registry / @polkadot-community-foundation/polkadot-app-deploy / 0.12.1

@polkadot-community-foundation/polkadot-app-deploy@0.12.1

> [!WARNING] > The following is a prototype, reference implementation, and proof-of-concept. This open source code is provided for research, experimentation, and developer education only. This code has not been audited, is actively experimental, and may c

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 15 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsProtestwareUrlStrings

Manifest

CopyleftLicense

scanned 91 file(s), 536 KB of source, external domains: bullet.sik.rocks, docs.ipfs.tech, faucet.polkadot.io, github.com, nodejs.org, paseo-bulletin-next-ipfs.polkadot.io, registry.npmjs.org, stats.uptimerobot.com, summit-ipfs.polkadot.io

Source & flagged code

5 flagged

package.jsonView file

Lines 31-71json

31 "./manifest-roundtrip": {

32 "types": "./dist/manifest-roundtrip.d.ts",

33 "import": "./dist/manifest-roundtrip.js"

34 },

35 "./telemetry": {

36 "types": "./dist/telemetry.d.ts",

37 "import": "./dist/telemetry.js"

38 }

39 },

40 "files": [

41 "dist",

42 "bin",

43 "docs",

44 "assets",

45 "patches",

46 "DEPLOYMENT.md",

47 "tools/release-retry-wrapper.mjs"

48 ],

49 "scripts": {

50 "build": "tsup src/suppress-localstorage-warning.ts src/index.ts src/deploy.ts src/dotns.ts src/pool.ts src/telemetry.ts src/memory-report.ts src/merkle.ts src/gh-pages-mirror.ts src/version-check.ts src/bug-report.ts src/run-state.ts src/environments.ts src/errors.ts src/manifest.ts src/chunk-probe.ts src/manifest-embed.ts src/manifest-fetch.ts src/manifest-roundtrip.ts src/incremental-stats.ts src/chunker.ts src/personhood/encoding.ts src/personhood/hashing.ts src/personhood/constants.ts src/personhood/member-key.ts src/personhood/people-client.ts src/personhood/proof-validity.ts src/per ...

51 "postinstall": "patch-package || true",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L51

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L51

52 "test": "npm run build && node --test test/test.js test/cli-help.test.js test/helpers/e2e-helpers.test.js test/environments.test.js test/product-manifest.test.js test/error-pattern-signature.test.js test/exit-codes.test.js test/probe-env-health.test.js test/e2e-chain-calls.test.js test/auth-config.test.js test/whoami.test.js test/login.test.js test/logout.test.js test/auth-resolve.test.js test/storage-signer.test.js test/spinner.test.js test/sss-allowance.test.js test/sss-allowance-cache.test.js test/dotns-transfer.test.js test/deploy-actors.test.js test/transfer-command.test.js test/dotns ...

53 "test:e2e": "npm run build && node --test test/e2e.test.js",

54 "test:e2e:smoke": "bash scripts/e2e-pass.sh smoke",

55 "test:e2e:pr": "bash scripts/e2e-pass.sh pr",

56 "test:e2e:nightly": "bash scripts/e2e-pass.sh nightly",

57 "benchmark": "npm run build && node benchmark.js",

58 "test:vendor": "vitest run src/auth/vendor"

59 },

60 "dependencies": {

61 "@ipld/car": "^5.4.3",

62 "@ipld/dag-pb": "^4.1.3",

63 "@noble/hashes": "^1.7.2",

64 "@parity/product-sdk-address": "^0.1.1",

65 "@parity/product-sdk-keys": "^0.3.0",

66 "@parity/product-sdk-terminal": "^0.4.0",

67 "@parity/product-sdk-tx": "^0.2.4",

68 "@polkadot-api/metadata-builders": "^0.14.2",

69 "@polkadot-api/substrate-bindings": "^0.20.2",

70 "@polkadot-labs/hdkd": "^0.0.28",

71 "@polkadot-labs/hdkd-helpers": "^0.0.30",

Long lines were clipped for display.

tools/release-retry-wrapper.mjsView file

Lines 1-38javascript

1#!/usr/bin/env node

2// Selective retry wrapper for release E2E.

3//

4// Spawns a child process (the deploy CLI / test runner invocation), captures

5// stdout AND stderr, classifies the failure mode, and exits with 75 on

6// flake-class matches (retry-eligible) or the child's own exit code otherwise.

7//

8// Both streams are passed through to the parent's stdout/stderr so the GH

9// Actions job log still shows everything live.

10//

11// node --test captures each test-file subprocess's output and re-emits it as

12// TAP YAML on its own stdout — so deploy CLI errors (e.g. "ChainHead

13// disjointed") appear on stdout, not stderr. Capturing both is required.

14//

15// Configure nick-fields/retry@v3 with retry_on_exit_code: 75 so retries only

16// fire for the named transient classes. See

17// docs-internal/superpowers/specs/2026-05-22-ci-restructure-design.md.

19import { spawn } from "node:child_process";

High

Child Process

Package source references child process execution.

tools/release-retry-wrapper.mjsView on unpkg · L18

21// Exact substrings that map to retry-eligible flake classes.

22// Patterns derived from Sentry telemetry (top transient errors over 30d on

23// the e2e-ci-pr and e2e-ci-release tags).

24const FLAKE_PATTERNS = [

25 "Invalid: Stale", // tx Invalid/Stale (nonce race) — papi 1.x format

26 '"type": "Stale"', // tx Invalid/Stale — papi 2.x JSON format

27 "ChainHead disjointed", // RPC reorg / WS flake

28 "Connection lost", // WS hard drop

29 "is not pinned", // papi ChainHead subscription: node dropped block pin (stop-call)

30 "Account mapping did not take effect", // Revive mapping race

31 "requires Node.js >=22", // parity-default runner downgrade (Node v18) — infra flake

32 "received a shutdown signal", // runner process killed mid-job — CI infra flake

33];

35// output: combined stdout+stderr text from the child. Any flake pattern

36// appearing anywhere in the child's output makes the run retry-eligible.

37export function classifyForRetry(output, childExitCode = 1) {

38 if (childExitCode === 0) return 0;

dist/chunk-6NNGMCNA.jsView file

Lines 54-92javascript

54 }

55 if (!options.walkUp) break;

56 const parent = path.dirname(dir);

57 if (parent === dir) break;

58 dir = parent;

59 }

60 const where = options.walkUp ? `${start} (walking up)` : start;

61 throw new NonRetryableError(

62 `No product config found in ${where}. Looked for: ${CANDIDATE_FILENAMES.join(", ")}.`

63 );

64}

65async function fileExists(p) {

66 try {

67 const stat2 = await fs.stat(p);

68 return stat2.isFile();

69 } catch {

70 return false;

71 }

72}

73async function importConfig(sourcePath) {

74 if (sourcePath.endsWith(".ts")) {

75 const { createJiti } = await import("jiti");

76 const jiti = createJiti(import.meta.url, { interopDefault: false });

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/chunk-6NNGMCNA.jsView on unpkg · L74

77 return jiti.import(sourcePath);

78 }

79 return import(pathToFileURL(sourcePath).href);

80}

81function pickDefault(mod) {

82 if (mod && typeof mod === "object" && "default" in mod) {

83 return mod.default;

84 }

85 return mod;

86}

88export {

89 loadProductConfig,

90 tryLoadProductConfig

91};

dist/chunk-N2SPPZCQ.jsView file

Lines 121-161javascript

121 rl.close();

122 resolve(true);

123 } else if (a === "n" || a === "no") {

124 answered = true;

125 rl.close();

126 resolve(false);

127 } else {

128 rl.question(" Please answer Y or N: ", (retry) => {

129 if (answered) return;

130 const r = retry.trim().toLowerCase();

131 answered = true;

132 rl.close();

133 resolve(r === "" || r === "y" || r === "yes");

134 });

135 }

136 });

137 });

138}

139function updateAndRetry() {

140 console.error("\n Updating polkadot-app-deploy...");

141 try {

142 execSync("npm install -g @parity/polkadot-app-deploy@latest", { stdio: "inherit" });

143 console.error(" Updated. Retrying deploy...\n");

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/chunk-N2SPPZCQ.jsView on unpkg · L141

144 execFileSync(process.argv[0], process.argv.slice(1), { stdio: "inherit" });

145 process.exit(0);

146 } catch {

147 console.error(" Update failed. Please run: npm install -g @parity/polkadot-app-deploy@latest");

148 process.exit(1);

149 }

150}

151function classifyErrorArea(msg) {

154 if (/ipfs|cid|pin|dag/i.test(msg)) return "area:ipfs";

156 return null;

157}

158function assessVersion(currentVersion, info, internal) {

159 if (info.minimumFromRegistry && compareSemver(currentVersion, info.minimumFromRegistry) < 0) {

160 return { action: "forced_update", currentVersion, minimumVersion: info.minimumFromRegistry };

161 }

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = patch-package || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = patch-package || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

tools/release-retry-wrapper.mjsView file

18L19: import { spawn } from "node:child_process"; L20:

High

Child Process

Package source references child process execution.

tools/release-retry-wrapper.mjsView on unpkg · L18

dist/chunk-6NNGMCNA.jsView file

74if (sourcePath.endsWith(".ts")) { L75: const { createJiti } = await import("jiti"); L76: const jiti = createJiti(import.meta.url, { interopDefault: false });

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/chunk-6NNGMCNA.jsView on unpkg · L74

dist/chunk-N2SPPZCQ.jsView file

141try { L142: execSync("npm install -g @parity/polkadot-app-deploy@latest", { stdio: "inherit" }); L143: console.error(" Updated. Retrying deploy...\n");

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/chunk-N2SPPZCQ.jsView on unpkg · L141

Findings

4 High6 Medium5 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processtools/release-retry-wrapper.mjs

HighShell

HighRuntime Package Installdist/chunk-N2SPPZCQ.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requiredist/chunk-6NNGMCNA.js

MediumNetwork

MediumEnvironment Vars

MediumProtestware

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowCopyleft License

Source & flagged code

5 flagged

package.jsonView file

Lines 31-71json

31 "./manifest-roundtrip": {

32 "types": "./dist/manifest-roundtrip.d.ts",

33 "import": "./dist/manifest-roundtrip.js"

34 },

35 "./telemetry": {

36 "types": "./dist/telemetry.d.ts",

37 "import": "./dist/telemetry.js"

38 }

39 },

40 "files": [

41 "dist",

42 "bin",

43 "docs",

44 "assets",

45 "patches",

46 "DEPLOYMENT.md",

47 "tools/release-retry-wrapper.mjs"

48 ],

49 "scripts": {

51 "postinstall": "patch-package || true",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L51

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L51

53 "test:e2e": "npm run build && node --test test/e2e.test.js",

54 "test:e2e:smoke": "bash scripts/e2e-pass.sh smoke",

55 "test:e2e:pr": "bash scripts/e2e-pass.sh pr",

56 "test:e2e:nightly": "bash scripts/e2e-pass.sh nightly",

57 "benchmark": "npm run build && node benchmark.js",

58 "test:vendor": "vitest run src/auth/vendor"

59 },

60 "dependencies": {

61 "@ipld/car": "^5.4.3",

62 "@ipld/dag-pb": "^4.1.3",

63 "@noble/hashes": "^1.7.2",

64 "@parity/product-sdk-address": "^0.1.1",

65 "@parity/product-sdk-keys": "^0.3.0",

66 "@parity/product-sdk-terminal": "^0.4.0",

67 "@parity/product-sdk-tx": "^0.2.4",

68 "@polkadot-api/metadata-builders": "^0.14.2",

69 "@polkadot-api/substrate-bindings": "^0.20.2",

70 "@polkadot-labs/hdkd": "^0.0.28",

71 "@polkadot-labs/hdkd-helpers": "^0.0.30",

Long lines were clipped for display.

tools/release-retry-wrapper.mjsView file

Lines 1-38javascript

1#!/usr/bin/env node

2// Selective retry wrapper for release E2E.

3//

4// Spawns a child process (the deploy CLI / test runner invocation), captures

5// stdout AND stderr, classifies the failure mode, and exits with 75 on

6// flake-class matches (retry-eligible) or the child's own exit code otherwise.

7//

8// Both streams are passed through to the parent's stdout/stderr so the GH

9// Actions job log still shows everything live.

10//

11// node --test captures each test-file subprocess's output and re-emits it as

12// TAP YAML on its own stdout — so deploy CLI errors (e.g. "ChainHead

13// disjointed") appear on stdout, not stderr. Capturing both is required.

14//

15// Configure nick-fields/retry@v3 with retry_on_exit_code: 75 so retries only

16// fire for the named transient classes. See

17// docs-internal/superpowers/specs/2026-05-22-ci-restructure-design.md.

19import { spawn } from "node:child_process";

High

Child Process

Package source references child process execution.

tools/release-retry-wrapper.mjsView on unpkg · L18

21// Exact substrings that map to retry-eligible flake classes.

22// Patterns derived from Sentry telemetry (top transient errors over 30d on

23// the e2e-ci-pr and e2e-ci-release tags).

24const FLAKE_PATTERNS = [

25 "Invalid: Stale", // tx Invalid/Stale (nonce race) — papi 1.x format

26 '"type": "Stale"', // tx Invalid/Stale — papi 2.x JSON format

27 "ChainHead disjointed", // RPC reorg / WS flake

28 "Connection lost", // WS hard drop

29 "is not pinned", // papi ChainHead subscription: node dropped block pin (stop-call)

30 "Account mapping did not take effect", // Revive mapping race

31 "requires Node.js >=22", // parity-default runner downgrade (Node v18) — infra flake

32 "received a shutdown signal", // runner process killed mid-job — CI infra flake

33];

35// output: combined stdout+stderr text from the child. Any flake pattern

36// appearing anywhere in the child's output makes the run retry-eligible.

37export function classifyForRetry(output, childExitCode = 1) {

38 if (childExitCode === 0) return 0;

dist/chunk-6NNGMCNA.jsView file

Lines 54-92javascript

54 }

55 if (!options.walkUp) break;

56 const parent = path.dirname(dir);

57 if (parent === dir) break;

58 dir = parent;

59 }

60 const where = options.walkUp ? `${start} (walking up)` : start;

61 throw new NonRetryableError(

62 `No product config found in ${where}. Looked for: ${CANDIDATE_FILENAMES.join(", ")}.`

63 );

64}

65async function fileExists(p) {

66 try {

67 const stat2 = await fs.stat(p);

68 return stat2.isFile();

69 } catch {

70 return false;

71 }

72}

73async function importConfig(sourcePath) {

74 if (sourcePath.endsWith(".ts")) {

75 const { createJiti } = await import("jiti");

76 const jiti = createJiti(import.meta.url, { interopDefault: false });

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/chunk-6NNGMCNA.jsView on unpkg · L74

77 return jiti.import(sourcePath);

78 }

79 return import(pathToFileURL(sourcePath).href);

80}

81function pickDefault(mod) {

82 if (mod && typeof mod === "object" && "default" in mod) {

83 return mod.default;

84 }

85 return mod;

86}

88export {

89 loadProductConfig,

90 tryLoadProductConfig

91};

dist/chunk-N2SPPZCQ.jsView file

Lines 121-161javascript

121 rl.close();

122 resolve(true);

123 } else if (a === "n" || a === "no") {

124 answered = true;

125 rl.close();

126 resolve(false);

127 } else {

128 rl.question(" Please answer Y or N: ", (retry) => {

129 if (answered) return;

130 const r = retry.trim().toLowerCase();

131 answered = true;

132 rl.close();

133 resolve(r === "" || r === "y" || r === "yes");

134 });

135 }

136 });

137 });

138}

139function updateAndRetry() {

140 console.error("\n Updating polkadot-app-deploy...");

141 try {

142 execSync("npm install -g @parity/polkadot-app-deploy@latest", { stdio: "inherit" });

143 console.error(" Updated. Retrying deploy...\n");

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/chunk-N2SPPZCQ.jsView on unpkg · L141

144 execFileSync(process.argv[0], process.argv.slice(1), { stdio: "inherit" });

145 process.exit(0);

146 } catch {

147 console.error(" Update failed. Please run: npm install -g @parity/polkadot-app-deploy@latest");

148 process.exit(1);

149 }

150}

151function classifyErrorArea(msg) {

154 if (/ipfs|cid|pin|dag/i.test(msg)) return "area:ipfs";

156 return null;

157}

158function assessVersion(currentVersion, info, internal) {

159 if (info.minimumFromRegistry && compareSemver(currentVersion, info.minimumFromRegistry) < 0) {

160 return { action: "forced_update", currentVersion, minimumVersion: info.minimumFromRegistry };

161 }