registry / @somewhere-tech/cli / 0.18.2

@somewhere-tech/cli@0.18.2

CLI for somewhere.tech — auth, projects, deploy, pull, promote, db, logs, env, MCP bridge.

Static Scan Results

scanned 9d ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 67 file(s), 477 KB of source, external domains: api.somewhere.tech, fonts.googleapis.com, mcp.somewhere.tech, npm.somewhere.tech, registry.npmjs.org, runner.somewhere.tech, somewhere.tech

Source & flagged code

4 flagged

dist/swpx/spawn.jsView file

Lines 1-26javascript

1/** Shell out to the REAL npx / npm. swpx/swpm are wrappers, never replacements:

2 * once a verdict says "go", the genuine tool runs with the user's exact args,

3 * inheriting stdio so its output is untouched (we keep our own messaging on

4 * stderr). The child's exit code becomes ours. A launch failure (tool not on

5 * PATH) resolves to 127 rather than throwing — the caller already printed the

6 * verdict; a missing npm is the user's environment, not a swpx error. */

7import { spawn } from 'node:child_process';

8import { dim } from '../lib/output.js';

High

Child Process

Package source references child process execution.

dist/swpx/spawn.jsView on unpkg · L6

9export function runReal(cmd, args) {

10 // SWPX_DRY_RUN: show the decision + what WOULD run, without executing. Useful

11 // for "what would swpx do?" and for testing the gate end-to-end offline.

12 if (process.env.SWPX_DRY_RUN) {

13 console.error(dim(`swpx: [dry-run] would run: ${cmd} ${args.join(' ')}`));

14 return Promise.resolve(0);

15 }

16 return new Promise((resolve) => {

17 const child = spawn(cmd, args, {

18 stdio: 'inherit',

19 // On Windows npx/npm are .cmd shims that need a shell; on POSIX we spawn

20 // the binary directly (no shell → no quoting/injection surface).

21 shell: process.platform === 'win32',

22 });

23 child.on('error', (err) => {

24 console.error(dim(`swpx: failed to launch ${cmd} — ${err.message}`));

25 resolve(127);

26 });

dist/commands/dev.jsView file

Lines 337-375javascript

337// ─── Legacy: `somewhere dev <cmd>` runs a local command with platform context.

338// Kept for anyone scripting against the old behavior; the no-arg form is the

339// recommended hot-deploy watcher above.

340async function runLegacyExec(cmdParts) {

341 const token = getToken();

342 const client =

dist/local/runtime.jsView file

Lines 16-56javascript

16 * - Handler errors return the real message + stack in the response body

17 * (deployed keeps them in logs only) — it's your own terminal.

18 * - Uncaught errors print to the terminal instead of POSTing to /v1/logs.

19 */

dist/commands/update.jsView file

Lines 32-62javascript

32 catch {

33 error('Could not reach npm to check the latest version. Check your connection and try again.');

34 process.exit(1);

35 }

36 if (!latest) {

37 error('Could not determine the latest version from npm.');

38 process.

Source & flagged code

4 flagged · loading source

dist/swpx/spawn.jsView file

6* verdict; a missing npm is the user's environment, not a swpx error. */ L7: import { spawn } from 'node:child_process'; L8: import { dim } from '../lib/output.js';

High

Child Process

Package source references child process execution.

dist/swpx/spawn.jsView on unpkg · L6

dist/commands/dev.jsView file

357const child = spawn(command, { L358: shell: true, L359: stdio: 'inherit',

High

Shell

Package source references shell execution.

dist/commands/dev.jsView on unpkg · L357

dist/local/runtime.jsView file

36const root = packageRoot(); L37: await import(pathToFileURL(join(root, 'runtime', 'sw-init.mjs')).href); L38: contextModule = (await import(pathToFileURL(join(root, 'runtime', 'platform-context.mjs')).href));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/local/runtime.jsView on unpkg · L36

dist/commands/update.jsView file

52// in which case npm's EACCES message is surfaced and we point at the manual fix. L53: execSync(`npm install -g ${PACKAGE}@latest`, { stdio: 'inherit' }); L54: }

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/commands/update.jsView on unpkg · L52

Findings

3 High4 Medium5 Low

HighChild Processdist/swpx/spawn.js

HighShelldist/commands/dev.js

HighRuntime Package Installdist/commands/update.js

MediumDynamic Requiredist/local/runtime.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

dist/swpx/spawn.jsView file

Lines 1-26javascript

1/** Shell out to the REAL npx / npm. swpx/swpm are wrappers, never replacements:

2 * once a verdict says "go", the genuine tool runs with the user's exact args,

3 * inheriting stdio so its output is untouched (we keep our own messaging on

4 * stderr). The child's exit code becomes ours. A launch failure (tool not on

5 * PATH) resolves to 127 rather than throwing — the caller already printed the

6 * verdict; a missing npm is the user's environment, not a swpx error. */

7import { spawn } from 'node:child_process';

8import { dim } from '../lib/output.js';

High

Child Process

Package source references child process execution.

dist/swpx/spawn.jsView on unpkg · L6

9export function runReal(cmd, args) {

10 // SWPX_DRY_RUN: show the decision + what WOULD run, without executing. Useful

11 // for "what would swpx do?" and for testing the gate end-to-end offline.

12 if (process.env.SWPX_DRY_RUN) {

13 console.error(dim(`swpx: [dry-run] would run: ${cmd} ${args.join(' ')}`));

14 return Promise.resolve(0);

15 }

16 return new Promise((resolve) => {

17 const child = spawn(cmd, args, {

18 stdio: 'inherit',

19 // On Windows npx/npm are .cmd shims that need a shell; on POSIX we spawn

20 // the binary directly (no shell → no quoting/injection surface).

21 shell: process.platform === 'win32',

22 });

23 child.on('error', (err) => {

24 console.error(dim(`swpx: failed to launch ${cmd} — ${err.message}`));

25 resolve(127);

26 });

dist/commands/dev.jsView file

Lines 337-375javascript

337// ─── Legacy: `somewhere dev <cmd>` runs a local command with platform context.

338// Kept for anyone scripting against the old behavior; the no-arg form is the

339// recommended hot-deploy watcher above.

340async function runLegacyExec(cmdParts) {

341 const token = getToken();

342 const client =

dist/local/runtime.jsView file

Lines 16-56javascript

16 * - Handler errors return the real message + stack in the response body

17 * (deployed keeps them in logs only) — it's your own terminal.

18 * - Uncaught errors print to the terminal instead of POSTing to /v1/logs.

19 */

dist/commands/update.jsView file

Lines 32-62javascript

32 catch {

33 error('Could not reach npm to check the latest version. Check your connection and try again.');

34 process.exit(1);

35 }

36 if (!latest) {

37 error('Could not determine the latest version from npm.');

38 process.