registry / @tailor-platform/sdk / 1.70.1

@tailor-platform/sdk@1.70.1

Tailor Platform SDK - The SDK to work with Tailor Platform

Static Scan Results

scanned 8d ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNativeBindingsNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 67 file(s), 1.73 MB of source, external domains: api.tailor.tech, app.example.com, console.tailor.tech, placeholder.invalid, sdk-error-tracking-926vh9t4cl.erp.dev

Source & flagged code

6 flagged

package.jsonView file

Lines 226-252json

226 "node": ">=22"

227 },

228 "scripts": {

229 "test": "vitest",

230 "test:unit": "vitest --project=unit*",

231 "test:e2e": "vitest --project=e2e",

232 "test:coverage": "vitest --coverage",

233 "docs:check": "vitest run --project=unit* src/cli/docs.test.ts",

234 "docs:update": "POLITTY_DOCS_UPDATE=true vitest run --project=unit* src/cli/docs.test.ts",

235 "build": "tsdown && politty generate-worker --bin dist/cli/index.mjs --program tailor-sdk --shell zsh --verify",

236 "lint": "oxlint --type-aware .",

237 "check:public-api-jsdoc": "tsx scripts/check-public-api-jsdoc.ts",

238 "check:zod-isolation": "tsx scripts/check-zod-isolation.ts",

239 "check:import-cycles": "tsx scripts/check-import-cycles.ts",

240 "lint:fix": "oxlint --type-aware . --fix",

241 "typecheck": "tsc --noEmit",

242 "typecheck:go": "tsgo",

243 "perf:typecheck": "bash scripts/perf/exec.sh",

244 "perf:runtime": "bash scripts/perf/runtime-perf.sh",

245 "prepublish": "pnpm run build",

246 "postinstall": "node postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L246

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L246

247 "measure:bundle": "node ../../scripts/measure-bundle-size-sonda.js",

248 "knip": "knip",

249 "publint": "publint --strict",

250 "generate": "zinfer && node -e \"const f=require('fs').readdirSync('src/types').filter(f=>f.endsWith('.generated.ts')).map(f=>'src/types/'+f);if(f.length)require('child_process').execSync('pnpm oxfmt --write '+f.join(' '),{stdio:'inherit'})\""

251 }

252}

dist/runtime-BpHVwifd.mjsView file

43import { setTimeout as setTimeout$2 } from "node:timers/promises"; L44: import { spawn } from "node:child_process"; L45: import { watch } from "chokidar";

High

Child Process

Package source references child process execution.

dist/runtime-BpHVwifd.mjsView on unpkg · L43

43Cross-file remote execution chain: dist/runtime-BpHVwifd.mjs spawns dist/application-DmjIKQ-a.mjs; helper contains network access plus dynamic code execution. L43: import { setTimeout as setTimeout$2 } from "node:timers/promises"; L44: import { spawn } from "node:child_process"; L45: import { watch } from "chokidar"; ... L112: function loadEnvFiles(envFiles, envFilesIfExists) { L113: const originalEnvKeys = new Set(Object.keys(process.env)); L114: const load = (files, required) => { L115: for (const file of [files ?? []].flat()) { L116: const envPath = path.resolve(process.cwd(), file); L117: if (!fs$1.existsSync(envPath)) { ... L134: * NOTE: --env-file and --env-file-if-exists collide with Node.js flags due to a bug L135: * (https://github.com/nodejs/node/issues/54232). Node.js parses these even after the L136: * script path, causing warnings (twice due to tsx loader).

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/runtime-BpHVwifd.mjsView on unpkg · L43

7044* Create a snapshot field config from an OperatorFieldConfig (for nested fields) L7045: * @param {import("#/parser/service/tailordb/types").OperatorFieldConfig} fieldConfig - Field configuration L7046: * @returns {SnapshotFieldConfig} Snapshot field configuration

dist/completion/zsh-worker.zshView file

•path = dist/completion/zsh-worker.zsh kind = build_helper sizeBytes = 445349 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/completion/zsh-worker.zshView on unpkg

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/runtime-BpHVwifd.mjsView file

43import { setTimeout as setTimeout$2 } from "node:timers/promises"; L44: import { spawn } from "node:child_process"; L45: import { watch } from "chokidar";

High

Child Process

Package source references child process execution.

dist/runtime-BpHVwifd.mjsView on unpkg · L43

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/runtime-BpHVwifd.mjsView on unpkg · L43

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/runtime-BpHVwifd.mjsView on unpkg · L7044

dist/completion/zsh-worker.zshView file

•path = dist/completion/zsh-worker.zsh kind = build_helper sizeBytes = 445349 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/completion/zsh-worker.zshView on unpkg

Findings

4 High6 Medium4 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/runtime-BpHVwifd.mjs

HighShell

HighCross File Remote Execution Contextdist/runtime-BpHVwifd.mjs

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requiredist/runtime-BpHVwifd.mjs

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperdist/completion/zsh-worker.zsh

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

6 flagged

package.jsonView file

Lines 226-252json

226 "node": ">=22"

227 },

228 "scripts": {

229 "test": "vitest",

230 "test:unit": "vitest --project=unit*",

231 "test:e2e": "vitest --project=e2e",

232 "test:coverage": "vitest --coverage",

233 "docs:check": "vitest run --project=unit* src/cli/docs.test.ts",

234 "docs:update": "POLITTY_DOCS_UPDATE=true vitest run --project=unit* src/cli/docs.test.ts",

235 "build": "tsdown && politty generate-worker --bin dist/cli/index.mjs --program tailor-sdk --shell zsh --verify",

236 "lint": "oxlint --type-aware .",

237 "check:public-api-jsdoc": "tsx scripts/check-public-api-jsdoc.ts",

238 "check:zod-isolation": "tsx scripts/check-zod-isolation.ts",

239 "check:import-cycles": "tsx scripts/check-import-cycles.ts",

240 "lint:fix": "oxlint --type-aware . --fix",

241 "typecheck": "tsc --noEmit",

242 "typecheck:go": "tsgo",

243 "perf:typecheck": "bash scripts/perf/exec.sh",

244 "perf:runtime": "bash scripts/perf/runtime-perf.sh",

245 "prepublish": "pnpm run build",

246 "postinstall": "node postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L246

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L246

247 "measure:bundle": "node ../../scripts/measure-bundle-size-sonda.js",

248 "knip": "knip",

249 "publint": "publint --strict",

251 }

252}

dist/runtime-BpHVwifd.mjsView file

43import { setTimeout as setTimeout$2 } from "node:timers/promises"; L44: import { spawn } from "node:child_process"; L45: import { watch } from "chokidar";

High

Child Process

Package source references child process execution.

dist/runtime-BpHVwifd.mjsView on unpkg · L43

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/runtime-BpHVwifd.mjsView on unpkg · L43

dist/completion/zsh-worker.zshView file

•path = dist/completion/zsh-worker.zsh kind = build_helper sizeBytes = 445349 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/completion/zsh-worker.zshView on unpkg