registry / @streetjs/cli / 1.2.7

@streetjs/cli@1.2.7

⚠ Under review

Street Framework CLI — scaffold, generate, migrate, and run TypeScript backend projects.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 16 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 26 file(s), 445 KB of source, external domains: admin.example.com, app.example.com, esm.sh, github.com, hassanmubiru.github.io, htmx.org, nodejs.org, plugins.streetjs.dev, unpkg.com, www.npmjs.com

Source & flagged code

7 flagged

dist/commands/start.jsView file

Lines 1-22javascript

1// packages/cli/src/commands/start.ts

2// `street start` — runs the compiled production server.

3import { spawn } from 'node:child_process';

4import { existsSync } from 'node:fs';

High

Child Process

Package source references child process execution.

dist/commands/start.jsView on unpkg · L2

5import { resolve, join } from

Source & flagged code

7 flagged · loading source

dist/commands/start.jsView file

2// `street start` — runs the compiled production server. L3: import { spawn } from 'node:child_process'; L4: import { existsSync } from 'node:fs';

High

Child Process

Package source references child process execution.

dist/commands/start.jsView on unpkg · L2

dist/commands/test.jsView file

76stdio: 'inherit', L77: shell: true, L78: });

High

Shell

Package source references shell execution.

dist/commands/test.jsView on unpkg · L76

73return new Promise((resolvePromise, reject) => { L74: const tsc = spawn('npx', ['tsc', '--project', 'tsconfig.json'], { L75: cwd: projectDir,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/commands/test.jsView on unpkg · L73

dist/commands/create.jsView file

398constructor( L399: private readonly orgs: OrgRepository, L400: private readonly members: MembershipWriteRepository, ... L672: L673: const token = randomBytes(32).toString('base64url'); // unique invite token L674: const expiresAt = new Date(Date.now() + INVITE_TTL_MS); ... L816: /** Environment label embedded in the prefix (e.g. "live", "test"). */ L817: private readonly environment: string = process.env['NODE_ENV'] === 'production' ? 'live' : 'test', L818: ) {} ... L1443: type: string; L1444: data: { object: Record<string, unknown> }; L1445: }

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/commands/create.jsView on unpkg · L398

398Trigger-reachable chain: manifest.main -> dist/index.js -> dist/commands/create.js L398: constructor( L399: private readonly orgs: OrgRepository, L400: private readonly members: MembershipWriteRepository, ... L672: L673: const token = randomBytes(32).toString('base64url'); // unique invite token L674: const expiresAt = new Date(Date.now() + INVITE_TTL_MS); ... L816: /** Environment label embedded in the prefix (e.g. "live", "test"). */ L817: private readonly environment: string = process.env['NODE_ENV'] === 'production' ? 'live' : 'test', L818: ) {} ... L1443: type: string; L1444: data: { object: Record<string, unknown> }; L1445: }

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/commands/create.jsView on unpkg · L398

dist/commands/generate.jsView file

94package = @streetjs/cli; repositoryIdentity = streetjs; dependency = streetjs L94: const output = String(ctx.args.flags['output'] ?? './sdk'); L95: const core = await import('streetjs'); L96: let specRaw;

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/commands/generate.jsView on unpkg · L94

dist/commands/add.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @streetjs/cli@1.2.1 matchedIdentity = npm:QHN0cmVldGpzL2NsaQ:1.2.1 similarity = 0.962 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/commands/add.jsView on unpkg

Findings

3 Critical4 High4 Medium5 Low

CriticalCredential Exfiltrationdist/commands/create.js

CriticalTrigger Reachable Dangerous Capabilitydist/commands/create.js

CriticalPrevious Version Dangerous Deltadist/commands/add.js

HighChild Processdist/commands/start.js

HighShelldist/commands/test.js

HighCopied Package Dependency Bridgedist/commands/generate.js

HighRuntime Package Installdist/commands/test.js

MediumDynamic Require

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

dist/commands/test.jsView file

Lines 53-93javascript

53 NODE_ENV: 'test',

54 },

55 });

56 runner.on('close', (code) => {

57 if (code === 0) {

58 console.log('\n[street] All tests passed.');

59 resolvePromise();

60 }

61 else {

62 console.error(`\n[street] Tests failed with exit code ${code}`);

63 process.exitCode = code ?? 1;

64 resolvePromise();

65 }

66 });

67 runner.on('error', (err) => {

68 reject(new Error(`Failed to run tests: ${err.message}`));

69 });

70 });

71 }

72 compile(projectDir) {

73 return new Promise((resolvePromise, reject) => {

74 const tsc = spawn('npx', ['tsc', '--project', 'tsconfig.json'], {

75 cwd: projectDir,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/commands/test.jsView on unpkg · L73

76 stdio: 'inherit',

77 shell: true,

78 });

High

Shell

Package source references shell execution.

dist/commands/test.jsView on unpkg · L76

79 tsc.on('close', (code) => {

80 if (code === 0) {

81 resolvePromise();

82 }

83 else {

84 reject(new Error(`TypeScript compilation failed with exit code ${code}`));

85 }

86 });

87 tsc.on('error', (err) => {

88 reject(new Error(`Failed to start TypeScript compiler: ${err.message}`));

89 });

90 });

91 }

92}

93//# sourceMappingURL=test.js.map

dist/commands/create.jsView file

Lines 378-418javascript

378 user_id: string;

379 role: Role;

380}

381

382/** Persistence contract OrgService relies on (satisfied by @streetjs/orm repos). */

383export interface OrgRepository {

384 findBySlug(slug: string): Promise<Organization | null>;

385 /** Organizations the user holds a membership in. */

386 findForUser(userId: string): Promise<Organization[]>;

387 insert(values: { name: string; slug: string; owner_id: string }): Promise<Organization>;

388}

389

390export interface MembershipWriteRepository {

391 insert(values: { org_id: string; user_id: string; role: Role }): Promise<Membership>;

392}

393

394/** Runs a unit of work in a transaction; defaults to a pass-through for tests. */

395export type TxRunner = <T>(fn: () => Promise<T>) => Promise<T>;

396

397export class OrgService {

398 constructor(

399 private readonly orgs: OrgRepository,

400 private readonly members: MembershipWriteRepository,

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/commands/create.jsView on unpkg · L398

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/commands/create.jsView on unpkg · L398

401 private readonly tx: TxRunner = (fn) => fn(),

402 ) {}

403

404 /**

405 * create — persist an organization and grant the creator the \`owner\` role.

406 *

407 * The slug is checked first: a duplicate slug rejects with 409 and NO

408 * \`organizations\` or \`memberships\` row is written. Otherwise the org row and

409 * the owner membership row are written together inside one transaction.

410 */

411 async create(actorId: string, input: { name: string; slug: string }): Promise<Organization> {

412 const existing = await this.orgs.findBySlug(input.slug);

413 if (existing) {

414 throw new ConflictException(\`organization slug "\${input.slug}" already exists\`);

415 }

416

417 return this.tx(async () => {

418 const org = await this.orgs.insert({

dist/commands/generate.jsView file

Lines 74-114javascript

74 await this.generateRepository(cwd, className, fileName, pluralName);

75 break;

76 case 'middleware':

77 await generateMiddleware(name, cwd);

78 break;

79 case 'gateway':

80 await generateGateway(name, cwd);

81 break;

82 case 'migration':

83 await generateMigration(name, cwd);

84 break;

85 }

86 if (type !== 'middleware' && type !== 'gateway' && type !== 'migration') {

87 console.log(`[street] Generated ${type}: src/${this.toPlural(type)}/${fileName}.${type}.ts`);

88 }

89 }

90 /** `street generate sdk --lang <typescript|python> --spec <openapi.json> --output <dir>` */

91 async generateSdk(ctx) {

92 const lang = String(ctx.args.flags['lang'] ?? 'typescript');

93 const specPath = String(ctx.args.flags['spec'] ?? 'openapi.json');

94 const output = String(ctx.args.flags['output'] ?? './sdk');

95 const core = await import('streetjs');

96 let specRaw;

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/commands/generate.jsView on unpkg · L94

97 try {

98 specRaw = await readFile(resolve(ctx.cwd, specPath), 'utf8');

99 }

100 catch {

101 console.error(`[street] Could not read OpenAPI spec at "${specPath}". Pass --spec <path>.`);

102 process.exitCode = 1;

103 return;

104 }

105 const spec = JSON.parse(specRaw);

106 const outDir = resolve(ctx.cwd, output);

107 if (lang === 'python') {

108 await core.generatePythonSdk(spec, outDir);

109 console.log(`[street] Generated Python SDK in ${output}/ (models.py, client.py)`);

110 }

111 else {

112 await core.generateTypescriptSdk(spec, outDir);

113 console.log(`[street] Generated TypeScript SDK in ${output}/ (types.ts, api-client.ts)`);

114 }