registry / @reddoorla/maintenance / 0.67.0

@reddoorla/maintenance@0.67.0

Canonical maintenance configs, audits, and recipes for the reddoor stack.

Static Scan Results

scanned 3d ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 86 file(s), 412 KB of source, external domains: api.github.com, api.netlify.com, content.airtable.com, developer.chrome.com, docs.renovatebot.com, github.com, images.prismic.io, player.vimeo.com, reddoor-maintenance.netlify.app, searchconsole.googleapis.com, static.cdn.prismic.io, www.googleapis.com, x.invalid

Source & flagged code

4 flagged

dist/chunk-ZO7WNY57.jsView file

Lines 84-124javascript

84 return source.slice(0, m.index) + source.slice(tailIdx).replace(new RegExp(`^${indent}\\n`), "");

85}

86async function migrateSvelteConfig(cwd) {

87 const path = join2(cwd, "svelte.config.js");

88 let src;

89 try {

90 src = await readFile(path, "utf-8");

91 } catch {

92 return false;

93 }

94 let next = src;

95 next = dropPreprocessKey(next);

96 next = dropVitePreprocessImport(next);

97 if (next === src) return false;

98 await writeFile(path, next, "utf-8");

99 return true;

100}

101

102// src/recipes/svelte-5/step-svelte-migrate.ts

103async function runSvelteMigrate(cwd, spawn = defaultSpawn) {

104 try {

105 const { code, stderr } = await spawn(

106 "npx",

High

Child Process

Package source references child process execution.

dist/chunk-ZO7WNY57.jsView on unpkg · L104

107 ["--yes", "svelte-migrate", "svelte-5", "--no-install"],

108 { cwd, timeoutMs: 5 * 6e4 }

109 );

110 if (code !== 0) {

111 return { ran: false, stderr };

112 }

113 return { ran: true, stderr };

114 } catch (err) {

115 const e = err;

116 if (e.code === "ENOENT" || /ENOENT/.test(String(err))) {

117 return { ran: false, stderr: "npx unavailable" };

118 }

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/chunk-ZO7WNY57.jsView on unpkg · L104

119 throw err;

120 }

121}

122

123// src/recipes/svelte-5/step-tailwind-upgrade.ts

124import { join as join3 } from "path";

dist/chunk-7MJJEEII.jsView file

Lines 11-51javascript

11import { resolve, extname } from "path";

12function sanitizeDynamicSites(sites) {

13 return sites.map((s) => {

14 if (s.deployedUrl !== void 0 && !isHttpUrl

dist/chunk-SYTPVYIK.jsView file

Lines 14-54javascript

14 "Domain, DNS & SSL",

15 "Google Indexed",

16 "Security Updates",

17 "Uptime Checked"

18 ],

19 testingIntro: "Testing includes checks similar to those at launch: testing on common browsers and operating systems, at different screen sizes, and checking every function, and updating all packages for performance rather than just those needed for security.",

20 testingChecklist: [

Source & flagged code

4 flagged · loading source

dist/chunk-ZO7WNY57.jsView file

104try { L105: const { code, stderr } = await spawn( L106: "npx",

High

Child Process

Package source references child process execution.

dist/chunk-ZO7WNY57.jsView on unpkg · L104

104try { L105: const { code, stderr } = await spawn( L106: "npx", ... L116: if (e.code === "ENOENT" || /ENOENT/.test(String(err))) { L117: return { ran: false, stderr: "npx unavailable" }; L118: }

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/chunk-ZO7WNY57.jsView on unpkg · L104

dist/chunk-7MJJEEII.jsView file

31if (input.fleet === "airtable") { L32: const { openBase, readAirtableConfig } = await import("./client-EPVO3FEH.js"); L33: const { fromAirtableBase } = await import("./airtable-33SY2UBZ.js");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/chunk-7MJJEEII.jsView on unpkg · L31

dist/chunk-SYTPVYIK.jsView file

34launchHeading: "LAUNCHED", L35: launchBody: "Your site is live. We've set it up on the Reddoor stack with hosting, security, and automatic maintenance so it stays fast and healthy. Here's what's in place:", L36: launchSetupItems: [ ... L174: <mj-text color="${RED}" font-size="20px" font-weight="700" padding-top="${labelTop}">LIGHTHOUSE SCORES*</mj-text>${rows} L175: <mj-text color="${GREY}" font-family="helvetica, sans-serif" font-size="12px" font-weight="300" padding-top="24px" padding-bottom="${footnoteBottom}" line-height="20px">*A Lighthou... L176: </mj-column> ... L549: const start = bytes[0] === 239 && bytes[1] === 187 && bytes[2] === 191 ? 3 : 0; L550: const head = Buffer.from(bytes.slice(start, start + 64)).toString("ascii").replace(/^[\s]+/, "").toLowerCase(); L551: return head.startsWith("<!doctype html") || head.startsWith("<html") || head.startsWith("<head"); ... L571: async function uploadAttachment(recordId, fieldName, body, filename, contentType) { L572: const apiKey = process.env.AIRTABLE_PAT; L573: const baseId = process.env.AIRTABLE_BASE_ID;

High

Credential Exfiltration

Source combines credential-like environment material and outbound requests; review data flow before blocking.

dist/chunk-SYTPVYIK.jsView on unpkg · L34

Findings

4 High4 Medium5 Low

HighChild Processdist/chunk-ZO7WNY57.js

HighShell

HighCredential Exfiltrationdist/chunk-SYTPVYIK.js

HighRuntime Package Installdist/chunk-ZO7WNY57.js

MediumDynamic Requiredist/chunk-7MJJEEII.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

dist/chunk-ZO7WNY57.jsView file

Lines 84-124javascript

84 return source.slice(0, m.index) + source.slice(tailIdx).replace(new RegExp(`^${indent}\\n`), "");

85}

86async function migrateSvelteConfig(cwd) {

87 const path = join2(cwd, "svelte.config.js");

88 let src;

89 try {

90 src = await readFile(path, "utf-8");

91 } catch {

92 return false;

93 }

94 let next = src;

95 next = dropPreprocessKey(next);

96 next = dropVitePreprocessImport(next);

97 if (next === src) return false;

98 await writeFile(path, next, "utf-8");

99 return true;

100}

101

102// src/recipes/svelte-5/step-svelte-migrate.ts

103async function runSvelteMigrate(cwd, spawn = defaultSpawn) {

104 try {

105 const { code, stderr } = await spawn(

106 "npx",

High

Child Process

Package source references child process execution.

dist/chunk-ZO7WNY57.jsView on unpkg · L104

107 ["--yes", "svelte-migrate", "svelte-5", "--no-install"],

108 { cwd, timeoutMs: 5 * 6e4 }

109 );

110 if (code !== 0) {

111 return { ran: false, stderr };

112 }

113 return { ran: true, stderr };

114 } catch (err) {

115 const e = err;

116 if (e.code === "ENOENT" || /ENOENT/.test(String(err))) {

117 return { ran: false, stderr: "npx unavailable" };

118 }

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/chunk-ZO7WNY57.jsView on unpkg · L104

119 throw err;

120 }

121}

122

123// src/recipes/svelte-5/step-tailwind-upgrade.ts

124import { join as join3 } from "path";

dist/chunk-7MJJEEII.jsView file

Lines 11-51javascript

11import { resolve, extname } from "path";

12function sanitizeDynamicSites(sites) {

13 return sites.map((s) => {

14 if (s.deployedUrl !== void 0 && !isHttpUrl

dist/chunk-SYTPVYIK.jsView file

Lines 14-54javascript

14 "Domain, DNS & SSL",

15 "Google Indexed",

16 "Security Updates",

17 "Uptime Checked"

18 ],

20 testingChecklist: [