registry / @principal-ai/principal-view-cli / 0.31.1

@principal-ai/principal-view-cli@0.31.1

Principal View CLI - Validate and manage .canvas configuration files

Static Scan Results

scanned 2d ago · by rust-scanner

Static analysis flagged 15 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 50 file(s), 814 KB of source, external domains: api.github.com, app.principal-ade.com, github.com, lucide.dev, opentelemetry.io, refactoring.guru, www.typescriptlang.org

Oversized source lightweight scan

dist/index.cjs12.0 MB file, sampled 256 KB

FilesystemNetworkChildProcessEnvironmentVarsHighEntropyStringsUrlStringsapp.principal-ade.comrefactoring.guruwww.typescriptlang.org

Source & flagged code

7 flagged

dist/commands/trail.jsView file

Lines 48-88javascript

48 encoding: 'utf8',

49 stdio: ['ignore', 'pipe', 'ignore'],

50 });

51 if (result.status === 0 && result.stdout) {

52 const token = result.stdout.trim();

53 if (token)

54 return token;

55 }

56 return null;

57}

58function resolveTokenViaGitCredential() {

59 const result = spawnSync('git', ['credential', 'fill'], {

60 encoding: 'utf8',

61 input: 'protocol=https\nhost=github.com\n\n',

62 stdio: ['pipe', 'pipe', 'ignore'],

63 });

64 if (result.status !== 0 || !result.stdout)

65 return null;

66 for (const line of result.stdout.split('\n')) {

67 if (line.startsWith('password=')) {

68 const token = line.slice('password='.length).trim();

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/commands/trail.jsView on unpkg · L68

69 if (token)

70 return token;

71 }

72 }

73 return null;

74}

75export function resolveToken() {

76 return resolveTokenViaGh() ?? resolveTokenViaGitCredential();

77}

78export function exitWithTokenError() {

79 process.stderr.write('Could not resolve a GitHub token. Run `gh auth login`, or configure a git credential helper for github.com.\n');

80 process.exit(2);

81}

82async function readPayloadFromStdin() {

83 const chunks = [];

84 for await (const chunk of process.stdin) {

85 chunks.push(typeof chunk === 'string' ? Buffer.from(chunk) : chunk);

86 }

87 return Buffer.concat(chunks).toString('utf8');

88}

dist/lib/open-url.jsView file

Lines 1-29javascript

1/**

2 * Cross-platform "open this URL in the default browser" helper.

3 *

4 * Used by `topic open` and `trail open-web`. Detaches + unrefs the child so

5 * the CLI returns immediately rather than waiting on the browser process.

6 * Headless machines (CI, ssh sessions) will see a friendly stderr warning;

7 * the URL itself is still printed to stdout by the caller, so the user can

8 * always copy it.

9 */

10import { spawn } from 'node:child_process';

dist/commands/hooks.jsView file

Lines 1-24javascript

1/**

2 * Hooks command - Manage husky pre-commit hooks for Principal View

3 *

4 * This command installs/removes pre-commit hooks into a target project

5 * that will run `npx @principal-ai/principal-view-cli doctor` and `npx @principal-ai/principal-view-cli validate` before each commit.

6 */

7import { Command } from 'commander';

8import { existsSync, readFileSync, writeFileSync, unlinkSync, chmodSync } from 'node:fs';

dist/index.cjsView file

•path = dist/index.cjs kind = oversized_source_file sizeBytes = 12540351 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/index.cjsView on unpkg

•path = dist/index.cjs kind = oversized_cli_entrypoint sizeBytes = 12540351 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/index.cjsView on unpkg

dist/commands/inbox.jsView file

Lines 17-57javascript

17 encoding: 'utf8',

18 stdio: ['ignore', 'pipe', 'ignore'],

19 });

20 if (result.status === 0 && result.stdout) {

21 const token = result.stdout.trim

dist/commands/topic.jsView file

Lines 27-67javascript

27 encoding: 'utf8',

28 stdio: ['ignore', 'pipe', 'ignore'],

29 });

30 if (result.status === 0 && result.stdout) {

31 const token = result.stdout.trim

Source & flagged code

7 flagged · loading source

dist/commands/trail.jsView file

68patternName = generic_password severity = medium line = 68 matchedText = const to...m();

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/commands/trail.jsView on unpkg · L68

dist/lib/open-url.jsView file

9*/ L10: import { spawn } from 'node:child_process'; L11: export function openInBrowser(url) {

High

Child Process

Package source references child process execution.

dist/lib/open-url.jsView on unpkg · L9

dist/commands/hooks.jsView file

4* This command installs/removes pre-commit hooks into a target project L5: * that will run `npx @principal-ai/principal-view-cli doctor` and `npx @principal-ai/principal-view-cli validate` before each commit. L6: */ ... L10: import chalk from 'chalk'; L11: import { execSync } from 'node:child_process'; L12: const HUSKY_DIR = '.husky';

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/commands/hooks.jsView on unpkg · L4

dist/index.cjsView file

•path = dist/index.cjs kind = oversized_source_file sizeBytes = 12540351 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/index.cjsView on unpkg

•path = dist/index.cjs kind = oversized_cli_entrypoint sizeBytes = 12540351 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/index.cjsView on unpkg

dist/commands/inbox.jsView file

37patternName = generic_password severity = medium line = 37 matchedText = const to...m();

Medium

Secret Pattern

Hardcoded password in dist/commands/inbox.js

dist/commands/inbox.jsView on unpkg · L37

dist/commands/topic.jsView file

47patternName = generic_password severity = medium line = 47 matchedText = const to...m();

Medium

Secret Pattern

Hardcoded password in dist/commands/topic.js

dist/commands/topic.jsView on unpkg · L47

Findings

4 High7 Medium4 Low

HighChild Processdist/lib/open-url.js

HighShell

HighRuntime Package Installdist/commands/hooks.js

HighOversized Source Filedist/index.cjs

MediumSecret Patterndist/commands/trail.js

MediumNetwork

MediumEnvironment Vars

MediumOversized Cli Entrypointdist/index.cjs

MediumStructural Risk Force Deep Review

MediumSecret Patterndist/commands/inbox.js

MediumSecret Patterndist/commands/topic.js

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

7 flagged

dist/commands/trail.jsView file

Lines 48-88javascript

48 encoding: 'utf8',

49 stdio: ['ignore', 'pipe', 'ignore'],

50 });

51 if (result.status === 0 && result.stdout) {

52 const token = result.stdout.trim();

53 if (token)

54 return token;

55 }

56 return null;

57}

58function resolveTokenViaGitCredential() {

59 const result = spawnSync('git', ['credential', 'fill'], {

60 encoding: 'utf8',

61 input: 'protocol=https\nhost=github.com\n\n',

62 stdio: ['pipe', 'pipe', 'ignore'],

63 });

64 if (result.status !== 0 || !result.stdout)

65 return null;

66 for (const line of result.stdout.split('\n')) {

67 if (line.startsWith('password=')) {

68 const token = line.slice('password='.length).trim();

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/commands/trail.jsView on unpkg · L68

69 if (token)

70 return token;

71 }

72 }

73 return null;

74}

75export function resolveToken() {

76 return resolveTokenViaGh() ?? resolveTokenViaGitCredential();

77}

78export function exitWithTokenError() {

79 process.stderr.write('Could not resolve a GitHub token. Run `gh auth login`, or configure a git credential helper for github.com.\n');

80 process.exit(2);

81}

82async function readPayloadFromStdin() {

83 const chunks = [];

84 for await (const chunk of process.stdin) {

85 chunks.push(typeof chunk === 'string' ? Buffer.from(chunk) : chunk);

86 }

87 return Buffer.concat(chunks).toString('utf8');

88}

dist/lib/open-url.jsView file

Lines 1-29javascript

1/**

2 * Cross-platform "open this URL in the default browser" helper.

3 *

4 * Used by `topic open` and `trail open-web`. Detaches + unrefs the child so

5 * the CLI returns immediately rather than waiting on the browser process.

6 * Headless machines (CI, ssh sessions) will see a friendly stderr warning;

7 * the URL itself is still printed to stdout by the caller, so the user can

8 * always copy it.

9 */

10import { spawn } from 'node:child_process';

dist/commands/hooks.jsView file

Lines 1-24javascript

1/**

2 * Hooks command - Manage husky pre-commit hooks for Principal View

3 *

4 * This command installs/removes pre-commit hooks into a target project

5 * that will run `npx @principal-ai/principal-view-cli doctor` and `npx @principal-ai/principal-view-cli validate` before each commit.

6 */

7import { Command } from 'commander';

8import { existsSync, readFileSync, writeFileSync, unlinkSync, chmodSync } from 'node:fs';

dist/index.cjsView file

•path = dist/index.cjs kind = oversized_source_file sizeBytes = 12540351 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/index.cjsView on unpkg

•path = dist/index.cjs kind = oversized_cli_entrypoint sizeBytes = 12540351 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/index.cjsView on unpkg

dist/commands/inbox.jsView file

Lines 17-57javascript

17 encoding: 'utf8',

18 stdio: ['ignore', 'pipe', 'ignore'],

19 });

20 if (result.status === 0 && result.stdout) {

21 const token = result.stdout.trim

dist/commands/topic.jsView file

Lines 27-67javascript

27 encoding: 'utf8',

28 stdio: ['ignore', 'pipe', 'ignore'],

29 });

30 if (result.status === 0 && result.stdout) {

31 const token = result.stdout.trim