registry / @ruan-cat/vercel-deploy-tool / 2.0.1

@ruan-cat/vercel-deploy-tool@2.0.1

阮喵喵自用的vercel部署工具，用于实现复杂项目的部署。

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 8 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 26 file(s), 101 KB of source

Source & flagged code

3 flagged

dist/index.jsView file

Lines 98-138javascript

98 * 部署后提供干净的链接

99 * @see https://vercel.com/docs/projects/project-configuration#cleanurls

100 *

101 * @description

102 * 暂无效果

103 *

104 * 目前在 build-output-api 中，实现cleanUrls需要手动地写入配置文件

105 *

106 * 成本较大，目前不做投入。

107 */

108 cleanUrls: true,

109 git: {

110 deploymentEnabled: {

111 main: false

112 }

113 }

114};

115var VERCEL_NULL_CONFIG_PATH = "./vercel.null.def.json";

116var VERCEL_OUTPUT_STATIC = ".vercel/output/static";

117

118// src/core/vercel.ts

119import { spawnSync } from "child_process";

120import { consola as consola2 } from "consola";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L118

121var MIN_VERCEL_CLI_VERSION = "47.2.2";

122function getVercelProjectNameArg(config) {

123 return ["--project", config.vercelProjectName];

124}

125function getVercelScopeArg(config) {

126 return ["--scope", config.vercelOrgId];

127}

128function getVercelTokenArg(config) {

129 return ["--token", config.vercelToken];

130}

131function getVercelLocalConfigArg() {

132 return ["--local-config", VERCEL_NULL_CONFIG_PATH];

133}

134function getTargetCWDArg(target) {

135 return ["--cwd", target.targetCWD];

136}

137function createVercelSpawnOptions(stdoutMode = "inherit") {

138 const base = {

Lines 311-351javascript

311import { isUndefined as isUndefined2, isEmpty } from "lodash-es";

312function createAfterBuildTasks(config) {

313 const afterBuildTasks = config.afterBuildTasks;

314 if (isUndefined2(afterBuildTasks) || isEmpty(afterBuildTasks)) {

315 return [

316 {

src/core/vercel.tsView file

Lines 68-108typescript

69function compareSemverLike(current: string, expected: string): number {

70 const currentParts = current.split(/[.-]/).slice(0, 3).

Source & flagged code

3 flagged · loading source

dist/index.jsView file

118// src/core/vercel.ts L119: import { spawnSync } from "child_process"; L120: import { consola as consola2 } from "consola";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L118

331stdio: "inherit", L332: shell: true L333: });

High

Shell

Package source references shell execution.

dist/index.jsView on unpkg · L331

src/core/vercel.tsView file

88export function assertVercelCliAvailable(): void { L89: const result = spawnSync("vercel", ["--version"], createVercelSpawnOptions("pipe")); L90: ... L92: throw new Error( L93: `未找到 Vercel CLI。@ruan-cat/vercel-deploy-tool 已将 vercel 改为 peerDependency，请在使用方项目中安装：pnpm add -D vercel@latest`, L94: );

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/core/vercel.tsView on unpkg · L88

Findings

3 High2 Medium3 Low

HighChild Processdist/index.js

HighShelldist/index.js

HighRuntime Package Installsrc/core/vercel.ts

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

Source & flagged code

3 flagged

dist/index.jsView file

Lines 98-138javascript

98 * 部署后提供干净的链接

99 * @see https://vercel.com/docs/projects/project-configuration#cleanurls

100 *

101 * @description

102 * 暂无效果

103 *

104 * 目前在 build-output-api 中，实现cleanUrls需要手动地写入配置文件

105 *

106 * 成本较大，目前不做投入。

107 */

108 cleanUrls: true,

109 git: {

110 deploymentEnabled: {

111 main: false

112 }

113 }

114};

115var VERCEL_NULL_CONFIG_PATH = "./vercel.null.def.json";

116var VERCEL_OUTPUT_STATIC = ".vercel/output/static";

117

118// src/core/vercel.ts

119import { spawnSync } from "child_process";

120import { consola as consola2 } from "consola";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L118

121var MIN_VERCEL_CLI_VERSION = "47.2.2";

122function getVercelProjectNameArg(config) {

123 return ["--project", config.vercelProjectName];

124}

125function getVercelScopeArg(config) {

126 return ["--scope", config.vercelOrgId];

127}

128function getVercelTokenArg(config) {

129 return ["--token", config.vercelToken];

130}

131function getVercelLocalConfigArg() {

132 return ["--local-config", VERCEL_NULL_CONFIG_PATH];

133}

134function getTargetCWDArg(target) {

135 return ["--cwd", target.targetCWD];

136}

137function createVercelSpawnOptions(stdoutMode = "inherit") {

138 const base = {

Lines 311-351javascript

311import { isUndefined as isUndefined2, isEmpty } from "lodash-es";

312function createAfterBuildTasks(config) {

313 const afterBuildTasks = config.afterBuildTasks;

314 if (isUndefined2(afterBuildTasks) || isEmpty(afterBuildTasks)) {

315 return [

316 {

src/core/vercel.tsView file

Lines 68-108typescript

69function compareSemverLike(current: string, expected: string): number {

70 const currentParts = current.split(/[.-]/).slice(0, 3).