registry / @skeweei/cli / 0.1.0

@skeweei/cli@0.1.0

Static Scan Results

scanned 6d ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 9 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

EnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 7 file(s), 12.3 KB of source, external domains: skeweei.com

Source & flagged code

2 flagged

dist/commands/add.jsView file

Lines 1-25javascript

1import { Command } from "commander";

2import fs from "fs";

3import path from "path";

4import chalk from "chalk";

5import fetch from "node-fetch";

6import { execa } from "execa";

7const REGISTRY_URL = process.env.REGISTRY_URL || "http://localhost:3000/registry";

High

Shell

Package source references shell execution.

dist/commands/add.jsView on unpkg · L5

8export const add = new Command()

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/commands/add.jsView on unpkg · L5

9 .name("add")

10 .description("add a component to your project")

11 .argument("[components...]", "the components to add")

12 .action(async (components) => {

13 try {

14 const configPath = path.resolve(process.cwd(), "components.json");

15 if (!fs.existsSync(configPath)) {

16 console.error(chalk.red("components.json not found. Please run `npx skeweei init` first."));

17 process.exit(1);

18 }

19 const config = JSON.parse(fs.readFileSync(configPath, "utf8"));

20 // Naively resolve alias to directory for this example

21 // In a real CLI, we parse tsconfig paths

22 const componentsDir = path.resolve(process.cwd(), config.aliases.components.replace("@/", "src/"), "ui");

23 if (!fs.existsSync(componentsDir)) {

24 fs.mkdirSync(componentsDir, { recursive: true });

25 }

Source & flagged code

2 flagged · loading source

dist/commands/add.jsView file

5import fetch from "node-fetch"; L6: import { execa } from "execa"; L7: const REGISTRY_URL = process.env.REGISTRY_URL || "http://localhost:3000/registry";

High

Shell

Package source references shell execution.

dist/commands/add.jsView on unpkg · L5

5import fetch from "node-fetch"; L6: import { execa } from "execa"; L7: const REGISTRY_URL = process.env.REGISTRY_URL || "http://localhost:3000/registry"; L8: export const add = new Command()

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/commands/add.jsView on unpkg · L5

Findings

2 High2 Medium5 Low

HighShelldist/commands/add.js

HighSame File Env Network Executiondist/commands/add.js

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

2 flagged

dist/commands/add.jsView file

Lines 1-25javascript

1import { Command } from "commander";

2import fs from "fs";

3import path from "path";

4import chalk from "chalk";

5import fetch from "node-fetch";

6import { execa } from "execa";

7const REGISTRY_URL = process.env.REGISTRY_URL || "http://localhost:3000/registry";

High

Shell

Package source references shell execution.

dist/commands/add.jsView on unpkg · L5

8export const add = new Command()

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/commands/add.jsView on unpkg · L5

9 .name("add")

10 .description("add a component to your project")

11 .argument("[components...]", "the components to add")

12 .action(async (components) => {

13 try {

14 const configPath = path.resolve(process.cwd(), "components.json");

15 if (!fs.existsSync(configPath)) {

16 console.error(chalk.red("components.json not found. Please run `npx skeweei init` first."));

17 process.exit(1);

18 }

19 const config = JSON.parse(fs.readFileSync(configPath, "utf8"));

20 // Naively resolve alias to directory for this example

21 // In a real CLI, we parse tsconfig paths

22 const componentsDir = path.resolve(process.cwd(), config.aliases.components.replace("@/", "src/"), "ui");

23 if (!fs.existsSync(componentsDir)) {

24 fs.mkdirSync(componentsDir, { recursive: true });

25 }