registry / @systembug/qingniao / 0.1.0

@systembug/qingniao@0.1.0

青鸟 - 零配置优先的通用发布工具，专为 monorepo 项目设计

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 8 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 11 file(s), 187 KB of source, external domains: github.com, registry.npmjs.org

Source & flagged code

2 flagged

dist/messages-Gc4q6t6X.cjsView file

Lines 13-53javascript

13 });

14 if (!no_symbols) __defProp(target, Symbol.toStringTag, { value: "Module" });

15 return target;

16};

17var __copyProps = (to, from, except, desc) => {

18 if (from && typeof from === "object" || typeof from === "function") for (var keys = __getOwnPropNames(from), i = 0, n = keys.length, key; i < n; i++) {

19 key = keys[i];

20 if (!__hasOwnProp.call(to, key) && key !== except) __defProp(to, key, {

21 get: ((k) => from[k]).bind(null, key),

22 enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable

23 });

24 }

25 return to;

26};

27var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", {

28 value: mod,

29 enumerable: true

30}) : target, mod));

31//#endregion

32let fs = require("fs");

33let path = require("path");

34let child_process = require("child_process");

35let inquirer = require("inquirer");

High

Child Process

Package source references child process execution.

dist/messages-Gc4q6t6X.cjsView on unpkg · L33

36inquirer = __toESM(inquirer, 1);

37let _systembug_tongyu = require("@systembug/tongyu");

38//#region src/utils/exec.ts

39/**

40* 命令执行工具

41*/

42var DEFAULT_TIMEOUT = 1800 * 1e3;

43/**

44* 执行命令（支持超时）

45*/

46function exec(command, options = {}) {

47 const { silent = false, cwd = process.cwd(), encoding = "utf-8", timeout = DEFAULT_TIMEOUT, description } = options;

48 try {

49 const execOptions = {

50 stdio: silent ? "pipe" : "inherit",

51 cwd,

52 encoding

53 };

dist/executor-Dw9gdMU_.jsView file

Lines 684-724javascript

684 timeout: 600 * 1e3,

685 description: "代码检查 (lint)"

686 });

687 lintSpinner.succeed();

688 } catch (error) {

689 abortPublishStep(lintSpinner, error, "lint", t("lintFailed"));

Source & flagged code

2 flagged · loading source

dist/messages-Gc4q6t6X.cjsView file

33let path = require("path"); L34: let child_process = require("child_process"); L35: let inquirer = require("inquirer");

High

Child Process

Package source references child process execution.

dist/messages-Gc4q6t6X.cjsView on unpkg · L33

dist/executor-Dw9gdMU_.jsView file

704if (isMissingScriptError(firstMsg)) try { L705: exec(`npx prettier --check "**/*.{ts,tsx,md}"`, { L706: cwd: rootDir,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/executor-Dw9gdMU_.jsView on unpkg · L704

Findings

3 High1 Medium4 Low

HighChild Processdist/messages-Gc4q6t6X.cjs

HighShell

HighRuntime Package Installdist/executor-Dw9gdMU_.js

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

dist/messages-Gc4q6t6X.cjsView file

Lines 13-53javascript

13 });

14 if (!no_symbols) __defProp(target, Symbol.toStringTag, { value: "Module" });

15 return target;

16};

17var __copyProps = (to, from, except, desc) => {

18 if (from && typeof from === "object" || typeof from === "function") for (var keys = __getOwnPropNames(from), i = 0, n = keys.length, key; i < n; i++) {

19 key = keys[i];

20 if (!__hasOwnProp.call(to, key) && key !== except) __defProp(to, key, {

21 get: ((k) => from[k]).bind(null, key),

22 enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable

23 });

24 }

25 return to;

26};

27var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", {

28 value: mod,

29 enumerable: true

30}) : target, mod));

31//#endregion

32let fs = require("fs");

33let path = require("path");

34let child_process = require("child_process");

35let inquirer = require("inquirer");

High

Child Process

Package source references child process execution.

dist/messages-Gc4q6t6X.cjsView on unpkg · L33

36inquirer = __toESM(inquirer, 1);

37let _systembug_tongyu = require("@systembug/tongyu");

38//#region src/utils/exec.ts

39/**

40* 命令执行工具

41*/

42var DEFAULT_TIMEOUT = 1800 * 1e3;

43/**

44* 执行命令（支持超时）

45*/

46function exec(command, options = {}) {

47 const { silent = false, cwd = process.cwd(), encoding = "utf-8", timeout = DEFAULT_TIMEOUT, description } = options;

48 try {

49 const execOptions = {

50 stdio: silent ? "pipe" : "inherit",

51 cwd,

52 encoding

53 };

dist/executor-Dw9gdMU_.jsView file

Lines 684-724javascript

684 timeout: 600 * 1e3,

685 description: "代码检查 (lint)"

686 });

687 lintSpinner.succeed();

688 } catch (error) {

689 abortPublishStep(lintSpinner, error, "lint", t("lintFailed"));