registry / @pondoknusa/cli / 2.1.0

@pondoknusa/cli@2.1.0

The Pondoknusa command-line interface

Static Scan Results

scanned 4h ago · by rust-scanner

Static analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 119 file(s), 332 KB of source, external domains: 127.0.0.1, api.example.com, files.your-domain.example, github.com, gitlab.com, pondoknusa.dev, provider.example, your-domain.example

Source & flagged code

2 flagged

dist/cluster-launcher.jsView file

Lines 1-36javascript

1/**

2 * Cluster primary/worker bootstrap for `pondoknusa start --cluster`.

3 *

4 * Workers dynamically import PONDOKNUSA_CLUSTER_ENTRY (the app main file).

5 */

6import cluster from 'node:cluster';

7import { availableParallelism } from 'node:os';

8import { pathToFileURL } from 'node:url';

9const entry = process.env.PONDOKNUSA_CLUSTER_ENTRY;

10if (!entry) {

11 console.error('PONDOKNUSA_CLUSTER_ENTRY is not set.');

12 process.exit(1);

13}

14const clusterEntry = entry;

15const workers = Math.max(1, Number(process.env.PONDOKNUSA_WORKERS) || availableParallelism());

16async function runWorker() {

17 await import(pathToFileURL(clusterEntry).href);

18}

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/cluster-launcher.jsView on unpkg · L16

19if (cluster.isPrimary) {

20 console.log(`Cluster primary ${process.pid} — starting ${workers} workers`);

21 console.log('Use Redis (or database) session store when running multiple workers.');

22 for (let index = 0; index < workers; index += 1) {

23 cluster.fork();

24 }

25 cluster.on('exit', (worker, code, signal) => {

26 if (signal === 'SIGTERM' || signal === 'SIGINT') {

27 return;

28 }

29 console.error(`Worker ${worker.process.pid} exited (${code ?? signal}); restarting…`);

30 cluster.fork();

31 });

32 const shutdown = () => {

33 for (const worker of Object.values(cluster.workers ?? {})) {

34 worker?.kill('SIGTERM');

35 }

36 };

dist/commands/shell.jsView file

Lines 1-18javascript

1import { Command } from '../command.js';

2import { requireProjectRoot } from '../project.js';

3export class ShellCommand extends Command {

4 name = 'shell';

5 description =

Source & flagged code

2 flagged · loading source

dist/cluster-launcher.jsView file

16async function runWorker() { L17: await import(pathToFileURL(clusterEntry).href); L18: }

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/cluster-launcher.jsView on unpkg · L16

dist/commands/shell.jsView file

8package = @pondoknusa/cli; repositoryIdentity = pondoknusa; dependency = @pondoknusa/repl L8: try { L9: const { startRepl } = await import('@pondoknusa/repl'); L10: return startRepl(projectRoot);

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/commands/shell.jsView on unpkg · L8

Findings

1 High4 Medium4 Low

HighCopied Package Dependency Bridgedist/commands/shell.js

MediumDynamic Requiredist/cluster-launcher.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

dist/cluster-launcher.jsView file

Lines 1-36javascript

1/**

2 * Cluster primary/worker bootstrap for `pondoknusa start --cluster`.

3 *

4 * Workers dynamically import PONDOKNUSA_CLUSTER_ENTRY (the app main file).

5 */

6import cluster from 'node:cluster';

7import { availableParallelism } from 'node:os';

8import { pathToFileURL } from 'node:url';

9const entry = process.env.PONDOKNUSA_CLUSTER_ENTRY;

10if (!entry) {

11 console.error('PONDOKNUSA_CLUSTER_ENTRY is not set.');

12 process.exit(1);

13}

14const clusterEntry = entry;

15const workers = Math.max(1, Number(process.env.PONDOKNUSA_WORKERS) || availableParallelism());

16async function runWorker() {

17 await import(pathToFileURL(clusterEntry).href);

18}

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/cluster-launcher.jsView on unpkg · L16

19if (cluster.isPrimary) {

20 console.log(`Cluster primary ${process.pid} — starting ${workers} workers`);

21 console.log('Use Redis (or database) session store when running multiple workers.');

22 for (let index = 0; index < workers; index += 1) {

23 cluster.fork();

24 }

25 cluster.on('exit', (worker, code, signal) => {

26 if (signal === 'SIGTERM' || signal === 'SIGINT') {

27 return;

28 }

29 console.error(`Worker ${worker.process.pid} exited (${code ?? signal}); restarting…`);

30 cluster.fork();

31 });

32 const shutdown = () => {

33 for (const worker of Object.values(cluster.workers ?? {})) {

34 worker?.kill('SIGTERM');

35 }

36 };

dist/commands/shell.jsView file

Lines 1-18javascript

1import { Command } from '../command.js';

2import { requireProjectRoot } from '../project.js';

3export class ShellCommand extends Command {

4 name = 'shell';

5 description =