registry / @skalfa/skalfa-app-core / 1.0.11

@skalfa/skalfa-app-core@1.0.11

Core framework engine and foundational utility hook library for the Skalfa Next.js frontend.

AI Security Review

scanned 7d ago · by lpm-firewall-ai

No confirmed malicious attack surface was established. The risky primitives are explicit development/frontend utilities rather than install-time or import-time behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

Explicit caller import or CLI command invocation

Impact

Runs local project tooling and writes generated app/page.tsx files only when invoked; performs configured frontend API requests.

Mechanism

User-invoked Next.js/dev tooling, blueprint generation, API helper requests

Rationale

Source inspection shows no lifecycle execution and no hidden attack behavior; scanner hits map to explicit development commands and frontend framework utilities. The child_process, filesystem, env, and network use are package-aligned and user/config driven.

Evidence

package.jsondist/index.jsdist/commands/cli.jsdist/commands/blueprint.jsdist/commands/use-pdf.jsdist/api/api.jsdist/cavity/cavity.jsdist/auth/auth.jsdist/encryption/encryption.jsbarrels.jsonutils/commands/stubs/table-blueprint.stubapp/<route>/page.tsxpublic/pdf.worker.min.mjs

Decision evidence

public snapshot

AI called this Clean at 86.0% confidence as Benign with low false-positive risk.

Evidence for block

dist/commands/cli.js exposes user-invoked commands that run shell commands via exec/execSync/spawn shell:true.
dist/commands/blueprint.js writes generated app route files from local blueprint JSON and a local stub.
dist/api/api.js sends bearer-auth axios requests to NEXT_PUBLIC_API_HOST or caller-supplied url.

Evidence against

package.json has no preinstall/install/postinstall lifecycle hooks and no bin entry.
dist/index.js only exports utility modules; CLI code is not import-time executed.
Shell commands are fixed development commands such as next, eslint, tsc, and npx barrelsby, activated by explicit CLI actions.
No credential harvesting, hidden exfiltration endpoint, persistence, AI-agent control-surface writes, destructive behavior, or remote code loading found.
Network behavior is package-aligned frontend API/socket use driven by app configuration or caller input.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 31 file(s), 66.2 KB of source

Source & flagged code

4 flagged

dist/commands/cli.jsView file

Lines 1-60javascript

1import { Command } from "commander";

2import { usePdf } from "./use-pdf";

3import { blueprint } from "./blueprint";

4import { logger } from "../logger";

5import fs from "fs";

6import path from "path";

7import { exec, execSync, spawn } from "child_process";

8// =====================================>

High

Child Process

Package source references child process execution.

dist/commands/cli.jsView on unpkg · L6

9// ## Command: use-pdf

10// =====================================>

11export const usePdfCommand = new Command("use-pdf")

12 .description("Copy pdf.worker.min.mjs ke folder public/")

13 .action(() => {

14 usePdf();

15});

16// =====================================>

17// ## Command: blueprint

18// =====================================>

19export const blueprintCommand = new Command("blueprint")

20 .description("Generate blueprint")

21 .option("-o, --only <names...>", "Run only specific blueprints")

22 .action(async (opts) => {

23 await blueprint({ only: opts.only });

24 logger.info("Success run all blueprints!");

25 process.exit(0);

26});

27// =====================================>

28// ## Command: barrels (run once)

29// =====================================>

30export const barrelsCommand = new Command("barrels")

31 .description("Generate barrels auto-imports using barrelsby")

32 .action(() => {

33 const rootDir = process.cwd();

34 const configPath = path.join(rootDir, "barrels.json");

35 if (!fs.existsSync(configPath)) {

36 logger.error("barrels.json config file not found at project root");

37 process.exit(1);

38 }

39 logger.info("Generating barrels...");

40 try {

41 execSync("npx barrelsby -c barrels.json", { cwd: rootDir, stdio: "inherit" });

42 logger.info("Barrels successfully generated!");

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/commands/cli.jsView on unpkg · L40

43 process.exit(0);

44 }

45 catch (err) {

46 logger.error(`Failed to generate barrels: ${err}`);

47 process.exit(1);

48 }

49});

50// =====================================>

51// ## Command: watch:barrels (file watcher)

52// =====================================>

53export const watchBarrelsCommand = new Command("watch:barrels")

54 .description("Watch directories and update barrels automatically on file changes")

55 .action(async () => {

56 const rootDir = process.cwd();

57 const configPath = path.join(rootDir, "barrels.json");

58 if (!fs.existsSync(configPath)) {

59 logger.error("barrels.json config file not found at project root");

60 process.exit(1);

Lines 89-129javascript

89 }

90 else {

91 logger.info(`Barrels updated: ${path.join(dir, "index.ts")}`);

92 }

93 });

94 }

95 });

96 });

97 logger.start("Barrels watcher running for: "

•matchType = previous_version_dangerous_delta matchedPackage = @skalfa/sk[redacted]@1.0.10 matchedIdentity = npm:QHNrYWxmYS9za2FsZmEtYXBwLWNvcmU:1.0.10 similarity = 0.952 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/commands/cli.jsView on unpkg

Source & flagged code

4 flagged · loading source

dist/commands/cli.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/commands/cli.jsView on unpkg

6import path from "path"; L7: import { exec, execSync, spawn } from "child_process"; L8: // =====================================>

High

Child Process

Package source references child process execution.

dist/commands/cli.jsView on unpkg · L6

109function executeCommand(commandLine) { L110: const child = spawn(commandLine, { stdio: "inherit", shell: true }); L111: child.on("exit", (code) => {

High

Shell

Package source references shell execution.

dist/commands/cli.jsView on unpkg · L109

40try { L41: execSync("npx barrelsby -c barrels.json", { cwd: rootDir, stdio: "inherit" }); L42: logger.info("Barrels successfully generated!");

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/commands/cli.jsView on unpkg · L40

Findings

1 Critical3 High2 Medium2 Low

CriticalPrevious Version Dangerous Deltadist/commands/cli.js

HighChild Processdist/commands/cli.js

HighShelldist/commands/cli.js

HighRuntime Package Installdist/commands/cli.js

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowFilesystem

Source & flagged code

4 flagged

dist/commands/cli.jsView file

Lines 1-60javascript

1import { Command } from "commander";

2import { usePdf } from "./use-pdf";

3import { blueprint } from "./blueprint";

4import { logger } from "../logger";

5import fs from "fs";

6import path from "path";

7import { exec, execSync, spawn } from "child_process";

8// =====================================>

High

Child Process

Package source references child process execution.

dist/commands/cli.jsView on unpkg · L6

9// ## Command: use-pdf

10// =====================================>

11export const usePdfCommand = new Command("use-pdf")

12 .description("Copy pdf.worker.min.mjs ke folder public/")

13 .action(() => {

14 usePdf();

15});

16// =====================================>

17// ## Command: blueprint

18// =====================================>

19export const blueprintCommand = new Command("blueprint")

20 .description("Generate blueprint")

21 .option("-o, --only <names...>", "Run only specific blueprints")

22 .action(async (opts) => {

23 await blueprint({ only: opts.only });

24 logger.info("Success run all blueprints!");

25 process.exit(0);

26});

27// =====================================>

28// ## Command: barrels (run once)

29// =====================================>

30export const barrelsCommand = new Command("barrels")

31 .description("Generate barrels auto-imports using barrelsby")

32 .action(() => {

33 const rootDir = process.cwd();

34 const configPath = path.join(rootDir, "barrels.json");

35 if (!fs.existsSync(configPath)) {

36 logger.error("barrels.json config file not found at project root");

37 process.exit(1);

38 }

39 logger.info("Generating barrels...");

40 try {

41 execSync("npx barrelsby -c barrels.json", { cwd: rootDir, stdio: "inherit" });

42 logger.info("Barrels successfully generated!");

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/commands/cli.jsView on unpkg · L40

43 process.exit(0);

44 }

45 catch (err) {

46 logger.error(`Failed to generate barrels: ${err}`);

47 process.exit(1);

48 }

49});

50// =====================================>

51// ## Command: watch:barrels (file watcher)

52// =====================================>

53export const watchBarrelsCommand = new Command("watch:barrels")

54 .description("Watch directories and update barrels automatically on file changes")

55 .action(async () => {

56 const rootDir = process.cwd();

57 const configPath = path.join(rootDir, "barrels.json");

58 if (!fs.existsSync(configPath)) {

59 logger.error("barrels.json config file not found at project root");

60 process.exit(1);

Lines 89-129javascript

89 }

90 else {

91 logger.info(`Barrels updated: ${path.join(dir, "index.ts")}`);

92 }

93 });

94 }

95 });

96 });

97 logger.start("Barrels watcher running for: "

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/commands/cli.jsView on unpkg