registry / @stoker-platform/cli / 0.5.122

@stoker-platform/cli@0.5.122

Static Scan Results

scanned 5d ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicenseWildcardDependency

scanned 65 file(s), 381 KB of source, external domains: firebase.googleapis.com, firebaseappcheck.googleapis.com, firebasedatabase.googleapis.com, firebasehosting.googleapis.com, firebasestorage.googleapis.com, identitytoolkit.googleapis.com, recaptchaenterprise.googleapis.com, www.w3.org

Source & flagged code

4 flagged

init-files/.env/.envView file

12patternName = blocked_file severity = critical matchedText = init-files/.env/.env redactedSecretContext = secretLikeLines = 13 L12: FB_FIRESTORE_REGION=<redacted:20 token-like> L19: FB_STORAGE_REGION=<redacted:20 token-like> L23: FB_AUTH_PASSWORD_POLICY=<redacted:1 value> L28: minPasswordLength=<redacted:2 value> L29: maxPasswordLength=<redacted:3 value> L31: FB_AUTH_PASSWORD_POLICY_UPGRADE=<redacted:5 value> L33: FB_FUNCTIONS_REGION=<redacted:20 token-like> L34: FB_FUNCTIONS_V1_REGION=<redacted:20 token-like> omittedSecretLikeLines = 5

Critical

Critical Secret

Package contains a critical-looking secret pattern.

init-files/.env/.envView on unpkg · L12

lib/src/deploy/schema/generateSchema.jsView file

Lines 1-35javascript

1import { tryPromise } from "@stoker-platform/node-client";

2import { getRelationLists, roleHasOperationAccess } from "@stoker-platform/utils";

3import { ServerValue } from "firebase-admin/database";

4import { spawnSync } from "child_process";

5import { existsSync } from "fs";

High

Child Process

Package source references child process execution.

lib/src/deploy/schema/generateSchema.jsView on unpkg · L3

6import { readdir, readFile, rm } from "fs/promises";

7import { join } from "path";

8import { pathToFileURL } from "url";

9const ensureSchemaBuildOutput = (isTypeGen) => {

10 if (!isTypeGen)

11 return;

12 const mainPath = join(process.cwd(), "lib", "main.js");

13 const collectionsPath = join(process.cwd(), "lib", "collections");

14 if (existsSync(mainPath) && existsSync(collectionsPath))

15 return;

16 const buildResult = spawnSync("npx", ["tsc", "--pretty", "false", "--noEmitOnError", "false"], {

17 cwd: process.cwd(),

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

lib/src/deploy/schema/generateSchema.jsView on unpkg · L15

18 stdio: "ignore",

19 });

20 if (buildResult.error) {

21 throw new Error("Failed to run TypeScript compile step for schema generation", { cause: buildResult.error });

22 }

23 if (!existsSync(mainPath) || !existsSync(collectionsPath)) {

24 throw new Error("No lib output found. Run 'npm run build' to generate lib artifacts.");

25 }

26 return true;

27};

28export const generateSchema = async (includeComputedFields = false, isTypeGen = false) => {

29 // eslint-disable-next-line @typescript-eslint/no-explicit-any

30 const newSchema = {};

31 const tempSchemaGenerated = ensureSchemaBuildOutput(isTypeGen);

32 try {

33 const path = join(process.cwd(), "lib", "main.js");

34 const url = pathToFileURL(path).href;

35 const globalConfigFile = await import(url);

lib/src/lint/securityReport.jsView file

Lines 1-33javascript

1import { generateSchema } from "../deploy/schema/generateSchema.js";

2import { getAccessFields, getField, getDependencyIndexFields, isDependencyField, isRelationField, getRoleGroups, getFieldCustomization, } from "@stoker-platform/utils";

3import { join } from "node:path";

4import { pathToFileURL } from "node:url";

5/* eslint-disable security/detect-object-injection */

6// eslint-disable-next-line @typescript-eslint/no-explicit-any

Source & flagged code

4 flagged · loading source

init-files/.env/.envView file

Critical

Critical Secret

Package contains a critical-looking secret pattern.

init-files/.env/.envView on unpkg · L12

lib/src/deploy/schema/generateSchema.jsView file

3import { ServerValue } from "firebase-admin/database"; L4: import { spawnSync } from "child_process"; L5: import { existsSync } from "fs";

High

Child Process

Package source references child process execution.

lib/src/deploy/schema/generateSchema.jsView on unpkg · L3

15return; L16: const buildResult = spawnSync("npx", ["tsc", "--pretty", "false", "--noEmitOnError", "false"], { L17: cwd: process.cwd(),

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

lib/src/deploy/schema/generateSchema.jsView on unpkg · L15

lib/src/lint/securityReport.jsView file

13const url = pathToFileURL(path).href; L14: const globalConfigFile = await import(url); L15: const globalConfig = globalConfigFile.default({ sdk: "node" });

Medium

Dynamic Require

Package source references dynamic require/import behavior.

lib/src/lint/securityReport.jsView on unpkg · L13

Findings

1 Critical3 High5 Medium5 Low

CriticalCritical Secretinit-files/.env/.env

HighChild Processlib/src/deploy/schema/generateSchema.js

HighShell

HighRuntime Package Installlib/src/deploy/schema/generateSchema.js

MediumDynamic Requirelib/src/lint/securityReport.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumWildcard Dependency

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

4 flagged

init-files/.env/.envView file

Critical

Critical Secret

Package contains a critical-looking secret pattern.

init-files/.env/.envView on unpkg · L12

lib/src/deploy/schema/generateSchema.jsView file

Lines 1-35javascript

1import { tryPromise } from "@stoker-platform/node-client";

2import { getRelationLists, roleHasOperationAccess } from "@stoker-platform/utils";

3import { ServerValue } from "firebase-admin/database";

4import { spawnSync } from "child_process";

5import { existsSync } from "fs";

High

Child Process

Package source references child process execution.

lib/src/deploy/schema/generateSchema.jsView on unpkg · L3

6import { readdir, readFile, rm } from "fs/promises";

7import { join } from "path";

8import { pathToFileURL } from "url";

9const ensureSchemaBuildOutput = (isTypeGen) => {

10 if (!isTypeGen)

11 return;

12 const mainPath = join(process.cwd(), "lib", "main.js");

13 const collectionsPath = join(process.cwd(), "lib", "collections");

14 if (existsSync(mainPath) && existsSync(collectionsPath))

15 return;

16 const buildResult = spawnSync("npx", ["tsc", "--pretty", "false", "--noEmitOnError", "false"], {

17 cwd: process.cwd(),

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

lib/src/deploy/schema/generateSchema.jsView on unpkg · L15

18 stdio: "ignore",

19 });

20 if (buildResult.error) {

21 throw new Error("Failed to run TypeScript compile step for schema generation", { cause: buildResult.error });

22 }

23 if (!existsSync(mainPath) || !existsSync(collectionsPath)) {

24 throw new Error("No lib output found. Run 'npm run build' to generate lib artifacts.");

25 }

26 return true;

27};

28export const generateSchema = async (includeComputedFields = false, isTypeGen = false) => {

29 // eslint-disable-next-line @typescript-eslint/no-explicit-any

30 const newSchema = {};

31 const tempSchemaGenerated = ensureSchemaBuildOutput(isTypeGen);

32 try {

33 const path = join(process.cwd(), "lib", "main.js");

34 const url = pathToFileURL(path).href;

35 const globalConfigFile = await import(url);

lib/src/lint/securityReport.jsView file

Lines 1-33javascript

1import { generateSchema } from "../deploy/schema/generateSchema.js";

2import { getAccessFields, getField, getDependencyIndexFields, isDependencyField, isRelationField, getRoleGroups, getFieldCustomization, } from "@stoker-platform/utils";

3import { join } from "node:path";

4import { pathToFileURL } from "node:url";

5/* eslint-disable security/detect-object-injection */

6// eslint-disable-next-line @typescript-eslint/no-explicit-any