registry / @storm-orm/cli / 1.11.6

@storm-orm/cli@1.11.6

Storm ORM - AI assistant configuration tool

Static Scan Results

scanned 11d ago · by rust-scanner

Static analysis flagged 8 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 109 KB of source, external domains: orm.st

Source & flagged code

2 flagged

storm.mjsView file

Lines 1-29javascript

1#!/usr/bin/env node

2// Storm CLI - AI assistant configuration tool

3// https://orm.st

4//

5// Zero dependencies. Requires Node.js 18+.

7import { writeFileSync, appendFileSync, mkdirSync, existsSync, readFileSync, readdirSync, unlinkSync, rmdirSync, statSync } from 'fs';

8import { basename, join, dirname } from 'path';

9import { homedir } from 'os';

10import { execSync, spawn } from 'child_process';

High

Child Process

Package source references child process execution.

storm.mjsView on unpkg · L9

12const VERSION = '1.11.6';

14// ─── ANSI ────────────────────────────────────────────────────────────────────

16const RESET = '\x1b[0m';

17const BOLD = '\x1b[1m';

18const DIM = '\x1b[2m';

19const HIDE_CURSOR = '\x1b[?25l';

20const SHOW_CURSOR = '\x1b[?25h';

21const CLEAR = '\x1b[2J';

22const HOME = '\x1b[H';

23const CLEAR_DOWN = '\x1b[J';

25const DB = '\x1b[38;5;244m';

26const DB_DIM = '\x1b[38;5;242m';

27const DB_GLOW = '\x1b[38;5;247m';

28const DB_DIM_GLOW = '\x1b[38;5;243m';

29const BOLT_BASE = '\x1b[38;5;226m';

Lines 760-800javascript

760

761 const packageJsonPath = join(globalDir, 'package.json');

762 if (!existsSync(packageJsonPath)) {

763 writeFileSync(packageJsonPath, '{"private":true}\n');

764 }

765

766 // Always overwrite server.mjs to keep in sync with CLI version.

767 writeFileSync(

Source & flagged code

2 flagged · loading source

storm.mjsView file

9import { homedir } from 'os'; L10: import { execSync, spawn } from 'child_process'; L11:

High

Child Process

Package source references child process execution.

storm.mjsView on unpkg · L9

780try { L781: execSync(`npm install ${driverPackage} --prefix "${globalDir}"`, { L782: stdio: 'pipe',

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

storm.mjsView on unpkg · L780

Findings

3 High2 Medium3 Low

HighChild Processstorm.mjs

HighShell

HighRuntime Package Installstorm.mjs

MediumNetwork

MediumStructural Risk Force Deep Review

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

storm.mjsView file

Lines 1-29javascript

1#!/usr/bin/env node

2// Storm CLI - AI assistant configuration tool

3// https://orm.st

4//

5// Zero dependencies. Requires Node.js 18+.

7import { writeFileSync, appendFileSync, mkdirSync, existsSync, readFileSync, readdirSync, unlinkSync, rmdirSync, statSync } from 'fs';

8import { basename, join, dirname } from 'path';

9import { homedir } from 'os';

10import { execSync, spawn } from 'child_process';

High

Child Process

Package source references child process execution.

storm.mjsView on unpkg · L9

12const VERSION = '1.11.6';

16const RESET = '\x1b[0m';

17const BOLD = '\x1b[1m';

18const DIM = '\x1b[2m';

19const HIDE_CURSOR = '\x1b[?25l';

20const SHOW_CURSOR = '\x1b[?25h';

21const CLEAR = '\x1b[2J';

22const HOME = '\x1b[H';

23const CLEAR_DOWN = '\x1b[J';

25const DB = '\x1b[38;5;244m';

26const DB_DIM = '\x1b[38;5;242m';

27const DB_GLOW = '\x1b[38;5;247m';

28const DB_DIM_GLOW = '\x1b[38;5;243m';

29const BOLT_BASE = '\x1b[38;5;226m';

Lines 760-800javascript

760

761 const packageJsonPath = join(globalDir, 'package.json');

762 if (!existsSync(packageJsonPath)) {

763 writeFileSync(packageJsonPath, '{"private":true}\n');

764 }

765

766 // Always overwrite server.mjs to keep in sync with CLI version.

767 writeFileSync(