registry / @raisindb/cli / 0.1.54

@raisindb/cli@0.1.54

Interactive CLI for RaisinDB with Ink-based terminal UI

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 18 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 101 file(s), 739 KB of source, external domains: a.example, api.dropbox.com, api.dropboxapi.com, api.example.com, api.github.com, api.groq.com, app.example.com, b.example, cdn.example.com, github.com, raisindb.com, x.example

Source & flagged code

11 flagged

dist/commands/server.jsView file

Lines 1-26javascript

1import fs from 'fs';

2import path from 'path';

3import os from 'os';

4import crypto from 'crypto';

5import { pipeline } from

Source & flagged code

11 flagged · loading source

dist/commands/server.jsView file

6import { Writable } from 'stream'; L7: import { spawn } from 'child_process'; L8: import { createWriteStream } from 'fs';

High

Child Process

Package source references child process execution.

dist/commands/server.jsView on unpkg · L6

141return new Promise((resolve, reject) => { L142: const child = spawn('powershell', ['-Command', `Expand-Archive -Path '${archive}' -DestinationPath '${targetDir}' -Force`], { stdio: 'ignore' }); L143: child.on('error', reject);

High

Shell

Package source references shell execution.

dist/commands/server.jsView on unpkg · L141

dist/flow/load.jsView file

88/** L89: * Extract `workflow_data:` / `workflowData =` object literals from a JS L90: * source file without executing the module. The literal is evaluated in an

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

dist/flow/load.jsView on unpkg · L88

dist/wasm/schema-validator.jsView file

19package = @raisindb/cli; repositoryIdentity = raisindb; dependency = @raisindb/schema-wasm L19: // Dynamic import of the WASM module (nodejs target - no async init needed) L20: wasmModule = await import('@raisindb/schema-wasm'); L21: // Initialize panic hooks

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/wasm/schema-validator.jsView on unpkg · L19

dist/commands/init.jsView file

38try { L39: execSync('npx skills add maravilla-labs/raisindb/packages/raisindb-skills', { L40: cwd: targetDir,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/commands/init.jsView on unpkg · L38

dist/commands/admin-commands.test.jsView file

198patternName = generic_password severity = medium line = 198 matchedText = await us...pl);

Medium

Secret Pattern

Hardcoded password in dist/commands/admin-commands.test.js

dist/commands/admin-commands.test.jsView on unpkg · L198

202patternName = generic_password severity = medium line = 202 matchedText = password...5!',

Medium

Secret Pattern

Hardcoded password in dist/commands/admin-commands.test.js

dist/commands/admin-commands.test.jsView on unpkg · L202

217patternName = generic_password severity = medium line = 217 matchedText = await us...pl);

Medium

Secret Pattern

Hardcoded password in dist/commands/admin-commands.test.js

dist/commands/admin-commands.test.jsView on unpkg · L217

219patternName = generic_password severity = medium line = 219 matchedText = expect(c... });

Medium

Secret Pattern

Hardcoded password in dist/commands/admin-commands.test.js

dist/commands/admin-commands.test.jsView on unpkg · L219

225patternName = generic_password severity = medium line = 225 matchedText = await ex...s/);

Medium

Secret Pattern

Hardcoded password in dist/commands/admin-commands.test.js

dist/commands/admin-commands.test.jsView on unpkg · L225

229patternName = generic_password severity = medium line = 229 matchedText = await ex...d();

Medium

Secret Pattern

Hardcoded password in dist/commands/admin-commands.test.js

dist/commands/admin-commands.test.jsView on unpkg · L229

Findings

4 High10 Medium4 Low

HighChild Processdist/commands/server.js

HighShelldist/commands/server.js

HighCopied Package Dependency Bridgedist/wasm/schema-validator.js

HighRuntime Package Installdist/commands/init.js

MediumUnsafe Vm Contextdist/flow/load.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumSecret Patterndist/commands/admin-commands.test.js

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Lines 121-161javascript

121 });

122}

123async function sha256File(filePath) {

124 return new Promise((resolve, reject) => {

125 const hash = crypto.createHash('sha256');

126 const rs = fs.createReadStream(filePath);

127 rs.on('error', reject);

128 rs.on('data', (chunk) => hash.update(chunk));

129 rs.on('end', () => resolve(hash.digest('hex')));

130 });

131}

132async function extractTarGz(archive, targetDir) {

133 return new Promise((resolve, reject) => {

134 const child = spawn('tar', ['xzf', archive, '-C', targetDir], { stdio: 'ignore' });

135 child.on('error', reject);

136 child.on('exit', (code) => code === 0 ? resolve() : reject(new Error(`tar exited ${code}`)));

137 });

138}

139async function extractZip(archive, targetDir) {

140 if (process.platform === 'win32') {

141 return new Promise((resolve, reject) => {

142 const child = spawn('powershell', ['-Command', `Expand-Archive -Path '${archive}' -DestinationPath '${targetDir}' -Force`], { stdio: 'ignore' });

143 child.on('error', reject);

High

Shell

Package source references shell execution.

dist/commands/server.jsView on unpkg · L141

144 child.on('exit', (code) => code === 0 ? resolve() : reject(new Error(`unzip exited ${code}`)));

145 });

146 }

147 return new Promise((resolve, reject) => {

148 const child = spawn('unzip', ['-o', archive, '-d', targetDir], { stdio: 'ignore' });

149 child.on('error', reject);

150 child.on('exit', (code) => code === 0 ? resolve() : reject(new Error(`unzip exited ${code}`)));

151 });

152}

153// --- PID management ---

154function readPid() {

155 try {

156 const pid = parseInt(fs.readFileSync(getPidPath(), 'utf-8').trim(), 10);

157 if (isNaN(pid)) {

158 removePid();

159 return null;

160 }

161 // Check if process is alive AND is actually raisindb (not a reused PID)

dist/flow/load.jsView file

Lines 68-108javascript

68 catch (error) {

69 failures.push({ file, error: error instanceof Error ? error.message : String(error) });

70 return null;

71 }

72 const extracted = extractDefinition(doc);

73 if (!extracted)

74 return null;

75 const fallbackName = path.basename(path.dirname(file));

76 const name = extracted.name ??

77 (path.basename(file).startsWith('.node.') ? fallbackName : path.basename(file).replace(/\.(ya?ml|json)$/i, ''));

78 if (extracted.def == null) {

79 failures.push({ file, error: 'raisin:Flow node has no workflow_data property' });

80 return null;

81 }

82 const source = classifyDefinition(file, extracted.def, name);

83 if (!source) {

84 failures.push({ file, error: 'workflow_data is not a recognizable flow definition (no nodes array)' });

85 }

86 return source;

87}

88/**

89 * Extract `workflow_data:` / `workflowData =` object literals from a JS

90 * source file without executing the module. The literal is evaluated in an

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

dist/flow/load.jsView on unpkg · L88

91 * empty vm sandbox; literals referencing module variables are skipped.

92 */

93export function extractFromJs(file) {

94 const text = fs.readFileSync(file, 'utf-8');

95 const sources = [];

96 const pattern = /workflow(?:_data|Data)\s*[:=]\s*\{/g;

97 let match;

98 let index = 0;

99 while ((match = pattern.exec(text)) !== null) {

100 const start = match.index + match[0].length - 1; // position of '{'

101 const literal = extractBalanced(text, start);

102 if (!literal)

103 continue;

104 let value;

105 try {

106 value = vm.runInNewContext(`(${literal})`, Object.create(null), { timeout: 1000 });

107 }

108 catch {

dist/wasm/schema-validator.jsView file

Lines 1-39javascript

1/**

2 * WASM-based schema validator for RaisinDB packages

3 */

4import * as fs from 'fs';

5import * as path from 'path';

6import { partitionTranslationFiles, validateTranslationFiles, } from './translation-validator.js';

7import { validateBundledResources } from './bundled-resource-validator.js';

8import { mergeFlowResults, validatePackageFlows } from '../flow/package-doctor.js';

9// Dynamic import for WASM module (nodejs target)

10let wasmModule = null;

11let wasmReady = false;

12/**

13 * Initialize the WASM module

14 */

15export async function initSchemaValidator() {

16 if (wasmReady)

17 return;

18 try {

19 // Dynamic import of the WASM module (nodejs target - no async init needed)

20 wasmModule = await import('@raisindb/schema-wasm');

21 // Initialize panic hooks

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/wasm/schema-validator.jsView on unpkg · L19

22 wasmModule.init();

23 wasmReady = true;

24 }

25 catch (error) {

26 throw new Error(`Failed to initialize schema validator: ${error}`);

27 }

28}

29/**

30 * Get list of built-in node type names

31 */

32export async function getBuiltinNodeTypes() {

33 await initSchemaValidator();

34 return wasmModule.get_builtin_node_types();

35}

36/**

37 * Get list of built-in workspace names

38 */

39export async function getBuiltinWorkspaces() {

dist/commands/init.jsView file

Lines 18-53javascript

18 const vars = { packageName, workspace, description, namespace };

19 const pack = getPack(options.pack || 'minimal');

20 const files = pack.getFiles(vars);

21 fs.mkdirSync(targetDir, { recursive: true });

22 const count = writeFileTree(targetDir, files);

23 console.log(`\nInitialized "${packageName}" in ${targetDir}\n`);

24 console.log(` Pack: ${pack.name}`);

25 console.log(` Workspace: ${workspace}`);

26 console.log(` Files: ${count}`);

27 if (!options.skipInstall) {

28 // Run npm install

29 console.log(`\nInstalling dependencies...`);

30 try {

31 execSync('npm install', { cwd: targetDir, stdio: 'inherit' });

32 }

33 catch {

34 console.warn(' npm install failed — run it manually: cd ' + folder + ' && npm install');

35 }

36 // Install agent skills

37 console.log(`\nInstalling AI agent skills...`);

38 try {

39 execSync('npx skills add maravilla-labs/raisindb/packages/raisindb-skills', {

40 cwd: targetDir,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/commands/init.jsView on unpkg · L38

41 stdio: 'inherit',

42 });

43 }

44 catch {

45 console.warn(' Skills install failed — run manually: npx skills add maravilla-labs/raisindb/packages/raisindb-skills');

46 }

47 }

48 console.log(`\nReady! Next steps:`);

49 console.log(` cd ${folder}`);

50 console.log(` npm run validate`);

51 console.log('');

52}

53//# sourceMappingURL=init.js.map

dist/commands/admin-commands.test.jsView file

Lines 178-237javascript

178describe('cors helpers', () => {

179 it('validateOrigin normalizes and rejects paths', () => {

180 expect(validateOrigin('http://localhost:5173/')).toBe('http://localhost:5173');

181 expect(validateOrigin('*')).toBe('*');

182 expect(() => validateOrigin('not a url')).toThrow(/Invalid origin/);

183 expect(() => validateOrigin('http://x.example/path')).toThrow(/path/);

184 });

185 it('addOrigin / removeOrigin report change status', () => {

186 expect(addOrigin(['a'], 'a').changed).toBe(false);

187 expect(addOrigin(['a'], 'b')).toEqual({ origins: ['a', 'b'], changed: true });

188 expect(removeOrigin(['a'], 'b').changed).toBe(false);

189 expect(removeOrigin(['a', 'b'], 'a')).toEqual({ origins: ['b'], changed: true });

190 });

191});

192describe('userRegister', () => {

193 const adminUrl = 'http://test-server:1234/api/raisindb/sys/default/identity-users';

194 it('uses the admin endpoint with repos + verified email', async () => {

195 const { fetchImpl, calls } = mockFetch([

196 { match: (u, m) => m === 'POST' && u === adminUrl, status: 201, body: { id: 'x', email: 'a@b.c' } },

197 ]);

198 await userRegister('a@b.c', { password: 'Secret12345!', repo: 'myrepo', displayName: 'A' }, fetchImpl);

Medium

Secret Pattern

Hardcoded password in dist/commands/admin-commands.test.js

dist/commands/admin-commands.test.jsView on unpkg · L198

199 expect(calls).toHaveLength(1);

200 expect(calls[0].body).toEqual({

201 email: 'a@b.c',

202 password: 'Secret12345!',

Medium

Secret Pattern

Hardcoded password in dist/commands/admin-commands.test.js

dist/commands/admin-commands.test.jsView on unpkg · L202

203 display_name: 'A',

204 email_verified: true,

205 repos: ['myrepo'],

206 });

207 });

208 it('falls back to /auth/{repo}/register when the token lacks admin access', async () => {

209 const { fetchImpl, calls } = mockFetch([

210 { match: (u, m) => m === 'POST' && u === adminUrl, status: 403, body: { message: 'forbidden' } },

211 {

212 match: (u, m) => m === 'POST' && u === 'http://test-server:1234/auth/myrepo/register',

213 status: 201,

214 body: {},

215 },

216 ]);

217 await userRegister('a@b.c', { password: 'Secret12345!', repo: 'myrepo' }, fetchImpl);

Medium

Secret Pattern

Hardcoded password in dist/commands/admin-commands.test.js

dist/commands/admin-commands.test.jsView on unpkg · L217

218 expect(calls).toHaveLength(2);

219 expect(calls[1].body).toMatchObject({ email: 'a@b.c', password: 'Secret12345!' });

220 });

221 it('treats 409 as success only with --exists-ok', async () => {

222 const conflict = mockFetch([

223 { match: (u, m) => m === 'POST' && u === adminUrl, status: 409, body: { message: 'EMAIL_EXISTS' } },

224 ]);

225 await expect(userRegister('a@b.c', { password: 'p1234567890!', repo: 'r' }, conflict.fetchImpl)).rejects.toThrow(/already exists/);

226 const conflictOk = mockFetch([

227 { match: (u, m) => m === 'POST' && u === adminUrl, status: 409, body: { message: 'EMAIL_EXISTS' } },

228 ]);

229 await expect(userRegister('a@b.c', { password: 'p1234567890!', repo: 'r', existsOk: true }, conflictOk.fetchImpl)).resolves.toBeUndefined();

230 });

231 it('resolvePassword: requires exactly one source and supports stdin', async () => {

232 await expect(resolvePassword({})).rejects.toThrow(/password is required/i);

233 await expect(resolvePassword({ password: 'a', passwordStdin: true })).rejects.toThrow(/mutually exclusive/);

234 await expect(resolvePassword({ passwordStdin: true }, { readStdinImpl: async () => 'pw\n' })).resolves.toBe('pw');

235 });

236});

237describe('repo create/delete', () => {

219patternName = generic_password severity = medium line = 219 matchedText = expect(c... });

Medium

Secret Pattern

Hardcoded password in dist/commands/admin-commands.test.js

dist/commands/admin-commands.test.jsView on unpkg · L219

225patternName = generic_password severity = medium line = 225 matchedText = await ex...s/);

Medium

Secret Pattern

Hardcoded password in dist/commands/admin-commands.test.js

dist/commands/admin-commands.test.jsView on unpkg · L225

229patternName = generic_password severity = medium line = 229 matchedText = await ex...d();

Medium

Secret Pattern

Hardcoded password in dist/commands/admin-commands.test.js

dist/commands/admin-commands.test.jsView on unpkg · L229