registry / @raisindb/cli / 0.1.54

@raisindb/cli@0.1.54

Interactive CLI for RaisinDB with Ink-based terminal UI

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 18 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 101 file(s), 739 KB of source, external domains: a.example, api.dropbox.com, api.dropboxapi.com, api.example.com, api.github.com, api.groq.com, app.example.com, b.example, cdn.example.com, github.com, raisindb.com, x.example

Source & flagged code

11 flagged

dist/commands/server.jsView file

Lines 1-26javascript

1import fs from 'fs';

2import path from 'path';

3import os from 'os';

4import crypto from 'crypto';

5import { pipeline } from 'stream/promises';

6import { Writable } from 'stream';

7import { spawn } from 'child_process';

8import { createWriteStream } from 'fs';

High

Child Process

Package source references child process execution.

dist/commands/server.jsView on unpkg · L6

9import React from 'react';

10import { render } from 'ink';

11import { ServerInstallUI } from '../components/ServerInstall.js';

12import { ServerReady } from '../components/ServerReady.js';

13const BIN_NAME = 'raisindb';

14const REPO = process.env.RAISINDB_REPO || 'maravilla-labs/raisindb';

15const GH_TOKEN = process.env.RAISINDB_GH_TOKEN || process.env.GITHUB_TOKEN || '';

16const HTTP_TIMEOUT_MS = Number(process.env.RAISINDB_HTTP_TIMEOUT_MS || 15000);

17const HTTP_RETRIES = Math.max(1, Number(process.env.RAISINDB_HTTP_RETRIES || 3));

18// --- Path helpers ---

19function getRaisinDir() {

20 const dir = path.join(os.homedir(), '.raisindb');

21 fs.mkdirSync(dir, { recursive: true });

22 return dir;

23}

24function getBinDir() {

25 const dir = path.join(getRaisinDir(), 'bin');

26 fs.mkdirSync(dir, { recursive: true });

Lines 121-161javascript

121 });

122}

123async function sha256File(filePath) {

124 return new Promise((resolve, reject) => {

125 const hash = crypto.createHash('sha256');

126 const

dist/flow/load.jsView file

Lines 68-108javascript

68 catch (error) {

69 failures.push({ file, error: error instanceof Error ? error.message : String(error) });

70 return null;

71 }

72 const extracted = extractDefinition(doc);

dist/wasm/schema-validator.jsView file

Lines 1-39javascript

1/**

2 * WASM-based schema validator for RaisinDB packages

3 */

4import * as fs from 'fs';

5import * as path from 'path';

6import { partitionTranslationFiles, validateTranslationFiles, } from './translation-validator.js';

dist/commands/init.jsView file

Lines 18-53javascript

18 const vars = { packageName, workspace, description, namespace };

19 const pack = getPack(options.pack || 'minimal');

20 const files = pack.getFiles(vars);

21 fs.mkdirSync(targetDir, { recursive: true });

dist/commands/admin-commands.test.jsView file

Lines 178-237javascript

178describe('cors helpers', () => {

179 it('validateOrigin normalizes and rejects paths', () => {

180 expect(validateOrigin('http://localhost:5173/')).toBe('http://localhost:5173');

181 expect(validateOrigin('*')).toBe

Source & flagged code

11 flagged · loading source

dist/commands/server.jsView file

6import { Writable } from 'stream'; L7: import { spawn } from 'child_process'; L8: import { createWriteStream } from 'fs';

High

Child Process

Package source references child process execution.

dist/commands/server.jsView on unpkg · L6

141return new Promise((resolve, reject) => { L142: const child = spawn('powershell', ['-Command', `Expand-Archive -Path '${archive}' -DestinationPath '${targetDir}' -Force`], { stdio: 'ignore' }); L143: child.on('error', reject);

High

Shell

Package source references shell execution.

dist/commands/server.jsView on unpkg · L141

dist/flow/load.jsView file

88/** L89: * Extract `workflow_data:` / `workflowData =` object literals from a JS L90: * source file without executing the module. The literal is evaluated in an

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

dist/flow/load.jsView on unpkg · L88

dist/wasm/schema-validator.jsView file

19package = @raisindb/cli; repositoryIdentity = raisindb; dependency = @raisindb/schema-wasm L19: // Dynamic import of the WASM module (nodejs target - no async init needed) L20: wasmModule = await import('@raisindb/schema-wasm'); L21: // Initialize panic hooks

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/wasm/schema-validator.jsView on unpkg · L19

dist/commands/init.jsView file

38try { L39: execSync('npx skills add maravilla-labs/raisindb/packages/raisindb-skills', { L40: cwd: targetDir,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/commands/init.jsView on unpkg · L38

dist/commands/admin-commands.test.jsView file

198patternName = generic_password severity = medium line = 198 matchedText = await us...pl);

Medium

Secret Pattern