registry / @pylonsync/create-pylon / 0.3.314

@pylonsync/create-pylon@0.3.314

Scaffold a new Pylon app — realtime backend + web/mobile/expo frontends in one command. Run via `npm create @pylonsync/pylon@latest`.

Static Scan Results

scanned 6h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 470 file(s), 1.23 MB of source, external domains: 10.0.2.2, api.replicate.com, docs.pylonsync.com, example.com, github.com, instagram.com, linkedin.com, pylonsync.com, rsms.me, x.com

Source & flagged code

4 flagged

templates/marketplace/client/market.tsView file

Lines 1-43typescript

1"use client";

3// Shared client-side glue for Pylon Market: types, display helpers, and the

4// email/password auth bootstrap. Same-origin under native SSR, so no baseUrl —

5// init() resolves window.location.origin.

6import { init, configureClient, callFn, setSessionToken, storageKey } from "@pylonsync/react";

8export const APP_NAME = "market";

10// Prefilled demo account — the shopper you sign in as. Owns a couple of its

11// own listings so "My Market" isn't empty, but NOT the bulk of the catalog,

12// so it can actually buy + bid on things.

13export const DEMO = {

14 email: "demo@pylon.market",

15 password: "pylondemo123",

Medium

Secret Pattern

Package contains a possible secret pattern.

templates/marketplace/client/market.tsView on unpkg · L15

16 name: "Demo Shopper",

17} as const;

19// The seed seller that owns most of the catalog. Nobody logs in as this; it

20// exists so the demo shopper has plenty of other people's listings to buy.

21const BAZAAR = {

22 email: "bazaar@pylon.market",

23 password: "bazaarseed123",

Medium

Secret Pattern

Hardcoded password in templates/marketplace/client/market.ts

templates/marketplace/client/market.tsView on unpkg · L23

24 name: "Pylon Bazaar",

25} as const;

27// How many of the seeded listings the bazaar owns; the rest go to the demo.

28const BAZAAR_COUNT = 10;

30export interface Listing {

31 id: string;

32 sellerId: string;

33 sellerName: string;

34 title: string;

35 slug: string;

36 description: string;

37 price: number;

38 category: string;

39 condition: string;

40 status: "active" | "sold";

41 seed: string;

42 createdAt: string;

43}

bin/create-pylon.jsView file

Lines 597-637javascript

597 build: "turbo build",

598 check: "turbo check",

599 lint: "turbo lint",

600 ...helperScripts,

601 },

602 devDependencies: {

603 turbo: "^2.3.0",

Source & flagged code

4 flagged · loading source

templates/marketplace/client/market.tsView file

15patternName = generic_password severity = medium line = 15 matchedText = password...23",

Medium

Secret Pattern

Package contains a possible secret pattern.

templates/marketplace/client/market.tsView on unpkg · L15

23patternName = generic_password severity = medium line = 23 matchedText = password...23",

Medium

Secret Pattern

Hardcoded password in templates/marketplace/client/market.ts

templates/marketplace/client/market.tsView on unpkg · L23

bin/create-pylon.jsView file

617console.log(`Installing dependencies with ${flags.pm}...`); L618: const { spawnSync } = await import("node:child_process"); L619: const result = spawnSync(flags.pm, ["install"], {

High

Child Process

Package source references child process execution.

bin/create-pylon.jsView on unpkg · L617

617console.log(`Installing dependencies with ${flags.pm}...`); L618: const { spawnSync } = await import("node:child_process"); L619: const result = spawnSync(flags.pm, ["install"], { ... L632: // L633: // `npx skills add pylonsync/pylon` (skills.sh) detects the installed agent L634: // (Claude Code / Codex / Cursor) and drops the canonical skill from this

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/create-pylon.jsView on unpkg · L617

Findings

2 High5 Medium4 Low

HighChild Processbin/create-pylon.js

HighRuntime Package Installbin/create-pylon.js

MediumSecret Patterntemplates/marketplace/client/market.ts

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumSecret Patterntemplates/marketplace/client/market.ts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

templates/marketplace/client/market.tsView file

Lines 1-43typescript

1"use client";

3// Shared client-side glue for Pylon Market: types, display helpers, and the

4// email/password auth bootstrap. Same-origin under native SSR, so no baseUrl —

5// init() resolves window.location.origin.

6import { init, configureClient, callFn, setSessionToken, storageKey } from "@pylonsync/react";

8export const APP_NAME = "market";

10// Prefilled demo account — the shopper you sign in as. Owns a couple of its

11// own listings so "My Market" isn't empty, but NOT the bulk of the catalog,

12// so it can actually buy + bid on things.

13export const DEMO = {

14 email: "demo@pylon.market",

15 password: "pylondemo123",

Medium

Secret Pattern

Package contains a possible secret pattern.

templates/marketplace/client/market.tsView on unpkg · L15

16 name: "Demo Shopper",

17} as const;

19// The seed seller that owns most of the catalog. Nobody logs in as this; it

20// exists so the demo shopper has plenty of other people's listings to buy.

21const BAZAAR = {

22 email: "bazaar@pylon.market",

23 password: "bazaarseed123",

Medium

Secret Pattern

Hardcoded password in templates/marketplace/client/market.ts

templates/marketplace/client/market.tsView on unpkg · L23

24 name: "Pylon Bazaar",

25} as const;

27// How many of the seeded listings the bazaar owns; the rest go to the demo.

28const BAZAAR_COUNT = 10;

30export interface Listing {

31 id: string;

32 sellerId: string;

33 sellerName: string;

34 title: string;

35 slug: string;

36 description: string;

37 price: number;

38 category: string;

39 condition: string;

40 status: "active" | "sold";

41 seed: string;

42 createdAt: string;

43}

bin/create-pylon.jsView file

Lines 597-637javascript

597 build: "turbo build",

598 check: "turbo check",

599 lint: "turbo lint",

600 ...helperScripts,

601 },

602 devDependencies: {

603 turbo: "^2.3.0",