registry / @tailor-platform/sdk / 1.74.0

@tailor-platform/sdk@1.74.0

⚠ Under review

Tailor Platform SDK - The SDK to work with Tailor Platform

Static Scan Results

scanned 3d ago · by rust-scanner

Static analysis flagged 15 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNativeBindingsNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 69 file(s), 1.84 MB of source, external domains: api.tailor.tech, app.example.com, console.tailor.tech, placeholder.invalid, sdk-error-tracking-926vh9t4cl.erp.dev

Source & flagged code

7 flagged

package.jsonView file

Lines 231-257json

231 "node": ">=22"

232 },

233 "scripts": {

234 "test": "vitest",

235 "test:unit": "vitest --project=unit*",

236 "test:e2e": "vitest --project=e2e",

237 "test:coverage": "vitest --coverage",

238 "docs:check": "vitest run --project=unit* src/cli/docs.test.ts",

239 "docs:update": "POLITTY_DOCS_UPDATE=true vitest run --project=unit* src/cli/docs.test.ts",

240 "build": "tsdown && politty generate-worker --bin dist/cli/index.mjs --program tailor-sdk --shell zsh --verify",

241 "lint": "oxlint --type-aware .",

242 "check:public-api-jsdoc": "tsx scripts/check-public-api-jsdoc.ts",

243 "check:zod-isolation": "tsx scripts/check-zod-isolation.ts",

244 "check:import-cycles": "tsx scripts/check-import-cycles.ts",

245 "lint:fix": "oxlint --type-aware . --fix",

246 "typecheck": "tsc --noEmit",

247 "typecheck:go": "tsgo",

248 "perf:typecheck": "bash scripts/perf/exec.sh",

249 "perf:runtime": "bash scripts/perf/runtime-perf.sh",

250 "prepublish": "pnpm run build",

251 "postinstall": "node postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L251

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L251

252 "measure:bundle": "node ../../scripts/measure-bundle-size-sonda.js",

253 "knip": "knip",

254 "publint": "publint --strict",

255 "generate": "zinfer && node -e \"const f=require('fs').readdirSync('src/types').filter(f=>f.endsWith('.generated.ts')).map(f=>'src/types/'+f);if(f.length)require('child_process').execSync('pnpm oxfmt --write '+f.join(' '),{stdio:'inherit'})\""

256 }

257}

dist/service-DBFZQloR.mjsView file

Lines 1-24javascript

1import { n as logger, r as styles } from "./logger-BEiZZ3qT.mjs";

2import { t as createCLIError } from "./errors-Dtf2WPaW.mjs";

3import * as path from "pathe";

4import { readPackageJSON } from "pkg-types";

dist/vitest/setup.mjsView file

Lines 64-104javascript

64* @returns Vault store, or null if the value is unusable

65*/

66function extractVaultStore(secrets) {

67 if (!secrets || typeof secrets !== "object") return null;

68 const

dist/cli/index.mjsView file

Lines 8-48javascript

8import { t as multiline } from "../multiline-sfHpTZZK.mjs";

9import { r as isPluginGeneratedType } from "../seed-DoMTMLcm.mjs";

10import { t as readPackageJson } from "../package-json-8b0O9TlX.mjs";

11import { i as userAgent } from "../secret-file-VSVGy1V0.mjs";

dist/completion/zsh-worker.zshView file

•path = dist/completion/zsh-worker.zsh kind = build_helper sizeBytes = 452595 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/completion/zsh-worker.zshView on unpkg

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/service-DBFZQloR.mjsView file

4import { readPackageJSON } from "pkg-types"; L5: import { spawnSync } from "node:child_process"; L6:

High

Child Process

Package source references child process execution.

dist/service-DBFZQloR.mjsView on unpkg · L4

dist/vitest/setup.mjsView file

84try { L85: const config = await import(pathToFileURL(configPath).href); L86: return extractVaultStore(config.default?.secrets ?? config.secrets);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/vitest/setup.mjsView on unpkg · L84

dist/cli/index.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @tailor-platform/sdk@1.72.0 matchedIdentity = npm:QHRhaWxvci1wbGF0Zm9ybS9zZGs:1.72.0 similarity = 0.864 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli/index.mjsView on unpkg

28Cross-file remote execution chain: dist/cli/index.mjs spawns dist/application-DwmoI6ZQ.mjs; helper contains network access plus dynamic code execution. L28: import { createHash } from "node:crypto"; L29: import * as http from "node:http"; L30: import open from "open"; ... L35: import { TraceMap, generatedPositionFor, originalPositionFor } from "@jridgewell/trace-mapping"; L36: import { spawn, spawnSync } from "node:child_process"; L37: import { watch } from "chokidar"; ... L62: if (!response.ok) throw new Error(`Failed to fetch OIDC discovery from ${url}: ${response.status}`); L63: return response.json(); L64: } ... L111: res.writeHead(404); L112: res.end("Not found"); L113: return;

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli/index.mjsView on unpkg · L28

dist/completion/zsh-worker.zshView file

•path = dist/completion/zsh-worker.zsh kind = build_helper sizeBytes = 452595 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/completion/zsh-worker.zshView on unpkg

Findings

1 Critical4 High6 Medium4 Low

CriticalPrevious Version Dangerous Deltadist/cli/index.mjs

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/service-DBFZQloR.mjs

HighShell

HighCross File Remote Execution Contextdist/cli/index.mjs

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requiredist/vitest/setup.mjs

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperdist/completion/zsh-worker.zsh

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

7 flagged

package.jsonView file

Lines 231-257json

231 "node": ">=22"

232 },

233 "scripts": {

234 "test": "vitest",

235 "test:unit": "vitest --project=unit*",

236 "test:e2e": "vitest --project=e2e",

237 "test:coverage": "vitest --coverage",

238 "docs:check": "vitest run --project=unit* src/cli/docs.test.ts",

239 "docs:update": "POLITTY_DOCS_UPDATE=true vitest run --project=unit* src/cli/docs.test.ts",

240 "build": "tsdown && politty generate-worker --bin dist/cli/index.mjs --program tailor-sdk --shell zsh --verify",

241 "lint": "oxlint --type-aware .",

242 "check:public-api-jsdoc": "tsx scripts/check-public-api-jsdoc.ts",

243 "check:zod-isolation": "tsx scripts/check-zod-isolation.ts",

244 "check:import-cycles": "tsx scripts/check-import-cycles.ts",

245 "lint:fix": "oxlint --type-aware . --fix",

246 "typecheck": "tsc --noEmit",

247 "typecheck:go": "tsgo",

248 "perf:typecheck": "bash scripts/perf/exec.sh",

249 "perf:runtime": "bash scripts/perf/runtime-perf.sh",

250 "prepublish": "pnpm run build",

251 "postinstall": "node postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L251

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L251

252 "measure:bundle": "node ../../scripts/measure-bundle-size-sonda.js",

253 "knip": "knip",

254 "publint": "publint --strict",

256 }

257}

dist/service-DBFZQloR.mjsView file

Lines 1-24javascript

1import { n as logger, r as styles } from "./logger-BEiZZ3qT.mjs";

2import { t as createCLIError } from "./errors-Dtf2WPaW.mjs";

3import * as path from "pathe";

4import { readPackageJSON } from "pkg-types";

dist/vitest/setup.mjsView file

Lines 64-104javascript

64* @returns Vault store, or null if the value is unusable

65*/

66function extractVaultStore(secrets) {

67 if (!secrets || typeof secrets !== "object") return null;

68 const

dist/cli/index.mjsView file

Lines 8-48javascript

8import { t as multiline } from "../multiline-sfHpTZZK.mjs";

9import { r as isPluginGeneratedType } from "../seed-DoMTMLcm.mjs";

10import { t as readPackageJson } from "../package-json-8b0O9TlX.mjs";

11import { i as userAgent } from "../secret-file-VSVGy1V0.mjs";

dist/completion/zsh-worker.zshView file

•path = dist/completion/zsh-worker.zsh kind = build_helper sizeBytes = 452595 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/completion/zsh-worker.zshView on unpkg