registry / @peektravel/app-cli / 0.5.0

@peektravel/app-cli@0.5.0

CLI for scaffolding, developing, and publishing Peek apps

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 27 file(s), 111 KB of source, external domains: 127.0.0.1, app-registry-dev.example.com, app-registry.peeklabs.com, developers.cloudflare.com, myapp.fly.dev

Source & flagged code

3 flagged

dist/lib/pm.jsView file

Lines 1-21javascript

1import { spawnSync } from "node:child_process";

2import { existsSync } from "node:fs";

High

Child Process

Package source references child process execution.

dist/lib/pm.jsView on unpkg · L1

3import { join } from "node:path";

4import { CLIError } from

Source & flagged code

3 flagged · loading source

dist/lib/pm.jsView file

1import { spawnSync } from "node:child_process"; L2: import { existsSync } from "node:fs";

High

Child Process

Package source references child process execution.

dist/lib/pm.jsView on unpkg · L1

76return undefined; L77: return new CLIError(`${pm} ${major} is too old — the starter template needs ${pm} ${min} or newer.`, `Upgrade (e.g. "npm install -g ${pm}@latest" or "corepack use ${pm}@${min}"), `... L78: `then re-run. Or pick another package manager: "peek init --pm npm".`); ... L80: function installedMajor(pm) { L81: const result = spawnSync(pm, ["--version"], { encoding: "utf8" }); L82: if (result.status !== 0 || typeof result.stdout !== "string")

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/lib/pm.jsView on unpkg · L76

dist/lib/claude.jsView file

4import { join } from "node:path"; L5: import { execa } from "execa"; L6: // Optional integration: if the developer has the Claude Code CLI installed, we use it to

High

Shell

Package source references shell execution.

dist/lib/claude.jsView on unpkg · L4

Findings

3 High3 Medium4 Low

HighChild Processdist/lib/pm.js

HighShelldist/lib/claude.js

HighRuntime Package Installdist/lib/pm.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Lines 56-94javascript

56 if (isInstalled("pnpm"))

57 return "pnpm";

58 // 4. Fall back to however we were invoked, else npm.

59 return invoking ?? "npm";

60}

61export function installArgs(pm) {

62 return pm === "yarn" ? [] : ["install"];

63}

64// Parse the major version out of a `pm --version` string ("10.25.0" -> 10). Returns

65// undefined for anything unparseable so callers can treat "unknown" as "don't block".

66export function parseMajor(version) {

67 const major = Number.parseInt(version.trim().split(".")[0], 10);

68 return Number.isNaN(major) ? undefined : major;

69}

70// Pure version-policy check: given a package manager and the major version installed

71// (undefined if it couldn't be determined), return a CLIError to throw or undefined to

72// proceed. Split out from the spawn so it's deterministically testable.

73export function unsupportedVersionError(pm, major) {

74 const min = MIN_MAJOR[pm];

75 if (min === undefined || major === undefined || major >= min)

76 return undefined;

77 return new CLIError(`${pm} ${major} is too old — the starter template needs ${pm} ${min} or newer.`, `Upgrade (e.g. "npm install -g ${pm}@latest" or "corepack use ${pm}@${min}"), ` +

78 `then re-run. Or pick another package manager: "peek init --pm npm".`);

79}

80function installedMajor(pm) {

81 const result = spawnSync(pm, ["--version"], { encoding: "utf8" });

82 if (result.status !== 0 || typeof result.stdout !== "string")

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/lib/pm.jsView on unpkg · L76

83 return undefined;

84 return parseMajor(result.stdout);

85}

86// Throw a clear, actionable CLIError when the selected package manager is too old for

87// the template. A no-op for package managers without a minimum, or when the version

88// can't be read (don't block on an unknown).

89export function assertSupportedVersion(pm) {

90 const error = unsupportedVersionError(pm, installedMajor(pm));

91 if (error)

92 throw error;

93}

94//# sourceMappingURL=pm.js.map

dist/lib/claude.jsView file

Lines 1-24javascript

1import { readFile, writeFile } from "node:fs/promises";

2import { existsSync, readdirSync } from "node:fs";

3import { homedir } from "node:os";

4import { join } from "node:path";

5import { execa } from "execa";

6// Optional integration: if the developer has the Claude Code CLI installed, we use it to

High

Shell

Package source references shell execution.

dist/lib/claude.jsView on unpkg · L4

7// name the app and write its listing copy from a plain-language goal. Everything here

8// degrades to a no-op when `claude` is absent or misbehaves — init must never fail on it.

9// Candidate binaries to probe, in preference order. `claude` on PATH is the normal case;

10// the rest cover real installs where PATH is shadowed (e.g. an asdf/mise shim with no

11// version pinned) — the documented local install, then the newest VS Code extension binary.

12function claudeCandidates() {

13 const home = homedir();

14 const candidates = ["claude", join(home, ".claude", "local", "claude")];

15 const extDir = join(home, ".vscode", "extensions");

16 try {

17 const vscodeBins = readdirSync(extDir)

18 .filter((d) => d.startsWith("anthropic.claude-code-"))

19 // Lexical sort puts the highest version last for zero-padded semver-ish dirs; good

20 // enough to prefer the newest install without a real version parse.

21 .sort()

22 .reverse()

23 .map((d) => join(extDir, d, "resources", "native-binary", "claude"));

24 candidates.push(...vscodeBins);