registry / @pc-nexus/cli / 0.5.0

@pc-nexus/cli@0.5.0

A command line interface for PC Nexus platform

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 251 KB of source, external domains: developer-rc.pingcode.com, fetch.localhost, gateway.localhost

Source & flagged code

5 flagged

index.jsView file

Lines 3284-3324javascript

3284 return this.lintResult;

3285 }

3286};

3287var typescriptLinter = new TypeScriptLinter();

3288

3289// src/features/lint/linters/eslint/eslint.linter.ts

3290import fs16 from "fs-extra"

Source & flagged code

5 flagged · loading source

index.jsView file

3304try { L3305: const { execSync } = await import("child_process"); L3306: const eslintCommand = `npx eslint src/**/*.ts --format json`;

High

Child Process

Package source references child process execution.

index.jsView on unpkg · L3304

6559const bootstrapPath = await this.createShadowApp(context, config); L6560: const execArgv = [ L6561: "--import",

High

Shell

Package source references shell execution.

index.jsView on unpkg · L6559

6569if (config.debug) { L6570: execArgv.push("--inspect"); L6571: } ... L6576: env: { L6577: ...process.env, L6578: NEXUS_RUNTIME_PORT: config.port.toString(), L6579: NEXUS_GATEWAY_ENDPOINT: `http://gateway.localhost:${config.tunnelInboundPort}`, L6580: NEXUS_FETCH_ENDPOINT: `http://fetch.localhost:${config.tunnelInboundPort}`,

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

index.jsView on unpkg · L6569

3304try { L3305: const { execSync } = await import("child_process"); L3306: const eslintCommand = `npx eslint src/**/*.ts --format json`; L3307: const output = execSync(eslintCommand, {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

index.jsView on unpkg · L3304

bin/nexus.jsView file

6const cwd = process.cwd(); L7: const localRequire = createRequire(path.join(cwd, "package.json")); L8: try {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/nexus.jsView on unpkg · L6

Findings

4 High4 Medium3 Low

HighChild Processindex.js

HighShellindex.js

HighSame File Env Network Executionindex.js

HighRuntime Package Installindex.js

MediumDynamic Requirebin/nexus.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Lines 6539-6589javascript

6539 await fs23.writeFile(packageJsonPath, `{"type": "module"}`);

6540 const runtimeScriptPath = await this.developRemoteService.downloadRuntimeScript();

6541 await fs23.copy(runtimeScriptPath, path25.join(shadowAppDir, "runtime.js"), { overwrite: true });

6542 const indexJsPath = path25.join(shadowAppDir, "index.js");

6543 const faasJsRuntimeUrl = pathToFileURL(require2.resolve("faas-js-runtime")).href;

6544 await fs23.writeFile(

6545 indexJsPath,

6546 `

6547 import runtime from "${faasJsRuntimeUrl}";

6548 import { handle } from "./runtime.js";

6549 runtime.start((context,body)=>{

6550 console.log("[_NEXUS_SERVER_LOG_MESSAGE_]",JSON.stringify(body));

6551 return handle(context,body)

6552 }, { port: ${config.port} });

6553 `

6554 );

6555 return indexJsPath;

6556 }

6557 async start(context, config) {

6558 const workspaceDir = context.paths?.workspaceDir;

6559 const bootstrapPath = await this.createShadowApp(context, config);

6560 const execArgv = [

6561 "--import",

High

Shell

Package source references shell execution.

index.jsView on unpkg · L6559

6562 pathToFileURL(require2.resolve("tsx")).href,

6563 "--enable-source-maps",

6564 "--trace-warnings",

6565 "--watch",

6566 "--watch-path",

6567 path25.join(context.paths.workspaceDir, "src")

6568 ];

6569 if (config.debug) {

6570 execArgv.push("--inspect");

6571 }

6572 const childProcess = fork(bootstrapPath, [], {

6573 cwd: workspaceDir,

6574 execArgv,

6575 silent: true,

6576 env: {

6577 ...process.env,

6578 NEXUS_RUNTIME_PORT: config.port.toString(),

6579 NEXUS_GATEWAY_ENDPOINT: `http://gateway.localhost:${config.tunnelInboundPort}`,

6580 NEXUS_FETCH_ENDPOINT: `http://fetch.localhost:${config.tunnelInboundPort}`,

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

index.jsView on unpkg · L6569

6581 NEXUS_COMMAND_OPTIONS_VERBOSE: config.verbose,

6582 NEXUS_RUNTIME_APP_CODE_DIR: path25.join(context.paths.workspaceDir, "src"),

6583 NEXUS_RUNTIME_LOG_DISABLED: "true",

6584 NEXUS_RUNTIME_IS_DEV_MODE: "true"

6585 }

6586 });

6587 const rl = readline.createInterface({

6588 input: childProcess.stdout,

6589 terminal: false

bin/nexus.jsView file

Lines 1-26javascript

1#!/usr/bin/env node

2import { createRequire } from "module";

3import * as path from "path";

4import { fileURLToPath, pathToFileURL } from "url";

5async function bootstrap() {

6 const cwd = process.cwd();

7 const localRequire = createRequire(path.join(cwd, "package.json"));

8 try {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/nexus.jsView on unpkg · L6

9 const localCliEntry = localRequire.resolve("@pc-nexus/cli");

10 if (localCliEntry) {

11 const currentFilePath = fileURLToPath(import.meta.url);

12 if (path.relative(path.dirname(currentFilePath), path.dirname(localCliEntry)) !== "") {

13 const localFileUrl = pathToFileURL(localCliEntry).href;

14 await import(localFileUrl);

15 return;

16 }

17 }

18 } catch (err) {

19 if (err?.code !== "MODULE_NOT_FOUND") {

20 process.exit(1);

21 }

22 }

23 await import("../index.js");

24}

25bootstrap().catch((err) => {

26 console.error(err);