registry / @seed-forge/cli / 0.2.4

@seed-forge/cli@0.2.4

SeedForge CLI — seed, generate, validate, suggest, introspect, diff, export, import, reset, doctor, studio

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 8 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

DynamicRequireEnvironmentVarsFilesystem

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 20 file(s), 288 KB of source, external domains: api.deepseek.com, api.openai.com, api.x.ai, openrouter.ai

Source & flagged code

2 flagged

dist/index.jsView file

Lines 4618-4658javascript

4618 case "ollama":

4619 return process.env.OPENAI_API_KEY ?? "";

4620 case "google":

4621 return process.env.GEMINI_API_KEY ?? "";

4622 default:

4623 return "";

4624 }

4625}

4626

4627// src/commands/init.ts

4628import fs from "fs/promises";

4629import path from "path";

4630import { introspect, analyzeSchema, registerIntrospector as registerIntrospector2, printCoverageTable } from "@seed-forge/core";

4631import { input, select, confirm } from "@inquirer/prompts";

4632import pc from "picocolors";

4633

4634// src/utils/adapters.ts

4635import { registerIntrospector } from "@seed-forge/core";

4636async function registerAdapters(dialect) {

4637 switch (dialect) {

4638 case "postgres": {

4639 const mod = await import("@seed-forge/adapter-postgres");

4640 registerIntrospector("postgres", { introspect: mod.introspect });

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L4638

4641 break;

4642 }

4643 case "mysql": {

4644 const mod = await import("@seed-forge/adapter-mysql");

4645 registerIntrospector("mysql", { introspect: mod.introspect });

4646 break;

4647 }

4648 case "mongodb": {

4649 const mod = await import("@seed-forge/adapter-mongodb");

4650 registerIntrospector("mongodb", { introspect: mod.introspect });

4651 break;

4652 }

4653 case "prisma": {

4654 const mod = await import("@seed-forge/adapter-prisma");

4655 registerIntrospector("prisma", { introspect: mod.introspect });

4656 break;

4657 }

4658 case "drizzle": {

src/commands/doctor.tsView file

Lines 1-22typescript

1import fs from 'node:fs/promises';

2import path from 'node:path';

3import { readLockfile, resolveLockfilePath, validateConfig } from '@seed-forge/core';

4import { loadConfig, inferConnectConfig } from '../utils/config.js';

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

src/commands/doctor.tsView on unpkg · L2

Source & flagged code

2 flagged · loading source

dist/index.jsView file

4638case "postgres": { L4639: const mod = await import("@seed-forge/adapter-postgres"); L4640: registerIntrospector("postgres", { introspect: mod.introspect });

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L4638

src/commands/doctor.tsView file

2package = @seed-forge/cli; repositoryIdentity = seedforge; dependency = @seed-forge/core L2: import path from 'node:path'; L3: import { readLockfile, resolveLockfilePath, validateConfig } from '@seed-forge/core'; L4: import { loadConfig, inferConnectConfig } from '../utils/config.js';

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

src/commands/doctor.tsView on unpkg · L2

Findings

1 High3 Medium4 Low

HighCopied Package Dependency Bridgesrc/commands/doctor.ts

MediumDynamic Requiredist/index.js

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

dist/index.jsView file

Lines 4618-4658javascript

4618 case "ollama":

4619 return process.env.OPENAI_API_KEY ?? "";

4620 case "google":

4621 return process.env.GEMINI_API_KEY ?? "";

4622 default:

4623 return "";

4624 }

4625}

4626

4627// src/commands/init.ts

4628import fs from "fs/promises";

4629import path from "path";

4630import { introspect, analyzeSchema, registerIntrospector as registerIntrospector2, printCoverageTable } from "@seed-forge/core";

4631import { input, select, confirm } from "@inquirer/prompts";

4632import pc from "picocolors";

4633

4634// src/utils/adapters.ts

4635import { registerIntrospector } from "@seed-forge/core";

4636async function registerAdapters(dialect) {

4637 switch (dialect) {

4638 case "postgres": {

4639 const mod = await import("@seed-forge/adapter-postgres");

4640 registerIntrospector("postgres", { introspect: mod.introspect });

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L4638

4641 break;

4642 }

4643 case "mysql": {

4644 const mod = await import("@seed-forge/adapter-mysql");

4645 registerIntrospector("mysql", { introspect: mod.introspect });

4646 break;

4647 }

4648 case "mongodb": {

4649 const mod = await import("@seed-forge/adapter-mongodb");

4650 registerIntrospector("mongodb", { introspect: mod.introspect });

4651 break;

4652 }

4653 case "prisma": {

4654 const mod = await import("@seed-forge/adapter-prisma");

4655 registerIntrospector("prisma", { introspect: mod.introspect });

4656 break;

4657 }

4658 case "drizzle": {

src/commands/doctor.tsView file

Lines 1-22typescript

1import fs from 'node:fs/promises';

2import path from 'node:path';

3import { readLockfile, resolveLockfilePath, validateConfig } from '@seed-forge/core';

4import { loadConfig, inferConnectConfig } from '../utils/config.js';

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

src/commands/doctor.tsView on unpkg · L2