registry / @ruan-cat/vercel-deploy-tool / 2.0.1

@ruan-cat/vercel-deploy-tool@2.0.1

阮喵喵自用的vercel部署工具，用于实现复杂项目的部署。

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 8 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 26 file(s), 101 KB of source

Source & flagged code

3 flagged

dist/index.jsView file

Lines 98-138javascript

98 * 部署后提供干净的链接

99 * @see https://vercel.com/docs/projects/project-configuration#cleanurls

100 *

101 * @description

102 * 暂无效果

103 *

104 * 目前在 build

Source & flagged code

3 flagged · loading source

dist/index.jsView file

118// src/core/vercel.ts L119: import { spawnSync } from "child_process"; L120: import { consola as consola2 } from "consola";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L118

331stdio: "inherit", L332: shell: true L333: });

High

Shell

Package source references shell execution.

dist/index.jsView on unpkg · L331

src/core/vercel.tsView file

88export function assertVercelCliAvailable(): void { L89: const result = spawnSync("vercel", ["--version"], createVercelSpawnOptions("pipe")); L90: ... L92: throw new Error( L93: `未找到 Vercel CLI。@ruan-cat/vercel-deploy-tool 已将 vercel 改为 peerDependency，请在使用方项目中安装：pnpm add -D vercel@latest`, L94: );

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/core/vercel.tsView on unpkg · L88

Findings

3 High2 Medium3 Low

HighChild Processdist/index.js

HighShelldist/index.js

HighRuntime Package Installsrc/core/vercel.ts

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

Lines 311-351javascript

311import { isUndefined as isUndefined2, isEmpty } from "lodash-es";

312function createAfterBuildTasks(config) {

313 const afterBuildTasks = config.afterBuildTasks;

314 if (isUndefined2(afterBuildTasks) || isEmpty(afterBuildTasks)) {

315 return [

316 {

317 name: "AfterBuild: \u65E0\u4EFB\u52A1",

318 fn: async () => {

319 consola6.warn("\u5F53\u524D\u6CA1\u6709\u6709\u610F\u4E49\u7684 afterBuildTasks \u4EFB\u52A1\u914D\u7F6E");

320 return void 0;

321 }

322 }

323 ];

324 }

325 return afterBuildTasks.map((command) => ({

326 name: `AfterBuild: ${command}`,

327 fn: async () => {

328 consola6.start(`\u5F00\u59CB afterBuild \u4EFB\u52A1: ${command}`);

329 const result = spawnSync5(command, [], {

330 encoding: "utf-8",

331 stdio: "inherit",

332 shell: true

333 });

High

Shell

Package source references shell execution.

dist/index.jsView on unpkg · L331

334 if (result.error) {

335 consola6.error(`afterBuild \u4EFB\u52A1\u5931\u8D25: ${command}`);

336 throw result.error;

337 }

338 consola6.success(`\u5B8C\u6210 afterBuild \u4EFB\u52A1: ${command}`);

339 return result.stdout;

340 }

341 }));

342}

343

344// src/core/tasks/user-commands.ts

345import { spawnSync as spawnSync6 } from "child_process";

346import { consola as consola7 } from "consola";

347function createUserCommandTasks(target) {

348 return target.userCommands.map((command) => ({

349 name: `UserCommand: ${command}`,

350 fn: async () => {

351 consola7.start(`\u5F00\u59CB\u7528\u6237\u547D\u4EE4\u4EFB\u52A1: ${command}`);

src/core/vercel.tsView file

Lines 68-108typescript

69function compareSemverLike(current: string, expected: string): number {

70 const currentParts = current.split(/[.-]/).slice(0, 3).map(Number);

71 const expectedParts = expected.split(/[.-]/).slice(0, 3).map(Number);

73 for (let index = 0; index < 3; index++) {

74 const currentPart = currentParts[index] ?? 0;

75 const expectedPart = expectedParts[index] ?? 0;

77 if (currentPart > expectedPart) return 1;

78 if (currentPart < expectedPart) return -1;

79 }

81 return 0;

82}

84export function isVercelCliVersionSupported(version: string): boolean {

85 return compareSemverLike(version, MIN_VERCEL_CLI_VERSION) >= 0;

86}

88export function assertVercelCliAvailable(): void {

89 const result = spawnSync("vercel", ["--version"], createVercelSpawnOptions("pipe"));

91 if (result.error) {

92 throw new Error(

93 `未找到 Vercel CLI。@ruan-cat/vercel-deploy-tool 已将 vercel 改为 peerDependency，请在使用方项目中安装：pnpm add -D vercel@latest`,

94 );

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/core/vercel.tsView on unpkg · L88

95 }

97 if (result.status !== 0) {

98 throw new Error("无法读取 Vercel CLI 版本，请确认项目中已安装可用的 vercel CLI。");

99 }

100

101 const output = String(result.stdout ?? "");

102 const version = parseVercelCliVersion(output);

103

104 if (!version) {

105 consola.warn(`无法解析 Vercel CLI 版本，原始输出为: ${output.trim()}`);

106 return;

107 }

108