registry / @puzzmo/cli / 1.0.55

@puzzmo/cli@1.0.55

Command-line tool for Puzzmo game developers. Authenticate, upload game builds, and create new game projects.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicenseWildcardDependency

scanned 69 file(s), 295 KB of source, external domains: api.puzzmo.com, dev-dj9e.onrender.com

Source & flagged code

3 flagged

lib/util/exec.jsView file

Lines 1-34javascript

1import { execSync } from "node:child_process";

2/** Runs a shell command, printing output */

High

Child Process

Package source references child process execution.

lib/util/exec.jsView on unpkg · L1

3export const runCommand = (cmd, opts = {}) => {

4 execSync(cmd, {

5 cwd: opts.cwd,

6 stdio: "inherit",

7 encoding: "utf-8",

8 });

9};

10/** Runs a command and returns stdout */

11export const runCommandOutput = (cmd, opts = {}) => {

12 return execSync(cmd, {

13 cwd: opts.cwd,

14 encoding: "utf-8",

15 }).trim();

16};

17/** Creates a git commit */

18export const gitCommit = (message, opts = {}) => {

19 execSync(`git commit -m "${message}"`, {

20 cwd: opts.cwd,

21 stdio: "inherit",

22 });

23};

24/** Runs vite build and returns success/failure */

25export const verifyBuild = (cwd) => {

26 try {

27 execSync("npx vite build", { cwd, encoding: "utf-8", stdio: "pipe" });

28 return { success: true };

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

lib/util/exec.jsView on unpkg · L26

29 }

30 catch (e) {

31 return { success: false, error: e.stderr || e.stdout || e.message };

32 }

33};

34//# sourceMappingURL=exec.js.map

src/commands/upload.tsView file

Lines 373-413typescript

373 }

374 return true

375 } catch (e) {

376 const message = e instanceof Error ? e.message : String(e)

377 console.error(` Could not create game: ${message}`)

Source & flagged code

3 flagged · loading source

lib/util/exec.jsView file

1import { execSync } from "node:child_process"; L2: /** Runs a shell command, printing output */

High

Child Process

Package source references child process execution.

lib/util/exec.jsView on unpkg · L1

26try { L27: execSync("npx vite build", { cwd, encoding: "utf-8", stdio: "pipe" }); L28: return { success: true };

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

lib/util/exec.jsView on unpkg · L26

src/commands/upload.tsView file

393const scriptRe = /<script\b[^>]*\bsrc\s*=\s*["']([^"']+)["']/gi L394: let match: RegExpExecArray | null L395: while ((match = scriptRe.exec(html)) !== null) {

High

Shell

Package source references shell execution.

src/commands/upload.tsView on unpkg · L393

Findings

3 High4 Medium5 Low

HighChild Processlib/util/exec.js

HighShellsrc/commands/upload.ts

HighRuntime Package Installlib/util/exec.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumWildcard Dependency

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

3 flagged

lib/util/exec.jsView file

Lines 1-34javascript

1import { execSync } from "node:child_process";

2/** Runs a shell command, printing output */

High

Child Process

Package source references child process execution.

lib/util/exec.jsView on unpkg · L1

3export const runCommand = (cmd, opts = {}) => {

4 execSync(cmd, {

5 cwd: opts.cwd,

6 stdio: "inherit",

7 encoding: "utf-8",

8 });

9};

10/** Runs a command and returns stdout */

11export const runCommandOutput = (cmd, opts = {}) => {

12 return execSync(cmd, {

13 cwd: opts.cwd,

14 encoding: "utf-8",

15 }).trim();

16};

17/** Creates a git commit */

18export const gitCommit = (message, opts = {}) => {

19 execSync(`git commit -m "${message}"`, {

20 cwd: opts.cwd,

21 stdio: "inherit",

22 });

23};

24/** Runs vite build and returns success/failure */

25export const verifyBuild = (cwd) => {

26 try {

27 execSync("npx vite build", { cwd, encoding: "utf-8", stdio: "pipe" });

28 return { success: true };

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

lib/util/exec.jsView on unpkg · L26

29 }

30 catch (e) {

31 return { success: false, error: e.stderr || e.stdout || e.message };

32 }

33};

34//# sourceMappingURL=exec.js.map

src/commands/upload.tsView file

Lines 373-413typescript

373 }

374 return true

375 } catch (e) {

376 const message = e instanceof Error ? e.message : String(e)

377 console.error(` Could not create game: ${message}`)