registry / @salesforce/ui-bundle-template-cli / 11.4.6

@salesforce/ui-bundle-template-cli@11.4.6

CLI tool for applying feature patches to base apps

Static Scan Results

scanned 8d ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStrings

Manifest

NoLicense

scanned 22 file(s), 155 KB of source

Source & flagged code

4 flagged

dist/nx-plugin/executors/build-dist-app/executor.jsView file

Lines 1-25javascript

1/**

4 * For full license text, see the LICENSE.txt file

5 */

6import { execSync } from "child_process";

7import { existsSync, readFileSync } from "fs";

High

Child Process

Package source references child process execution.

dist/nx-plugin/executors/build-dist-app/executor.jsView on unpkg · L5

8import { join } from "path";

9import { logger } from "@nx/devkit";

10import { createProjectPaths } from "../utils";

11const NO_PACKAGE_LOCK = "--package-lock=false";

12/** Workspace-relative paths for internal @salesforce packages to install from file (not template/app/feature packages). */

13const INTERNAL_PACKAGE_PATHS = [

14 "packages/sdk/platform-sdk-core",

15 "packages/sdk/platform-sdk-data",

16 "packages/sdk/platform-sdk-chat",

17 "packages/sdk/platform-sdk-lightning",

18 "packages/sdk/platform-sdk-view",

19 "packages/ui-bundle",

20 "packages/ui-design-mode",

21 "packages/vite-plugin-ui-bundle",

22 "packages/agentforceConversationClient",

23];

24/**

25 * Nx executor for building the application in the dist folder

Lines 65-105javascript

65 catch {

66 continue;

67 }

68 if (!name || !name.startsWith("@salesforce/"))

69 continue;

70 fileInstalls.push(`${name}@file:${pkgPath}`);

dist/nx-plugin/executors/dev-server/executor.jsView file

Lines 14-54javascript

14 * It runs npm install first, then starts the dev server asynchronously.

15 *

16 * @param options - Executor options

17 * @param context - Nx executor context

18 * @returns Async generator yielding executor results

19 */

20export default

dist/core/patch-loader.jsView file

Lines 16-56javascript

16 * Extract patch name from patch path

17 * Examples:

18 * - 'packages/feature-navigation-menu' -> 'feature-navigation-menu'

19 * - '/absolute/path/to/feature-name' -> 'feature-name'

20 *

Source & flagged code

4 flagged · loading source

dist/nx-plugin/executors/build-dist-app/executor.jsView file

5*/ L6: import { execSync } from "child_process"; L7: import { existsSync, readFileSync } from "fs";

High

Child Process

Package source references child process execution.

dist/nx-plugin/executors/build-dist-app/executor.jsView on unpkg · L5

85: "Running npm install (no package lock)..."); L86: execSync(`npm install ${installArgs.join(" ")}`, execOptions); L87: // Lint the dist app before building to catch issues early

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/nx-plugin/executors/build-dist-app/executor.jsView on unpkg · L85

dist/nx-plugin/executors/dev-server/executor.jsView file

34stdio: "inherit", L35: shell: true, L36: env: process.env,

High

Shell

Package source references shell execution.

dist/nx-plugin/executors/dev-server/executor.jsView on unpkg · L34

dist/core/patch-loader.jsView file

36const patchPathUrl = pathToFileURL(patchesFilePath).href; L37: const module = await import(patchPathUrl); L38: // Require default export

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/core/patch-loader.jsView on unpkg · L36

Findings

3 High3 Medium4 Low

HighChild Processdist/nx-plugin/executors/build-dist-app/executor.js

HighShelldist/nx-plugin/executors/dev-server/executor.js

HighRuntime Package Installdist/nx-plugin/executors/build-dist-app/executor.js

MediumDynamic Requiredist/core/patch-loader.js

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowNo License

Source & flagged code

4 flagged

dist/nx-plugin/executors/build-dist-app/executor.jsView file

Lines 1-25javascript

1/**

4 * For full license text, see the LICENSE.txt file

5 */

6import { execSync } from "child_process";

7import { existsSync, readFileSync } from "fs";

High

Child Process

Package source references child process execution.

dist/nx-plugin/executors/build-dist-app/executor.jsView on unpkg · L5

8import { join } from "path";

9import { logger } from "@nx/devkit";

10import { createProjectPaths } from "../utils";

11const NO_PACKAGE_LOCK = "--package-lock=false";

12/** Workspace-relative paths for internal @salesforce packages to install from file (not template/app/feature packages). */

13const INTERNAL_PACKAGE_PATHS = [

14 "packages/sdk/platform-sdk-core",

15 "packages/sdk/platform-sdk-data",

16 "packages/sdk/platform-sdk-chat",

17 "packages/sdk/platform-sdk-lightning",

18 "packages/sdk/platform-sdk-view",

19 "packages/ui-bundle",

20 "packages/ui-design-mode",

21 "packages/vite-plugin-ui-bundle",

22 "packages/agentforceConversationClient",

23];

24/**

25 * Nx executor for building the application in the dist folder

Lines 65-105javascript

65 catch {

66 continue;

67 }

68 if (!name || !name.startsWith("@salesforce/"))

69 continue;

70 fileInstalls.push(`${name}@file:${pkgPath}`);

dist/nx-plugin/executors/dev-server/executor.jsView file

Lines 14-54javascript

14 * It runs npm install first, then starts the dev server asynchronously.

15 *

16 * @param options - Executor options

17 * @param context - Nx executor context

18 * @returns Async generator yielding executor results

19 */

20export default

dist/core/patch-loader.jsView file

Lines 16-56javascript

16 * Extract patch name from patch path

17 * Examples:

18 * - 'packages/feature-navigation-menu' -> 'feature-navigation-menu'

19 * - '/absolute/path/to/feature-name' -> 'feature-name'

20 *