registry / @polkadot-community-foundation/polkadot-app-deploy / 0.12.1

@polkadot-community-foundation/polkadot-app-deploy@0.12.1

> [!WARNING] > The following is a prototype, reference implementation, and proof-of-concept. This open source code is provided for research, experimentation, and developer education only. This code has not been audited, is actively experimental, and may c

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 15 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsProtestwareUrlStrings

Manifest

CopyleftLicense

scanned 91 file(s), 536 KB of source, external domains: bullet.sik.rocks, docs.ipfs.tech, faucet.polkadot.io, github.com, nodejs.org, paseo-bulletin-next-ipfs.polkadot.io, registry.npmjs.org, stats.uptimerobot.com, summit-ipfs.polkadot.io

Source & flagged code

5 flagged

package.jsonView file

Lines 31-71json

31 "./manifest-roundtrip": {

32 "types": "./dist/manifest-roundtrip.d.ts",

33 "import": "./dist/manifest-roundtrip.js"

34 },

35 "./telemetry": {

36 "types": "./dist/telemetry.d.ts",

37 "import": "./dist/telemetry.js"

38 }

39 },

40 "files": [

41 "dist",

42 "bin",

43 "docs",

44 "assets",

45 "patches",

46 "DEPLOYMENT.md",

47 "tools/release-retry-wrapper.mjs"

48 ],

49 "scripts": {

50 "build": "tsup src/suppress-localstorage-warning.ts src/index.ts src/deploy.ts src/dotns.ts src/pool.ts src/telemetry.ts src/memory-report.ts src/merkle.ts src/gh-pages-mirror.ts src/version-check.ts src/bug-report.ts src/run-state.ts src/environments.ts src/errors.ts src/manifest.ts src/chunk-probe.ts src/manifest-embed.ts src/manifest-fetch.ts src/manifest-roundtrip.ts src/incremental-stats.ts src/chunker.ts src/personhood/encoding.ts src/personhood/hashing.ts src/personhood/constants.ts src/personhood/member-key.ts src/personhood/people-client.ts src/personhood/proof-validity.ts src/per ...

51 "postinstall": "patch-package || true",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L51

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L51

52 "test": "npm run build && node --test test/test.js test/cli-help.test.js test/helpers/e2e-helpers.test.js test/environments.test.js test/product-manifest.test.js test/error-pattern-signature.test.js test/exit-codes.test.js test/probe-env-health.test.js test/e2e-chain-calls.test.js test/auth-config.test.js test/whoami.test.js test/login.test.js

53 "test:e2e": "npm run build && node --test test/e2e.test.js",

54 "test:e2e:smoke": "bash scripts/e2e-pass.sh smoke",

55 "test:e2e:pr": "bash scripts/e2e-pass.sh pr",

56 "test:e2e:nightly": "bash scripts/e2e-pass.sh nightly",

57 "benchmark": "npm run build && node benchmark.js",

58 "test:vendor": "vitest run src/auth/vendor"

59 },

60 "dependencies": {

61 "@ipld/car": "^5.4.3",

62 "@ipld/dag-pb": "^4.1.3",

63 "@noble/hashes": "^1.7.2",

64 "@parity/product-sdk-address": "^0.1.1",

65 "@parity/product-sdk-keys": "^0.3.0",

66 "@parity/product-sdk-terminal": "^0.4.0",

67 "@parity/product-sdk-tx": "^0.2.4",

68 "@polkadot-api/metadata-builders": "^0.14.2",

69 "@polkadot-api/substrate-bindings": "^0.20.2",

70 "@polkadot-labs/hdkd": "^0.0.28",

71 "@polkadot-labs/hdkd-helpers": "^0.0.30",

Long lines were clipped for display.

tools/release-retry-wrapper.mjsView file

Lines 1-38javascript

1#!/usr/bin/env node

2// Selective retry wrapper for release E2E.

3//

4// Spawns a child process (the deploy CLI / test runner invocation), captures

5// stdout AND stderr, classifies the failure mode, and exits with 75 on

6// flake-class matches (retry-eligible) or the child's own exit code otherwise.

7//

8// Both streams are passed through to the parent's stdout/stderr so the GH

9// Actions job log still shows everything live.

10//

11// node --test captures each test-file subprocess's output and re-emits it as

dist/chunk-6NNGMCNA.jsView file

Lines 54-92javascript

54 }

55 if (!options.walkUp) break;

56 const parent = path.dirname(dir);

57 if (parent === dir) break;

58 dir = parent;

59 }

dist/chunk-N2SPPZCQ.jsView file

Lines 121-161javascript

121 rl.close();

122 resolve(true);

123 } else if (a === "n" || a === "no") {

124 answered = true;

125 rl.close();

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = patch-package || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = patch-package || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

tools/release-retry-wrapper.mjsView file

18L19: import { spawn } from "node:child_process"; L20:

High

Child Process

Package source references child process execution.

tools/release-retry-wrapper.mjsView on unpkg · L18

dist/chunk-6NNGMCNA.jsView file

74if (sourcePath.endsWith(".ts")) { L75: const { createJiti } = await import("jiti"); L76: const jiti = createJiti(import.meta.url, { interopDefault: false });

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/chunk-6NNGMCNA.jsView on unpkg · L74

dist/chunk-N2SPPZCQ.jsView file

141try { L142: execSync("npm install -g @parity/polkadot-app-deploy@latest", { stdio: "inherit" }); L143: console.error(" Updated. Retrying deploy...\n");

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/chunk-N2SPPZCQ.jsView on unpkg · L141

Findings

4 High6 Medium5 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processtools/release-retry-wrapper.mjs

HighShell

HighRuntime Package Installdist/chunk-N2SPPZCQ.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requiredist/chunk-6NNGMCNA.js

MediumNetwork

MediumEnvironment Vars

MediumProtestware

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowCopyleft License

Source & flagged code

5 flagged

package.jsonView file

Lines 31-71json

31 "./manifest-roundtrip": {

32 "types": "./dist/manifest-roundtrip.d.ts",

33 "import": "./dist/manifest-roundtrip.js"

34 },

35 "./telemetry": {

36 "types": "./dist/telemetry.d.ts",

37 "import": "./dist/telemetry.js"

38 }

39 },

40 "files": [

41 "dist",

42 "bin",

43 "docs",

44 "assets",

45 "patches",

46 "DEPLOYMENT.md",

47 "tools/release-retry-wrapper.mjs"

48 ],

49 "scripts": {

51 "postinstall": "patch-package || true",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L51

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L51

53 "test:e2e": "npm run build && node --test test/e2e.test.js",

54 "test:e2e:smoke": "bash scripts/e2e-pass.sh smoke",

55 "test:e2e:pr": "bash scripts/e2e-pass.sh pr",

56 "test:e2e:nightly": "bash scripts/e2e-pass.sh nightly",

57 "benchmark": "npm run build && node benchmark.js",

58 "test:vendor": "vitest run src/auth/vendor"

59 },

60 "dependencies": {

61 "@ipld/car": "^5.4.3",

62 "@ipld/dag-pb": "^4.1.3",

63 "@noble/hashes": "^1.7.2",

64 "@parity/product-sdk-address": "^0.1.1",

65 "@parity/product-sdk-keys": "^0.3.0",

66 "@parity/product-sdk-terminal": "^0.4.0",

67 "@parity/product-sdk-tx": "^0.2.4",

68 "@polkadot-api/metadata-builders": "^0.14.2",

69 "@polkadot-api/substrate-bindings": "^0.20.2",

70 "@polkadot-labs/hdkd": "^0.0.28",

71 "@polkadot-labs/hdkd-helpers": "^0.0.30",

Long lines were clipped for display.

tools/release-retry-wrapper.mjsView file

Lines 1-38javascript

1#!/usr/bin/env node

2// Selective retry wrapper for release E2E.

3//

4// Spawns a child process (the deploy CLI / test runner invocation), captures

5// stdout AND stderr, classifies the failure mode, and exits with 75 on

6// flake-class matches (retry-eligible) or the child's own exit code otherwise.

7//

8// Both streams are passed through to the parent's stdout/stderr so the GH

9// Actions job log still shows everything live.

10//

11// node --test captures each test-file subprocess's output and re-emits it as

dist/chunk-6NNGMCNA.jsView file

Lines 54-92javascript

54 }

55 if (!options.walkUp) break;

56 const parent = path.dirname(dir);

57 if (parent === dir) break;

58 dir = parent;

59 }

dist/chunk-N2SPPZCQ.jsView file

Lines 121-161javascript

121 rl.close();

122 resolve(true);

123 } else if (a === "n" || a === "no") {

124 answered = true;

125 rl.close();