registry / @runwisp/pubv / 1.4.2

@runwisp/pubv@1.4.2

Automate releases from your Keep a Changelog CHANGELOG.md: bump the version, update the changelog, then commit, tag, and push in one command. A tiny, zero-config release CLI for GitHub, GitLab, and Bitbucket.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsNetwork

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 37.1 KB of source, external domains: github.com

Source & flagged code

3 flagged

dist/bin.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2var l1=Object.create;var{getPrototypeOf:i1,defineProperty:A1,getOwnPropertyNames:a1}=Object;var p1=Object.prototype.hasOwnProperty;function n1($){return this[$]}var o1,r1,h=($,b,x)=>{var Y=$!=null&&typeof $==="object";if(Y){var A=b?o1??=new WeakMap:r1??=new WeakMap,W=A.get($);if(W)return W}x=$!=null?l1(i1($)):{};let J=b||!$||!$.__esModule?A1(x,"default",{value:$,enumerable:!0}):x;for(let X of a1($))if(!p1.call(J,X))A1(J,X,{get:n1.bind($,X),enumerable:!0});if(Y)A.set($,J);return J};var e1=($,b)=>()=>(b||$((b={exports:{}}).exports,b),b.exports);var k=e1((Ib,g)=>{var P=process||{},M1=P.argv||[],E ...

3`).map((Y)=>Y.trim()).filter(Boolean)},async firstCommit(){return(await b(["rev-list","--max-parents=0","HEAD"])).trim().split(`

High

Child Process

Package source references child process execution.

dist/bin.jsView on unpkg · L1

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/bin.jsView on unpkg · L1

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/bin.jsView on unpkg · L1

4`)[0]},async stage(x){await b(["add","--",x])},async commit(x,Y){let A=["commit"];if(Y?.sign)A.push("-S");A.push("-m",x),await b(A)},async tag(x,Y,A){await b(["tag",A?.sign?"-s":"-a",x,"-m",Y])},async push(x,Y,A){let W=["push"];if(A.followTags)W.push("--follow-tags");if(A.setUpstream)W.push("-u");W.push(x,Y),await b(W)},async createBranch(x){await b(["switch","-c",x])},async switchBranch(x){await b(["switch",x])},async pushTag(x,Y){await b(["push",x,Y])}}}function Z$($,b){return new Promise((x,Y)=>{let A=D$("git",$,{cwd:b,stdio:["ignore","pipe","pipe"],env:{...process.env,GIT_TERMINAL_PROMPT:" ...

5`);return{banner(A,W){Y(),Y(`${I}${S.default.bold(S.default.cyan(A))} ${S.default.dim(`v${W}`)}`)},section(A){let W=S

6`)};return{succeed:(Z)=>D(Y.ok,Z),fail:(Z)=>D(Y.fail,Z),stop:()=>{if(W)return;W=!0,clearInterval(X),b.write("\r\x1B[2K")}}}function U$($,b,x){let Y=!1,A=(W,J)=>{if(Y)return;Y=!0,b(`${I}${W} ${J??$}`)};return{succeed:(W)=>A(x.ok,W),fail:(W)=>A(x.fail,W),stop:()=>{Y=!0}}}var C=h(k(),1);import{createInterface as I$,emitKeypressEvents as _$}from"node:readline";var T=" ";function C1($){return{async confirm(b,x){let Y=x?C.default.dim("[Y/n]"):C.default.dim("[y/N]"),A=(await v($,`${T}${C.default.bold("?")} ${b} ${Y} ${C.default.cyan("›")} `)).trim().toLowerCase();if(!A)return x;return A==="y"||A===" ...

7`);let Z=(F,_)=>{if(!_)J.write(`\x1B[${X.length}A`);X.forEach((K,y)=>{let U=y===F,m=U?C.default.cyan("❯"):" ",q=K.kind==="custom"?C.default.italic(A.label):`${C.default.bold(O1(K.key))} ${C.default.dim(K.label)

8`)})};_$(W);let z=W.isRaw??!1;W.setRawMode?.(!0),W.resume();let G=D;Z(G,!0);let O=await new Promise((F)=>{let _=(y,U)=>{if

9`),process.exit(130)},K=()=>{W.removeListener("keypress",_),W.setRawMode?.(z),W.pause()};W.on("keypress",_)}),Q=X[O];if(Q.kind==="custom")return await F1($,A);return Q.key}

10`),J.forEach((O,Q)=>{let F=Q===X?C.default.cyan("●"):C.default.dim("○"),_=O.kind==="custom"?C.default.italic(A.label):`${C.default.bold

11`)});let D=C.default.dim(`[${X+1}]`),Z=(await v($,`${T}${C.default.cyan("›")} ${D} `)).trim(),z=X;if(Z){let O=Number.

12`)}}var d=/^\[([^\]]+)\]:\s*(.+?)\s*$/,f=/^##\s+\[([^\]]+)\](?:\s*-\s*([0-9]{4}-[0-9]

13`)?`\r

14`:`

15`,x=$.split(/\r?\n/);if(x.length>0&&x[x.length-1]==="")x.pop();let{mainLines:Y,links:A,dropped:W}=L$(x),{header:J,sections:X}=V$(Y),{links:D,collapsed

16`)}

17`}function P$($){let b=$.trim(),x=/^[^@]+@([^:]+):(.+?)(?:\.git)?\/?$/.exec(b);if(x)return`https://${x[1]}/${V1(x

18`)??"",J=q1(W),X=Y?.prerelease&&A.prerelease?"prerelease":J,D=Y?A[X]:"0.1.0";return{last:b?.version??null,lastSemver:Y,defaultKind:X,defaultVersion:D,candidates:A}}function l$($){return["major","minor","patch","prerelease"].filter((x)=>$.candidates[x]!==void 0)}async function k1($,b,x,Y){if($.tagPrefixOverride!==null)return $.tagPrefixOverride;if(x!==null)return x;let A=r(b);if(A.kind==="unique")return A.prefix;if($.yes)return"v";return await Y.select(A.kind==="none"?"no existing tags. tag prefix?":"mixed prefixed/bare tags. which to use?",[{key:"v",label:"v1.2.3"},{key:"",label:"1.2.3 (no pre ...

19`)});if(W.created)A.succeed(W.url?`release created: ${W.url}`:"release created");else A.stop(),Y.warn(`release not created (${W.reason??"unknown"})`)}async function $b($,b,x){let

20 ${$("pubv")} ${b("— graduate [Unreleased] into a release commit + tag")}

Long lines were clipped for display.

Source & flagged code

3 flagged · loading source

dist/bin.jsView file

1#!/usr/bin/env node L2: var l1=Object.create;var{getPrototypeOf:i1,defineProperty:A1,getOwnPropertyNames:a1}=Object;var p1=Object.prototype.hasOwnProperty;function n1($){return this[$]}var o1,r1,h=($,b,x)... L3: `).map((Y)=>Y.trim()).filter(Boolean)},async firstCommit(){return(await b(["rev-list","--max-parents=0","HEAD"])).trim().split(`

High

Child Process

Package source references child process execution.

dist/bin.jsView on unpkg · L1

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/bin.jsView on unpkg · L1

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/bin.jsView on unpkg · L1

Findings

3 High3 Medium4 Low

HighChild Processdist/bin.js

HighSame File Env Network Executiondist/bin.js

HighCommand Output Exfiltrationdist/bin.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

dist/bin.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

3`).map((Y)=>Y.trim()).filter(Boolean)},async firstCommit(){return(await b(["rev-list","--max-parents=0","HEAD"])).trim().split(`

High

Child Process

Package source references child process execution.

dist/bin.jsView on unpkg · L1

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/bin.jsView on unpkg · L1

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/bin.jsView on unpkg · L1

5`);return{banner(A,W){Y(),Y(`${I}${S.default.bold(S.default.cyan(A))} ${S.default.dim(`v${W}`)}`)},section(A){let W=S

8`)})};_$(W);let z=W.isRaw??!1;W.setRawMode?.(!0),W.resume();let G=D;Z(G,!0);let O=await new Promise((F)=>{let _=(y,U)=>{if

9`),process.exit(130)},K=()=>{W.removeListener("keypress",_),W.setRawMode?.(z),W.pause()};W.on("keypress",_)}),Q=X[O];if(Q.kind==="custom")return await F1($,A);return Q.key}

10`),J.forEach((O,Q)=>{let F=Q===X?C.default.cyan("●"):C.default.dim("○"),_=O.kind==="custom"?C.default.italic(A.label):`${C.default.bold

11`)});let D=C.default.dim(`[${X+1}]`),Z=(await v($,`${T}${C.default.cyan("›")} ${D} `)).trim(),z=X;if(Z){let O=Number.

12`)}}var d=/^\[([^\]]+)\]:\s*(.+?)\s*$/,f=/^##\s+\[([^\]]+)\](?:\s*-\s*([0-9]{4}-[0-9]

13`)?`\r

14`:`

15`,x=$.split(/\r?\n/);if(x.length>0&&x[x.length-1]==="")x.pop();let{mainLines:Y,links:A,dropped:W}=L$(x),{header:J,sections:X}=V$(Y),{links:D,collapsed

16`)}

17`}function P$($){let b=$.trim(),x=/^[^@]+@([^:]+):(.+?)(?:\.git)?\/?$/.exec(b);if(x)return`https://${x[1]}/${V1(x

19`)});if(W.created)A.succeed(W.url?`release created: ${W.url}`:"release created");else A.stop(),Y.warn(`release not created (${W.reason??"unknown"})`)}async function $b($,b,x){let

20 ${$("pubv")} ${b("— graduate [Unreleased] into a release commit + tag")}

Long lines were clipped for display.