctx) {

3322 this.bootstrap(ctx);

3323 const workingDir = ctx.workspaceDir;

3324 if (!this.hasConfig(workingDir)) {

Lines 6539-6589javascript

6539 await fs23.writeFile(packageJsonPath, `{"type": "module"}`);

6540 const runtimeScriptPath = await this.developRemoteService.downloadRuntimeScript();

6541 await fs23.copy(runtimeScriptPath, path25.join(shadowAppDir, "runtime.js"), { overwrite: true });

6542 const indexJsPath = path25.

bin/nexus.jsView file

Lines 1-26javascript

1#!/usr/bin/env node

2import { createRequire } from "module";

3import * as path from "path";

4import { fileURLToPath, pathToFileURL } from "url";

5async function bootstrap() {

6 const

Source & flagged code

5 flagged · loading source

index.jsView file

3304try { L3305: const { execSync } = await import("child_process"); L3306: const eslintCommand = `npx eslint src/**/*.ts --format json`;

High

Child Process

Package source references child process execution.

index.jsView on unpkg · L3304

6559const bootstrapPath = await this.createShadowApp(context, config); L6560: const execArgv = [ L6561: "--import",

High

Shell

Package source references shell execution.

index.jsView on unpkg · L6559

6569if (config.debug) { L6570: execArgv.push("--inspect"); L6571: } ... L6576: env: { L6577: ...process.env, L6578: NEXUS_RUNTIME_PORT: config.port.toString(), L6579: NEXUS_GATEWAY_ENDPOINT: `http://gateway.localhost:${config.tunnelInboundPort}`, L6580: NEXUS_FETCH_ENDPOINT: `http://fetch.localhost:${config.tunnelInboundPort}`,

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

index.jsView on unpkg · L6569

3304try { L3305: const { execSync } = await import("child_process"); L3306: const eslintCommand = `npx eslint src/**/*.ts --format json`; L3307: const output = execSync(eslintCommand, {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

index.jsView on unpkg · L3304

bin/nexus.jsView file

6const cwd = process.cwd(); L7: const localRequire = createRequire(path.join(cwd, "package.json")); L8: try {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/nexus.jsView on unpkg · L6

Findings

4 High4 Medium3 Low

HighChild Processindex.js

HighShellindex.js

HighSame File Env Network Executionindex.js

HighRuntime Package Installindex.js

MediumDynamic Requirebin/nexus.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

5 flagged

index.jsView file

Lines 3284-3324javascript

3284 return this.lintResult;

3285 }

3286};

3287var typescriptLinter = new TypeScriptLinter();

3288

3289// src/features/lint/linters/eslint/eslint.linter.ts

3290import fs16 from "fs-extra";

3291import path16 from "path";

3292var CONFIG_FILES = ["eslint.config.js", "eslint.config.mjs", "eslint.config.cjs", ".eslintrc.json", ".eslintrc.js", ".eslintrc.cjs"];

3293var ESLintLinter = class extends BaseLinter {

3294 id = "eslint-lint";

3295 hasConfig(workingDir) {

3296 return CONFIG_FILES.some((configFile) => fs16.existsSync(path16.resolve(workingDir, configFile)));

3297 }

3298 async check(ctx) {

3299 this.bootstrap(ctx);

3300 const workingDir = ctx.workspaceDir;

3301 if (!this.hasConfig(workingDir)) {

3302 return this.lintResult;

3303 }

3304 try {

3305 const { execSync } = await import("child_process");

3306 const eslintCommand = `npx eslint src/**/*.ts --format json`;

High

Child Process

Package source references child process execution.

index.jsView on unpkg · L3304

3307 const output = execSync(eslintCommand, {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

index.jsView on unpkg · L3304

3308 cwd: workingDir,

3309 stdio: "pipe",

3310 encoding: "utf8"

3311 });

3312 this.parseESLintResults(output);

3313 } catch (error) {

3314 const execError = error;

3315 if (execError.stdout) {

3316 this.parseESLintResults(execError.stdout.toString());

3317 }

3318 }

3319 return this.lintResult;

3320 }

3321 async fix(ctx) {

3322 this.bootstrap(ctx);

3323 const workingDir = ctx.workspaceDir;

3324 if (!this.hasConfig(workingDir)) {

Lines 6539-6589javascript

6539 await fs23.writeFile(packageJsonPath, `{"type": "module"}`);

6540 const runtimeScriptPath = await this.developRemoteService.downloadRuntimeScript();

6541 await fs23.copy(runtimeScriptPath, path25.join(shadowAppDir, "runtime.js"), { overwrite: true });

6542 const indexJsPath = path25.

bin/nexus.jsView file

Lines 1-26javascript

1#!/usr/bin/env node

2import { createRequire } from "module";

3import * as path from "path";

4import { fileURLToPath, pathToFileURL } from "url";

5async function bootstrap() {

6 const