registry  /  @roki-h5/create-roki-app  /  0.1.8

@roki-h5/create-roki-app@0.1.8

Roki H5 项目脚手架

Static Scan Results

scanned 15d ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
FilesystemNetwork
Supply chain
HighEntropyStringsUrlStrings
ManifestNo manifest risk signals triggered.
scanned 29 file(s), 43.5 KB of source, external domains: api-test.myroki.com

Source & flagged code

4 flagged · loading source
templates/h5/config/env/.env.productionView file
•patternName = blocked_file severity = critical matchedText = templates/h5/config/env/.env.production redactedSecretContext = secretLikeLines = 0 notes = no secret-like key/value lines found in sampled text
Critical
Critical Secret

Package contains a critical-looking secret pattern.

templates/h5/config/env/.env.productionView on unpkg
templates/h5/.agents/skills/systematic-debugging/find-polluter.shView file
•path = templates/h5/.agents/skills/systematic-debugging/find-polluter.sh kind = payload_in_excluded_dir sizeBytes = 1528 magicHex = [redacted]
High
Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

templates/h5/.agents/skills/systematic-debugging/find-polluter.shView on unpkg
•path = templates/h5/.agents/skills/systematic-debugging/find-polluter.sh kind = build_helper sizeBytes = 1528 magicHex = [redacted]
Medium
Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/h5/.agents/skills/systematic-debugging/find-polluter.shView on unpkg
templates/h5/src/stores/app.tsView file
41patternName = supabase_service_key severity = critical line = 41 matchedText = 'eyJhbGc...z4',
Critical
Secret Pattern

Supabase service role key (JWT) in templates/h5/src/stores/app.ts

templates/h5/src/stores/app.tsView on unpkg · L41

Findings

2 Critical1 High3 Medium4 Low
CriticalCritical Secrettemplates/h5/config/env/.env.production
CriticalSecret Patterntemplates/h5/src/stores/app.ts
HighPayload In Excluded Dirtemplates/h5/.agents/skills/systematic-debugging/find-polluter.sh
MediumNetwork
MediumShips Build Helpertemplates/h5/.agents/skills/systematic-debugging/find-polluter.sh
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings