registry / @salesforce/ui-bundle-template-cli / 11.14.0

@salesforce/ui-bundle-template-cli@11.14.0

⚠ Under review

CLI tool for applying feature patches to base apps

Static Scan Results

scanned 1h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStrings

Manifest

NoLicense

scanned 22 file(s), 158 KB of source

Source & flagged code

5 flagged

dist/nx-plugin/executors/build-dist-app/executor.jsView file

Lines 1-25javascript

1/**

4 * For full license text, see the LICENSE.txt file

5 */

6import { execSync } from "child_process";

7import { existsSync, readFileSync, readdirSync } from "fs";

High

Child Process

Package source references child process execution.

dist/nx-plugin/executors/build-dist-app/executor.jsView on unpkg · L5

8import { join } from "path";

9import { logger } from "@nx/devkit";

10import { createProjectPaths } from "../utils";

11const NO_PACKAGE_LOCK = "--package-lock=false";

12/**

13 * Discover the workspace-relative paths of every internal @salesforce/* package

14 * under packages/ — both direct packages (packages/ui-bundle) and packages nested

15 * one level inside a sub-collection (packages/sdk/platform-sdk). The template/app/

16 * feature scaffolds under packages/template are excluded automatically: packages/

17 * template has its own (non-@salesforce/) package.json, so it is treated as a

18 * package and never descended into.

19 *

20 * This is dynamic on purpose: a hardcoded list silently goes stale whenever a new

21 * or renamed workspace @salesforce package — or a whole new sub-collection like

22 * sdk — is added, dropping it from the file: overlay. That is exactly what broke

23 * @salesforce/graphiti — every generated app depends on it, but it was missing

24 * from the static list, so during a release or rename window (when the bumped/

25 * renamed version is not yet on the registry) the install could not resolve it.

Lines 150-190javascript

150 }

151 if (!name || !name.startsWith("@salesforce/"))

152 continue;

153 if (!declaredSalesforceDeps.has(name))

154 continue;

155 fileInstalls.push(`${name}@file:${pkgPath

•matchType = previous_version_dangerous_delta matchedPackage = @salesforce/ui-bundle-template-cli@11.13.0 matchedIdentity = npm:[redacted]:11.13.0 similarity = 0.850 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/nx-plugin/executors/build-dist-app/executor.jsView on unpkg

dist/nx-plugin/executors/dev-server/executor.jsView file

Lines 17-57javascript

17 * populated node_modules, otherwise Vite starts against an empty tree.

18 *

19 * @param options - Executor options

20 * @param context - Nx executor context

21 * @returns Async generator yielding executor results

22 */

23export default

dist/core/patch-loader.jsView file

Lines 16-56javascript

16 * Extract patch name from patch path

17 * Examples:

18 * - 'packages/feature-navigation-menu' -> 'feature-navigation-menu'

19 * - '/absolute/path/to/feature-name' -> 'feature-name'

20 *

Source & flagged code

5 flagged · loading source

dist/nx-plugin/executors/build-dist-app/executor.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/nx-plugin/executors/build-dist-app/executor.jsView on unpkg

5*/ L6: import { execSync } from "child_process"; L7: import { existsSync, readFileSync, readdirSync } from "fs";

High

Child Process

Package source references child process execution.

dist/nx-plugin/executors/build-dist-app/executor.jsView on unpkg · L5

170: "Running npm install (no package lock)..."); L171: execSync(`npm install ${installArgs.join(" ")}`, execOptions); L172: // Run GraphQL codegen when a schema is present (e.g. after `graphql:schema`).

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/nx-plugin/executors/build-dist-app/executor.jsView on unpkg · L170

dist/nx-plugin/executors/dev-server/executor.jsView file

37stdio: "inherit", L38: shell: true, L39: env: process.env,

High

Shell

Package source references shell execution.

dist/nx-plugin/executors/dev-server/executor.jsView on unpkg · L37

dist/core/patch-loader.jsView file

36const patchPathUrl = pathToFileURL(patchesFilePath).href; L37: const module = await import(patchPathUrl); L38: // Require default export

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/core/patch-loader.jsView on unpkg · L36

Findings

1 Critical3 High3 Medium4 Low

CriticalPrevious Version Dangerous Deltadist/nx-plugin/executors/build-dist-app/executor.js

HighChild Processdist/nx-plugin/executors/build-dist-app/executor.js

HighShelldist/nx-plugin/executors/dev-server/executor.js

HighRuntime Package Installdist/nx-plugin/executors/build-dist-app/executor.js

MediumDynamic Requiredist/core/patch-loader.js

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowNo License

Source & flagged code

5 flagged

dist/nx-plugin/executors/build-dist-app/executor.jsView file

Lines 1-25javascript

1/**

4 * For full license text, see the LICENSE.txt file

5 */

6import { execSync } from "child_process";

7import { existsSync, readFileSync, readdirSync } from "fs";

High

Child Process

Package source references child process execution.

dist/nx-plugin/executors/build-dist-app/executor.jsView on unpkg · L5

8import { join } from "path";

9import { logger } from "@nx/devkit";

10import { createProjectPaths } from "../utils";

11const NO_PACKAGE_LOCK = "--package-lock=false";

12/**

13 * Discover the workspace-relative paths of every internal @salesforce/* package

14 * under packages/ — both direct packages (packages/ui-bundle) and packages nested

15 * one level inside a sub-collection (packages/sdk/platform-sdk). The template/app/

16 * feature scaffolds under packages/template are excluded automatically: packages/

17 * template has its own (non-@salesforce/) package.json, so it is treated as a

18 * package and never descended into.

19 *

20 * This is dynamic on purpose: a hardcoded list silently goes stale whenever a new

21 * or renamed workspace @salesforce package — or a whole new sub-collection like

22 * sdk — is added, dropping it from the file: overlay. That is exactly what broke

23 * @salesforce/graphiti — every generated app depends on it, but it was missing

24 * from the static list, so during a release or rename window (when the bumped/

25 * renamed version is not yet on the registry) the install could not resolve it.

Lines 150-190javascript

150 }

151 if (!name || !name.startsWith("@salesforce/"))

152 continue;

153 if (!declaredSalesforceDeps.has(name))

154 continue;

155 fileInstalls.push(`${name}@file:${pkgPath

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/nx-plugin/executors/build-dist-app/executor.jsView on unpkg

dist/nx-plugin/executors/dev-server/executor.jsView file

Lines 17-57javascript

17 * populated node_modules, otherwise Vite starts against an empty tree.

18 *

19 * @param options - Executor options

20 * @param context - Nx executor context

21 * @returns Async generator yielding executor results

22 */

23export default

dist/core/patch-loader.jsView file

Lines 16-56javascript

16 * Extract patch name from patch path

17 * Examples:

18 * - 'packages/feature-navigation-menu' -> 'feature-navigation-menu'

19 * - '/absolute/path/to/feature-name' -> 'feature-name'

20 *