registry / @quickback-dev/cli / 0.50.1

@quickback-dev/cli@0.50.1

CLI for Quickback — define your backend in TypeScript, compile to a fully wired Cloudflare Worker (or Bun / Node) with auth, database, migrations, security, CMS, and Account UI.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 15 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 44 file(s), 1.48 MB of source, external domains: account-staging.example.com, account.custom.com, account.example.com, account.quickback.dev, account.yourdomain.com, acme-corp.acme.com, acme.com, admin.example.com, agentauthprotocol.com, api-staging.example.com, api.example.com, api.mysite.com, api.quickback.dev, api.your-app.com, api.your-domain, api.yourdomain.com, app-staging.example.com, app.acme.com, app.custom.com, app.example.com, auth.example.com, better-auth.com, billing.example.com, cheatsheetseries.owasp.org, cms.example.com, compiler.quickback.dev, compiler.test, crm.example.com, dashboard.example.com, datatracker.ietf.org, developer.mozilla.org, developers.cloudflare.com, docs.quickback.dev, example.com, files.yourdomain.com, fonts.googleapis.com, fonts.gstatic.com, github.com, help.acme.com, hstspreload.org, isitagentready.com, meet.example.com, my-api.example.com, openfga.dev, orm.drizzle.team, petstore.swagger.io, quickback.dev, quickback.example.com, scalar.com, secure.example.com

Source & flagged code

8 flagged

dist/lib/shell.jsView file

Lines 1-32javascript

1/**

2 * Shell Utility

3 *

4 * Run shell commands with proper error handling

5 */

6import { spawn } from 'child_process';

7/**

High

Child Process

Package source references child process execution.

dist/lib/shell.jsView on unpkg · L5

8 * Run a shell command and return a promise

9 */

10export async function runCommand(cmd, options = {}) {

11 const { cwd = process.cwd(), silent = false, env } = options;

12 return new Promise((resolve, reject) => {

13 const proc = spawn(cmd, {

14 cwd,

15 stdio: silent ? 'pipe' : 'inherit',

16 shell: true,

17 env: env || process.env,

High

Shell

Package source references shell execution.

dist/lib/shell.jsView on unpkg · L15

18 });

19 proc.on('close', (code) => {

20 if (code === 0) {

21 resolve();

22 }

23 else {

24 reject(new Error(`Command failed with exit code ${code}: ${cmd}`));

25 }

26 });

27 proc.on('error', (err) => {

28 reject(new Error(`Failed to run command: ${cmd}\n${err.message}`));

29 });

30 });

31}

32//# sourceMappingURL=shell.js.map

dist/docs/content.jsView file

101"title": "feature() — the canonical form", L102: "content": "`feature()` is **the** way to write a Quickback feature: one file, one default export, the table and its security contract together. The older `q.table()` + `defineTabl... L103: },

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/docs/content.jsView on unpkg · L101

65"title": "Security Headers", L66: "content": "Every compiled Quickback Worker sets a baseline of security response-headers on every response: HSTS, `X-Content-Type-Options: nosniff`, a clickjacking CSP (`frame-ance... L67: },

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/docs/content.jsView on unpkg · L65

dist/commands/login.jsView file

Lines 1-36javascript

1/**

2 * Login Command

3 *

4 * Uses OAuth 2.0 Device Authorization Grant (RFC 8628) for CLI authentication.

5 * Works in headless environments (SSH, containers) and is more secure than URL-based tokens.

6 *

7 * After authentication, the CLI:

8 * 1. Lists user's organizations

9 * 2. Prompts to select one (or auto-selects if only one)

10 * 3. Sets the active organization on the session

11 *

12 * The device flow creates a Better Auth session that appears in the

dist/commands/create.jsView file

Lines 826-866javascript

826 window: 60,

827 max: 100,

828 customRules: {

829 "/sign-in/email": { window: 60, max: 10 },

830 "/sign-in/social": { window: 60, max: 10 },

831 "/device/init"

dist/examples/recruitment.tar.gzView file

•path = dist/examples/recruitment.tar.gz kind = high_entropy_blob sizeBytes = 2384520 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/examples/recruitment.tar.gzView on unpkg

•path = dist/examples/recruitment.tar.gz kind = compressed_blob sizeBytes = 2384520 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dist/examples/recruitment.tar.gzView on unpkg

Source & flagged code

8 flagged · loading source

dist/lib/shell.jsView file

5*/ L6: import { spawn } from 'child_process'; L7: /**

High

Child Process

Package source references child process execution.

dist/lib/shell.jsView on unpkg · L5

15stdio: silent ? 'pipe' : 'inherit', L16: shell: true, L17: env: env || process.env,

High

Shell

Package source references shell execution.

dist/lib/shell.jsView on unpkg · L15

dist/docs/content.jsView file

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/docs/content.jsView on unpkg · L101

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/docs/content.jsView on unpkg · L65

dist/commands/login.jsView file

16*/ L17: import { exec } from 'child_process'; L18: import pc from 'picocolors'; ... L21: import { storeCredentials } from '../lib/auth.js'; L22: const AUTH_URL = process.env.QUICKBACK_AUTH_URL || 'https://api.quickback.dev'; L23: const CLIENT_ID = 'quickback-cli';

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/commands/login.jsView on unpkg · L16

dist/commands/create.jsView file

846// Check if wrangler is available L847: const wranglerCheck = spawnSync("npx", ["wrangler", "--version"], { encoding: "utf-8" }); L848: if (wranglerCheck.status !== 0) {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/commands/create.jsView on unpkg · L846

dist/examples/recruitment.tar.gzView file

•path = dist/examples/recruitment.tar.gz kind = high_entropy_blob sizeBytes = 2384520 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/examples/recruitment.tar.gzView on unpkg

•path = dist/examples/recruitment.tar.gz kind = compressed_blob sizeBytes = 2384520 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dist/examples/recruitment.tar.gzView on unpkg

Findings

5 High5 Medium5 Low

HighChild Processdist/lib/shell.js

HighShelldist/lib/shell.js

HighSame File Env Network Executiondist/commands/login.js

HighRuntime Package Installdist/commands/create.js

HighShips High Entropy Blobdist/examples/recruitment.tar.gz

MediumDynamic Requiredist/docs/content.js

MediumNetwork

MediumEnvironment Vars

MediumShips Compressed Blobdist/examples/recruitment.tar.gz

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvaldist/docs/content.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

8 flagged

dist/lib/shell.jsView file

Lines 1-32javascript

1/**

2 * Shell Utility

3 *

4 * Run shell commands with proper error handling

5 */

6import { spawn } from 'child_process';

7/**

High

Child Process

Package source references child process execution.

dist/lib/shell.jsView on unpkg · L5

8 * Run a shell command and return a promise

9 */

10export async function runCommand(cmd, options = {}) {

11 const { cwd = process.cwd(), silent = false, env } = options;

12 return new Promise((resolve, reject) => {

13 const proc = spawn(cmd, {

14 cwd,

15 stdio: silent ? 'pipe' : 'inherit',

16 shell: true,

17 env: env || process.env,

High

Shell

Package source references shell execution.

dist/lib/shell.jsView on unpkg · L15

18 });

19 proc.on('close', (code) => {

20 if (code === 0) {

21 resolve();

22 }

23 else {

24 reject(new Error(`Command failed with exit code ${code}: ${cmd}`));

25 }

26 });

27 proc.on('error', (err) => {

28 reject(new Error(`Failed to run command: ${cmd}\n${err.message}`));

29 });

30 });

31}

32//# sourceMappingURL=shell.js.map

dist/docs/content.jsView file

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/docs/content.jsView on unpkg · L101

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/docs/content.jsView on unpkg · L65

dist/commands/login.jsView file

Lines 1-36javascript

1/**

2 * Login Command

3 *

4 * Uses OAuth 2.0 Device Authorization Grant (RFC 8628) for CLI authentication.

5 * Works in headless environments (SSH, containers) and is more secure than URL-based tokens.

6 *

7 * After authentication, the CLI:

8 * 1. Lists user's organizations

9 * 2. Prompts to select one (or auto-selects if only one)

10 * 3. Sets the active organization on the session

11 *

12 * The device flow creates a Better Auth session that appears in the

dist/commands/create.jsView file

Lines 826-866javascript

826 window: 60,

827 max: 100,

828 customRules: {

829 "/sign-in/email": { window: 60, max: 10 },

830 "/sign-in/social": { window: 60, max: 10 },

831 "/device/init"

dist/examples/recruitment.tar.gzView file

•path = dist/examples/recruitment.tar.gz kind = high_entropy_blob sizeBytes = 2384520 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/examples/recruitment.tar.gzView on unpkg

•path = dist/examples/recruitment.tar.gz kind = compressed_blob sizeBytes = 2384520 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dist/examples/recruitment.tar.gzView on unpkg