registry / @servicetitan/startup / 37.0.1

@servicetitan/startup@37.0.1

CLI to create multi-package Lerna projects with TypeScript and React

Static Scan Results

scanned 2mo ago · by rust-scanner

Static analysis flagged 17 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 713 file(s), 968 KB of source, external domains: docs.st.dev, nodejs.org, unpkg.servicetitan.com, unpkg.st.dev, verdaccio.servicetitan.com, verdaccio.st.dev

Source & flagged code

8 flagged

package.jsonView file

Lines 65-105json

65 "stylelint": "./bin/stylelint.js",

66 "swc": "./bin/swc.js",

67 "swcx": "./bin/swcx.js",

68 "tcm": "./bin/tcm.js",

69 "ts-jest": "./bin/ts-jest.js",

70 "ts-node": "./bin/ts-node.js",

71 "ts-node-cwd": "./bin/ts-node-cwd.js",

72 "ts-node-esm": "./bin/ts-node-esm.js",

73 "ts-node-script": "./bin/ts-node-script.js",

74 "ts-node-transpile-only": "./bin/ts-node-transpile-only.js",

75 "ts-script": "./bin/ts-script.js",

76 "tsc": "./bin/tsc.js",

77 "tsserver": "./bin/tsserver.js",

78 "vite": "./bin/vite.js",

79 "vitest": "./bin/vitest.js",

80 "webpack": "./bin/webpack.js",

81 "webpack-bundle-analyzer": "./bin/webpack-bundle-analyzer.js",

82 "webpack-dev-server": "./bin/webpack-dev-server.js"

83 },

84 "scripts": {

85 "postinstall": "node ./src/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L85

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L85

86 "prepare": "node ./src/scripts/generate-bin-wrappers.js"

87 },

88 "devDependencies": {

89 "@swc/types": "^0.1.27",

90 "@types/cpx": "~1.5.5",

91 "@types/debug": "^4.1.12",

92 "@types/eslint": "~9.6.1",

93 "@types/js-yaml": "^4.0.9",

94 "@types/less": "~3.0.8",

95 "@types/lodash.kebabcase": "^4.1.9",

96 "@types/lodash.memoize": "^4.1.9",

97 "@types/moment-locales-webpack-plugin": "~1.2.2",

98 "@types/webpack-assets-manifest": "~5.1.4",

99 "@types/yargs": "~17.0.35"

100 },

101 "dependencies": {

102 "@babel/preset-env": "~7.29.7",

103 "@jest/core": "~30.4.2",

104 "@jest/types": "~30.4.1",

105 "@jsdevtools/coverage-istanbul-loader": "^3.0.5",

bin/_run.jsView file

Lines 1-33javascript

1/**

2 * Shared helper for bin wrappers generated by scripts/generate-bin-wrappers.js.

3 *

4 * Locates a dependency's bin script by walking up the node_modules tree from

5 * the caller's directory, then executes it with the same argv. Works with both

6 * npm (flat hoisting) and pnpm (strict isolation).

7 *

8 * Caveat (npm only): if npm nests a different version of a package inside

9 * startup's node_modules and startup's bin wrapper is installed last, the

10 * consumer may get startup's version instead of their own. Keeping versions

dist/cli/tasks/cli-task.jsView file

Lines 1-30javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", {

3 value: true

4});

5Object.defineProperty(exports, "CliTask", {

6 enumerable: true

dist/webpack/loaders/expose-loader/runtime/get-global-this.jsView file

Lines 1-28javascript

1"use strict";

2/* eslint-disable */ // @ts-nocheck

3module.exports = function() {

4 if (typeof globalThis === 'object') {

bin/webpack.jsView file

Lines 1-4javascript

1#!/usr/bin/env node

2// Auto-generated by scripts/generate-bin-wrappers.js - wraps: webpack -> bin/webpack.js

3require('./_run')('webpack', 'bin/webpack.js');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/webpack.jsView on unpkg · L2

src/vite/plugins/shared-dependencies-plugin/shared-dependencies-plugin.tsView file

Lines 30-70typescript

31 return {

32 name: 'shared-dependencies',

33 enforce: 'pre',

35 config(_, env) {

36 isProduction

dist/cli/commands/clean.jsView file

Lines 34-74javascript

34var CleanProcesses = /*#__PURE__*/ function(CleanProcesses) {

35 CleanProcesses[CleanProcesses["CleanGitWorkingTree"] = 0] = "CleanGitWorkingTree";

36 CleanProcesses[CleanProcesses["ClearJestCache"] =

Source & flagged code

8 flagged · loading source

package.jsonView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code