registry / @seed-forge/cli / 0.2.6

@seed-forge/cli@0.2.6

SeedForge CLI — seed, generate, validate, suggest, introspect, diff, export, import, reset, doctor, studio

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 38 file(s), 511 KB of source, external domains: api.deepseek.com, api.openai.com, api.x.ai, openrouter.ai, registry.dev

Source & flagged code

2 flagged

dist/chunk-QEQC23Q3.jsView file

Lines 1-39javascript

1// src/utils/config.ts

2import { createJiti } from "jiti";

3import path from "path";

4import fs from "fs/promises";

5async function loadConfig(configPath) {

6 const resolved = path.resolve(configPath ?? "seedforge.config.ts");

7 try {

8 await fs.access(resolved);

9 } catch {

10 return { connection: {}, tables: {} };

11 }

12 if (resolved.endsWith(".json")) {

13 const content = await fs.readFile(resolved, "utf-8");

14 return JSON.parse(content);

15 }

16 const jiti = createJiti(process.cwd(), {

17 interopDefault: true,

18 moduleCache: false

19 });

20 const mod = await jiti.import(resolved);

21 const config = mod.default ?? mod;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/chunk-QEQC23Q3.jsView on unpkg · L19

22 return config;

23}

24function inferConnectConfig(config) {

25 const envConnStr = process.env.SEEDFORGE_CONNECTION_STRING;

26 const envDialect = process.env.SEEDFORGE_DIALECT;

27 const conn = config.connection;

28 if (conn?.source === "prisma" || conn?.source === "drizzle") {

29 return {

30 dialect: envDialect ?? conn.source,

31 schemaPath: conn.schemaPath ?? "schema.prisma"

32 };

33 }

34 if (conn?.dialect || envDialect || envConnStr) {

35 return {

36 dialect: envDialect ?? conn?.dialect ?? "postgres",

37 connectionString: envConnStr ?? conn?.connectionString,

38 ...conn?.database ? { database: conn.database } : {}

39 };

src/commands/clone.tsView file

Lines 58-98typescript

58 const cloneOptions: CloneOptions = {

59 sourceConnection: source,

60 dialect,

61 anonymize: !!opts.anonymize,

62 iUnderstandTheRisk: !!opts.iUnderstandTheRisk,

63 outputDir,

64 maxRowsPerTable: maxRows,

65 };

Source & flagged code

2 flagged · loading source

dist/chunk-QEQC23Q3.jsView file

19}); L20: const mod = await jiti.import(resolved); L21: const config = mod.default ?? mod;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/chunk-QEQC23Q3.jsView on unpkg · L19

src/commands/clone.tsView file

78package = @seed-forge/cli; repositoryIdentity = seedforge; dependency = @seed-forge/adapter-mongodb L78: case 'mysql': return import('@seed-forge/adapter-mysql'); L79: case 'mongodb': return import('@seed-forge/adapter-mongodb'); L80: case 'sqlite': return import('@seed-forge/adapter-sqlite');

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

src/commands/clone.tsView on unpkg · L78

Findings

1 High4 Medium4 Low

HighCopied Package Dependency Bridgesrc/commands/clone.ts

MediumDynamic Requiredist/chunk-QEQC23Q3.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

dist/chunk-QEQC23Q3.jsView file

Lines 1-39javascript

1// src/utils/config.ts

2import { createJiti } from "jiti";

3import path from "path";

4import fs from "fs/promises";

5async function loadConfig(configPath) {

6 const resolved = path.resolve(configPath ?? "seedforge.config.ts");

7 try {

8 await fs.access(resolved);

9 } catch {

10 return { connection: {}, tables: {} };

11 }

12 if (resolved.endsWith(".json")) {

13 const content = await fs.readFile(resolved, "utf-8");

14 return JSON.parse(content);

15 }

16 const jiti = createJiti(process.cwd(), {

17 interopDefault: true,

18 moduleCache: false

19 });

20 const mod = await jiti.import(resolved);

21 const config = mod.default ?? mod;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/chunk-QEQC23Q3.jsView on unpkg · L19

22 return config;

23}

24function inferConnectConfig(config) {

25 const envConnStr = process.env.SEEDFORGE_CONNECTION_STRING;

26 const envDialect = process.env.SEEDFORGE_DIALECT;

27 const conn = config.connection;

28 if (conn?.source === "prisma" || conn?.source === "drizzle") {

29 return {

30 dialect: envDialect ?? conn.source,

31 schemaPath: conn.schemaPath ?? "schema.prisma"

32 };

33 }

34 if (conn?.dialect || envDialect || envConnStr) {

35 return {

36 dialect: envDialect ?? conn?.dialect ?? "postgres",

37 connectionString: envConnStr ?? conn?.connectionString,

38 ...conn?.database ? { database: conn.database } : {}

39 };

src/commands/clone.tsView file

Lines 58-98typescript

58 const cloneOptions: CloneOptions = {

59 sourceConnection: source,

60 dialect,

61 anonymize: !!opts.anonymize,

62 iUnderstandTheRisk: !!opts.iUnderstandTheRisk,

63 outputDir,

64 maxRowsPerTable: maxRows,

65 };