registry / @tailor-platform/sdk / 1.72.0

@tailor-platform/sdk@1.72.0

Tailor Platform SDK - The SDK to work with Tailor Platform

Static Scan Results

scanned 8d ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNativeBindingsNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 67 file(s), 1.78 MB of source, external domains: api.tailor.tech, app.example.com, console.tailor.tech, placeholder.invalid, sdk-error-tracking-926vh9t4cl.erp.dev

Source & flagged code

6 flagged

package.jsonView file

Lines 226-252json

226 "node": ">=22"

227 },

228 "scripts": {

229 "test": "vitest",

230 "test:unit": "vitest --project=unit*",

231 "test:e2e": "vitest --project=e2e",

232 "test:coverage": "vitest --coverage",

233 "docs:check": "vitest run --project=unit* src/cli/docs.test.ts",

234 "docs:update": "POLITTY_DOCS_UPDATE=true vitest run --project=unit* src/cli/docs.test.ts",

235 "build": "tsdown && politty generate-worker --bin dist/cli/index.mjs --program tailor-sdk --shell zsh --verify",

236 "lint": "oxlint --type-aware .",

237 "check:public-api-jsdoc": "tsx scripts/check-public-api-jsdoc.ts",

238 "check:zod-isolation": "tsx scripts/check-zod-isolation.ts",

239 "check:import-cycles": "tsx scripts/check-import-cycles.ts",

240 "lint:fix": "oxlint --type-aware . --fix",

241 "typecheck": "tsc --noEmit",

242 "typecheck:go": "tsgo",

243 "perf:typecheck": "bash scripts/perf/exec.sh",

244 "perf:runtime": "bash scripts/perf/runtime-perf.sh",

245 "prepublish": "pnpm run build",

246 "postinstall": "node postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L246

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L246

247 "measure:bundle": "node ../../scripts/measure-bundle-size-sonda.js",

248 "knip": "knip",

249 "publint": "publint --strict",

250 "generate": "zinfer && node -e \"const f=require('fs').readdirSync('src/types').filter(f=>f.endsWith('.generated.ts')).map(f=>'src/types/'+f);if(f.length)require('child_process').execSync('pnpm oxfmt --write '+f.join(' '),{stdio:'inherit'})\""

251 }

252}

dist/cli/skills.mjsView file

Lines 1-22javascript

1#!/usr/bin/env node

3import { n as logger } from "../logger-DKF-JsAK.mjs";

4import { dirname, resolve } from "pathe";

5import { fileURLToPath } from "node:url";

6import { spawn } from "node:child_process";

dist/vitest/setup.mjsView file

Lines 65-105javascript

65* @returns Vault store, or null if the value is unusable

66*/

67function extractVaultStore(secrets) {

68 if (!secrets || typeof secrets !== "object") return null;

69 const

dist/cli/index.mjsView file

Lines 9-49javascript

9import { t as multiline } from "../multiline-Cf9ODpr1.mjs";

10import { r as isPluginGeneratedType } from "../seed-YAbtMy65.mjs";

11import { t as readPackageJson } from "../package-json-DcQApfPQ.mjs";

12import { i as userAgent } from "../secret-file-eB3R3Fil.mjs";

dist/completion/zsh-worker.zshView file

•path = dist/completion/zsh-worker.zsh kind = build_helper sizeBytes = 451649 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/completion/zsh-worker.zshView on unpkg

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/cli/skills.mjsView file

5import { fileURLToPath } from "node:url"; L6: import { spawn } from "node:child_process"; L7:

High

Child Process

Package source references child process execution.

dist/cli/skills.mjsView on unpkg · L5

dist/vitest/setup.mjsView file

85try { L86: const config = await import(pathToFileURL(configPath).href); L87: return extractVaultStore(config.default?.secrets ?? config.secrets);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/vitest/setup.mjsView on unpkg · L85

dist/cli/index.mjsView file

29Cross-file remote execution chain: dist/cli/index.mjs spawns dist/application-DmjIKQ-a.mjs; helper contains network access plus dynamic code execution. L29: import { createHash } from "node:crypto"; L30: import * as http from "node:http"; L31: import open from "open"; ... L36: import { TraceMap, generatedPositionFor, originalPositionFor } from "@jridgewell/trace-mapping"; L37: import { spawn, spawnSync } from "node:child_process"; L38: import { watch } from "chokidar"; ... L63: if (!response.ok) throw new Error(`Failed to fetch OIDC discovery from ${url}: ${response.status}`); L64: return response.json(); L65: } ... L112: res.writeHead(404); L113: res.end("Not found"); L114: return;

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli/index.mjsView on unpkg · L29

dist/completion/zsh-worker.zshView file

•path = dist/completion/zsh-worker.zsh kind = build_helper sizeBytes = 451649 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/completion/zsh-worker.zshView on unpkg

Findings

4 High6 Medium4 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/cli/skills.mjs

HighShell

HighCross File Remote Execution Contextdist/cli/index.mjs

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requiredist/vitest/setup.mjs

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperdist/completion/zsh-worker.zsh

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

6 flagged

package.jsonView file

Lines 226-252json

226 "node": ">=22"

227 },

228 "scripts": {

229 "test": "vitest",

230 "test:unit": "vitest --project=unit*",

231 "test:e2e": "vitest --project=e2e",

232 "test:coverage": "vitest --coverage",

233 "docs:check": "vitest run --project=unit* src/cli/docs.test.ts",

234 "docs:update": "POLITTY_DOCS_UPDATE=true vitest run --project=unit* src/cli/docs.test.ts",

235 "build": "tsdown && politty generate-worker --bin dist/cli/index.mjs --program tailor-sdk --shell zsh --verify",

236 "lint": "oxlint --type-aware .",

237 "check:public-api-jsdoc": "tsx scripts/check-public-api-jsdoc.ts",

238 "check:zod-isolation": "tsx scripts/check-zod-isolation.ts",

239 "check:import-cycles": "tsx scripts/check-import-cycles.ts",

240 "lint:fix": "oxlint --type-aware . --fix",

241 "typecheck": "tsc --noEmit",

242 "typecheck:go": "tsgo",

243 "perf:typecheck": "bash scripts/perf/exec.sh",

244 "perf:runtime": "bash scripts/perf/runtime-perf.sh",

245 "prepublish": "pnpm run build",

246 "postinstall": "node postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L246

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L246

247 "measure:bundle": "node ../../scripts/measure-bundle-size-sonda.js",

248 "knip": "knip",

249 "publint": "publint --strict",

251 }

252}

dist/cli/skills.mjsView file

Lines 1-22javascript

1#!/usr/bin/env node

3import { n as logger } from "../logger-DKF-JsAK.mjs";

4import { dirname, resolve } from "pathe";

5import { fileURLToPath } from "node:url";

6import { spawn } from "node:child_process";

dist/vitest/setup.mjsView file

Lines 65-105javascript

65* @returns Vault store, or null if the value is unusable

66*/

67function extractVaultStore(secrets) {

68 if (!secrets || typeof secrets !== "object") return null;

69 const

dist/cli/index.mjsView file

Lines 9-49javascript

9import { t as multiline } from "../multiline-Cf9ODpr1.mjs";

10import { r as isPluginGeneratedType } from "../seed-YAbtMy65.mjs";

11import { t as readPackageJson } from "../package-json-DcQApfPQ.mjs";

12import { i as userAgent } from "../secret-file-eB3R3Fil.mjs";

dist/completion/zsh-worker.zshView file

•path = dist/completion/zsh-worker.zsh kind = build_helper sizeBytes = 451649 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/completion/zsh-worker.zshView on unpkg