registry / @skalfa/skalfa-app-core / 1.0.10

@skalfa/skalfa-app-core@1.0.10

Core framework engine and foundational utility hook library for the Skalfa Next.js frontend.

AI Security Review

scanned 7d ago · by lpm-firewall-ai

No confirmed malicious attack surface was established. Risky primitives are limited to explicit CLI/dev scaffolding commands and normal frontend API helpers.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

Explicit import/use of library helpers or manual invocation of exported CLI commands

Impact

May modify consumer project files or run dev/build tools when deliberately invoked; no install-time or import-time compromise found

Mechanism

User-invoked project scaffolding/dev shell commands and env-configured API requests

Rationale

Static inspection found no lifecycle execution, automatic persistence, exfiltration, or foreign AI-agent control-surface writes. The scanner-highlighted child_process and package-manager commands are tied to explicit CLI/dev workflows and package-aligned code generation.

Evidence

package.jsondist/index.jsdist/commands/cli.jsdist/commands/blueprint.jsdist/commands/use-pdf.jsdist/api/api.jsdist/cavity/cavity.jsbarrels.jsonblueprints/*.blueprint.jsonutils/commands/stubs/table-blueprint.stubapp/<route>/page.tsxpublic/pdf.worker.min.mjs

Decision evidence

public snapshot

AI called this Clean at 90.0% confidence as Benign with low false-positive risk.

Evidence for block

dist/commands/cli.js exposes user-invoked shell commands for npx barrelsby, next, tsc, eslint, and concurrently
dist/commands/blueprint.js writes generated app/<route>/page.tsx files from local blueprint JSON and stub input
dist/api/api.js sends requests to caller/env-provided URL or NEXT_PUBLIC_API_HOST with auth bearer

Evidence against

package.json has no preinstall/install/postinstall lifecycle hooks and no bin entry
dist/index.js only re-exports library modules and does not run CLI code on import
No evidence of credential harvesting, hardcoded exfiltration endpoint, persistence, AI-agent surface mutation, eval/vm, or native/binary loading
Network behavior is normal API client/socket cache functionality using caller configuration

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 31 file(s), 66.1 KB of source

Source & flagged code

4 flagged

dist/commands/cli.jsView file

Lines 1-60javascript

1import { Command } from "commander";

2import { usePdf } from "./use-pdf";

3import { blueprint } from "./blueprint";

4import { logger } from "../logger";

5import fs from "fs";

6import path from "path";

7import { exec, execSync, spawn } from "child_process";

8// =====================================>

High

Child Process

Package source references child process execution.

dist/commands/cli.jsView on unpkg · L6

9// ## Command: use-pdf

10// =====================================>

11export const usePdfCommand = new Command("use-pdf")

12 .description("Copy pdf.worker.min.mjs ke folder public/")

13 .action(() => {

14 usePdf();

15});

16// =====================================>

17// ## Command: blueprint

18// =====================================>

19export const blueprintCommand = new Command("blueprint")

20 .description("Generate blueprint")

21 .option("-o, --only <names...>", "Run only specific blueprints")

22 .action(async (opts) => {

23 await blueprint({ only: opts.only });

24 logger.info("Success run all blueprints!");

25 process.exit(0);

26});

27// =====================================>

28// ## Command: barrels (run once)

29// =====================================>

30export const barrelsCommand = new Command("barrels")

31 .description("Generate barrels auto-imports using barrelsby")

32 .action(() => {

33 const rootDir = process.cwd();

34 const configPath = path.join(rootDir, "barrels.json");

35 if (!fs.existsSync(configPath)) {

36 logger.error("barrels.json config file not found at project root");

37 process.exit(1);

38 }

39 logger.info("Generating barrels...");

40 try {

41 execSync("npx barrelsby -c barrels.json", { cwd: rootDir, stdio: "inherit" });

42 logger.info("Barrels successfully generated!");

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/commands/cli.jsView on unpkg · L40

43 process.exit(0);

44 }

45 catch (err) {

46 logger.error(`Failed to generate barrels: ${err}`);

47 process.exit(1);

48 }

49});

50// =====================================>

51// ## Command: watch:barrels (file watcher)

52// =====================================>

53export const watchBarrelsCommand = new Command("watch:barrels")

54 .description("Watch directories and update barrels automatically on file changes")

55 .action(async () => {

56 const rootDir = process.cwd();

57 const configPath = path.join(rootDir, "barrels.json");

58 if (!fs.existsSync(configPath)) {

59 logger.error("barrels.json config file not found at project root");

60 process.exit(1);

Lines 89-129javascript

89 }

90 else {

91 logger.info(`Barrels updated: ${path.join(dir, "index.ts")}`);

92 }

93 });

94 }

95 });

96 });

97 logger.start("Barrels watcher running for: "

•matchType = previous_version_dangerous_delta matchedPackage = @skalfa/sk[redacted]@1.0.9 matchedIdentity = npm:QHNrYWxmYS9za2FsZmEtYXBwLWNvcmU:1.0.9 similarity = 0.952 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/commands/cli.jsView on unpkg

Source & flagged code

4 flagged · loading source

dist/commands/cli.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/commands/cli.jsView on unpkg

6import path from "path"; L7: import { exec, execSync, spawn } from "child_process"; L8: // =====================================>

High

Child Process

Package source references child process execution.

dist/commands/cli.jsView on unpkg · L6

109function executeCommand(commandLine) { L110: const child = spawn(commandLine, { stdio: "inherit", shell: true }); L111: child.on("exit", (code) => {

High

Shell

Package source references shell execution.

dist/commands/cli.jsView on unpkg · L109

40try { L41: execSync("npx barrelsby -c barrels.json", { cwd: rootDir, stdio: "inherit" }); L42: logger.info("Barrels successfully generated!");

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/commands/cli.jsView on unpkg · L40

Findings

1 Critical3 High2 Medium2 Low

CriticalPrevious Version Dangerous Deltadist/commands/cli.js

HighChild Processdist/commands/cli.js

HighShelldist/commands/cli.js

HighRuntime Package Installdist/commands/cli.js

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowFilesystem

Source & flagged code

4 flagged

dist/commands/cli.jsView file

Lines 1-60javascript

1import { Command } from "commander";

2import { usePdf } from "./use-pdf";

3import { blueprint } from "./blueprint";

4import { logger } from "../logger";

5import fs from "fs";

6import path from "path";

7import { exec, execSync, spawn } from "child_process";

8// =====================================>

High

Child Process

Package source references child process execution.

dist/commands/cli.jsView on unpkg · L6

9// ## Command: use-pdf

10// =====================================>

11export const usePdfCommand = new Command("use-pdf")

12 .description("Copy pdf.worker.min.mjs ke folder public/")

13 .action(() => {

14 usePdf();

15});

16// =====================================>

17// ## Command: blueprint

18// =====================================>

19export const blueprintCommand = new Command("blueprint")

20 .description("Generate blueprint")

21 .option("-o, --only <names...>", "Run only specific blueprints")

22 .action(async (opts) => {

23 await blueprint({ only: opts.only });

24 logger.info("Success run all blueprints!");

25 process.exit(0);

26});

27// =====================================>

28// ## Command: barrels (run once)

29// =====================================>

30export const barrelsCommand = new Command("barrels")

31 .description("Generate barrels auto-imports using barrelsby")

32 .action(() => {

33 const rootDir = process.cwd();

34 const configPath = path.join(rootDir, "barrels.json");

35 if (!fs.existsSync(configPath)) {

36 logger.error("barrels.json config file not found at project root");

37 process.exit(1);

38 }

39 logger.info("Generating barrels...");

40 try {

41 execSync("npx barrelsby -c barrels.json", { cwd: rootDir, stdio: "inherit" });

42 logger.info("Barrels successfully generated!");

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/commands/cli.jsView on unpkg · L40

43 process.exit(0);

44 }

45 catch (err) {

46 logger.error(`Failed to generate barrels: ${err}`);

47 process.exit(1);

48 }

49});

50// =====================================>

51// ## Command: watch:barrels (file watcher)

52// =====================================>

53export const watchBarrelsCommand = new Command("watch:barrels")

54 .description("Watch directories and update barrels automatically on file changes")

55 .action(async () => {

56 const rootDir = process.cwd();

57 const configPath = path.join(rootDir, "barrels.json");

58 if (!fs.existsSync(configPath)) {

59 logger.error("barrels.json config file not found at project root");

60 process.exit(1);

Lines 89-129javascript

89 }

90 else {

91 logger.info(`Barrels updated: ${path.join(dir, "index.ts")}`);

92 }

93 });

94 }

95 });

96 });

97 logger.start("Barrels watcher running for: "

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/commands/cli.jsView on unpkg