registry / @skalfa/skalfa-app-core / 1.0.9

@skalfa/skalfa-app-core@1.0.9

Core framework engine and foundational utility hook library for the Skalfa Next.js frontend.

AI Security Review

scanned 8d ago · by lpm-firewall-ai

No confirmed malicious attack surface is established. The risky primitives are user-invoked developer utilities and framework API helpers, not install-time or import-time behavior.

Static reason

One or more suspicious static signals were detected.

Trigger

Explicit library API or CLI command invocation by the consuming project.

Impact

Can generate project files or run barrelsby when intentionally invoked; no evidence of unconsented execution or data exfiltration.

Mechanism

Frontend framework utilities, API wrapper, cache/auth helpers, and code generation commands.

Rationale

Static inspection found suspicious primitives, but they are aligned with a Next.js framework package and require explicit user invocation or app configuration. There is no lifecycle execution, import-time payload, credential harvesting, or concrete exfiltration behavior.

Evidence

package.jsondist/index.jsdist/commands/cli.jsdist/commands/use-pdf.jsdist/commands/blueprint.jsdist/api/api.jsdist/auth/auth.jsdist/cavity/cavity.jsdist/encryption/encryption.jsREADME.mdpublic/pdf.worker.min.mjsapp/<route>/page.tsxbarrels.json

Network endpoints1

skalfa.sejedigital.com

Decision evidence

public snapshot

AI called this Clean at 88.0% confidence as Benign with low false-positive risk.

Evidence for block

dist/commands/cli.js imports child_process and runs `npx barrelsby -c barrels.json` only from explicit CLI commands.
dist/commands/blueprint.js writes generated Next.js pages under app/<route>/page.tsx when blueprint command is invoked.
dist/api/api.js sends axios requests to caller-provided url or NEXT_PUBLIC_API_HOST; auth bearer comes from package auth helper.

Evidence against

package.json has no install/preinstall/postinstall lifecycle hooks and no bin entry.
dist/index.js only re-exports library modules; CLI runCli is not called on import.
No obfuscated payloads, native binaries, dynamic require/import, eval/vm, persistence, or destructive file operations found.
Network use is package-aligned frontend API/socket functionality driven by environment or caller-provided configuration.
Cookie/env usage is limited to app configuration and access-token helper functions, with no exfiltration path.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 31 file(s), 64.1 KB of source

Source & flagged code

2 flagged

dist/commands/cli.jsView file

Lines 1-60javascript

1import { Command } from "commander";

2import { usePdf } from "./use-pdf";

3import { blueprint } from "./blueprint";

4import { logger } from "../logger";

5import fs from "fs";

6import path from "path";

7import { exec, execSync } from "child_process";

8// =====================================>

High

Child Process

Package source references child process execution.

dist/commands/cli.jsView on unpkg · L6

9// ## Command: use-pdf

10// =====================================>

11export const usePdfCommand = new Command("use-pdf")

12 .description("Copy pdf.worker.min.mjs ke folder public/")

13 .action(() => {

14 usePdf();

15});

16// =====================================>

17// ## Command: blueprint

18// =====================================>

19export const blueprintCommand = new Command("blueprint")

20 .description("Generate blueprint")

21 .option("-o, --only <names...>", "Run only specific blueprints")

22 .action(async (opts) => {

23 await blueprint({ only: opts.only });

24 logger.info("Success run all blueprints!");

25 process.exit(0);

26});

27// =====================================>

28// ## Command: barrels (run once)

29// =====================================>

30export const barrelsCommand = new Command("barrels")

31 .description("Generate barrels auto-imports using barrelsby")

32 .action(() => {

33 const rootDir = process.cwd();

34 const configPath = path.join(rootDir, "barrels.json");

35 if (!fs.existsSync(configPath)) {

36 logger.error("barrels.json config file not found at project root");

37 process.exit(1);

38 }

39 logger.info("Generating barrels...");

40 try {

41 execSync("npx barrelsby -c barrels.json", { cwd: rootDir, stdio: "inherit" });

42 logger.info("Barrels successfully generated!");

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/commands/cli.jsView on unpkg · L40

43 process.exit(0);

44 }

45 catch (err) {

46 logger.error(`Failed to generate barrels: ${err}`);

47 process.exit(1);

48 }

49});

50// =====================================>

51// ## Command: watch:barrels (file watcher)

52// =====================================>

53export const watchBarrelsCommand = new Command("watch:barrels")

54 .description("Watch directories and update barrels automatically on file changes")

55 .action(async () => {

56 const rootDir = process.cwd();

57 const configPath = path.join(rootDir, "barrels.json");

58 if (!fs.existsSync(configPath)) {

59 logger.error("barrels.json config file not found at project root");

60 process.exit(1);

Source & flagged code

2 flagged · loading source

dist/commands/cli.jsView file

6import path from "path"; L7: import { exec, execSync } from "child_process"; L8: // =====================================>

High

Child Process

Package source references child process execution.

dist/commands/cli.jsView on unpkg · L6

40try { L41: execSync("npx barrelsby -c barrels.json", { cwd: rootDir, stdio: "inherit" }); L42: logger.info("Barrels successfully generated!");

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/commands/cli.jsView on unpkg · L40

Findings

3 High2 Medium2 Low

HighChild Processdist/commands/cli.js

HighShell

HighRuntime Package Installdist/commands/cli.js

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowFilesystem

Source & flagged code

2 flagged

dist/commands/cli.jsView file

Lines 1-60javascript

1import { Command } from "commander";

2import { usePdf } from "./use-pdf";

3import { blueprint } from "./blueprint";

4import { logger } from "../logger";

5import fs from "fs";

6import path from "path";

7import { exec, execSync } from "child_process";

8// =====================================>

High

Child Process

Package source references child process execution.

dist/commands/cli.jsView on unpkg · L6

9// ## Command: use-pdf

10// =====================================>

11export const usePdfCommand = new Command("use-pdf")

12 .description("Copy pdf.worker.min.mjs ke folder public/")

13 .action(() => {

14 usePdf();

15});

16// =====================================>

17// ## Command: blueprint

18// =====================================>

19export const blueprintCommand = new Command("blueprint")

20 .description("Generate blueprint")

21 .option("-o, --only <names...>", "Run only specific blueprints")

22 .action(async (opts) => {

23 await blueprint({ only: opts.only });

24 logger.info("Success run all blueprints!");

25 process.exit(0);

26});

27// =====================================>

28// ## Command: barrels (run once)

29// =====================================>

30export const barrelsCommand = new Command("barrels")

31 .description("Generate barrels auto-imports using barrelsby")

32 .action(() => {

33 const rootDir = process.cwd();

34 const configPath = path.join(rootDir, "barrels.json");

35 if (!fs.existsSync(configPath)) {

36 logger.error("barrels.json config file not found at project root");

37 process.exit(1);

38 }

39 logger.info("Generating barrels...");

40 try {

41 execSync("npx barrelsby -c barrels.json", { cwd: rootDir, stdio: "inherit" });

42 logger.info("Barrels successfully generated!");

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/commands/cli.jsView on unpkg · L40

43 process.exit(0);

44 }

45 catch (err) {

46 logger.error(`Failed to generate barrels: ${err}`);

47 process.exit(1);

48 }

49});

50// =====================================>

51// ## Command: watch:barrels (file watcher)

52// =====================================>

53export const watchBarrelsCommand = new Command("watch:barrels")

54 .description("Watch directories and update barrels automatically on file changes")

55 .action(async () => {

56 const rootDir = process.cwd();

57 const configPath = path.join(rootDir, "barrels.json");

58 if (!fs.existsSync(configPath)) {

59 logger.error("barrels.json config file not found at project root");

60 process.exit(1);