registry / @skeweei/cli / 0.1.5

@skeweei/cli@0.1.5

Static Scan Results

scanned 5h ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 8 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

EnvironmentVarsFilesystemNetworkShell

Supply chain

UrlStrings

Manifest

NoLicense

scanned 4 file(s), 11.5 KB of source, external domains: nice-showers-kiss.loca.lt, skeweei.com

Source & flagged code

2 flagged

dist/commands/add.jsView file

Lines 1-25javascript

1import { Command } from "commander";

2import fs from "fs";

3import path from "path";

4import chalk from "chalk";

5import fetch from "node-fetch";

6import { execa } from "execa";

7import ora from "ora";

High

Shell

Package source references shell execution.

dist/commands/add.jsView on unpkg · L5

8const REGISTRY_URL = process.env.REGISTRY_URL || "https://nice-showers-kiss.loca.lt/registry";

9export const add = new Command()

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/commands/add.jsView on unpkg · L5

10 .name("add")

11 .description("add a component to your project")

12 .argument("[components...]", "the components to add")

13 .action(async (components) => {

14 console.log(chalk.cyan.bold("\n💎 Skeweei CLI\n"));

15 try {

16 const configPath = path.resolve(process.cwd(), "components.json");

17 if (!fs.existsSync(configPath)) {

18 console.error(chalk.red("components.json not found. Please run `npx skeweei init` first."));

19 process.exit(1);

20 }

21 const config = JSON.parse(fs.readFileSync(configPath, "utf8"));

22 // Naively resolve alias to directory for this example

23 // In a real CLI, we parse tsconfig paths

24 const componentsDir = path.resolve(process.cwd(), config.aliases.components.replace("@/", "src/"), "ui");

25 if (!fs.existsSync(componentsDir)) {

Source & flagged code

2 flagged · loading source

dist/commands/add.jsView file

5import fetch from "node-fetch"; L6: import { execa } from "execa"; L7: import ora from "ora";

High

Shell

Package source references shell execution.

dist/commands/add.jsView on unpkg · L5

5import fetch from "node-fetch"; L6: import { execa } from "execa"; L7: import ora from "ora"; L8: const REGISTRY_URL = process.env.REGISTRY_URL || "https://nice-showers-kiss.loca.lt/registry"; L9: export const add = new Command()

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/commands/add.jsView on unpkg · L5

Findings

2 High2 Medium4 Low

HighShelldist/commands/add.js

HighSame File Env Network Executiondist/commands/add.js

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowFilesystem

LowUrl Strings

LowNo License

Source & flagged code

2 flagged

dist/commands/add.jsView file

Lines 1-25javascript

1import { Command } from "commander";

2import fs from "fs";

3import path from "path";

4import chalk from "chalk";

5import fetch from "node-fetch";

6import { execa } from "execa";

7import ora from "ora";

High

Shell

Package source references shell execution.

dist/commands/add.jsView on unpkg · L5

8const REGISTRY_URL = process.env.REGISTRY_URL || "https://nice-showers-kiss.loca.lt/registry";

9export const add = new Command()

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/commands/add.jsView on unpkg · L5

10 .name("add")

11 .description("add a component to your project")

12 .argument("[components...]", "the components to add")

13 .action(async (components) => {

14 console.log(chalk.cyan.bold("\n💎 Skeweei CLI\n"));

15 try {

16 const configPath = path.resolve(process.cwd(), "components.json");

17 if (!fs.existsSync(configPath)) {

18 console.error(chalk.red("components.json not found. Please run `npx skeweei init` first."));

19 process.exit(1);

20 }

21 const config = JSON.parse(fs.readFileSync(configPath, "utf8"));

22 // Naively resolve alias to directory for this example

23 // In a real CLI, we parse tsconfig paths

24 const componentsDir = path.resolve(process.cwd(), config.aliases.components.replace("@/", "src/"), "ui");

25 if (!fs.existsSync(componentsDir)) {