registry / @teamvelix/cli / 5.3.2

@teamvelix/cli@5.3.2

Velix v5 CLI — Create, develop, and build Velix applications

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 7 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessFilesystem

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 8 file(s), 31.5 KB of source, external domains: github.com, teamvelix.vercel.app

Source & flagged code

2 flagged

dist/build-UNC2I4XB.jsView file

Lines 1-43javascript

1import {

2 log,

3 showBanner

4} from "./chunk-A7YBQRHF.js";

6// commands/build.ts

7import fs from "fs";

8import path from "path";

9async function buildCommand() {

10 showBanner();

11 log.info("Building for production...");

12 const { spawn } = await import("child_process");

13 const cwd = process.cwd();

High

Child Process

Package source references child process execution.

dist/build-UNC2I4XB.jsView on unpkg · L11

14 const candidates = [

15 path.join(cwd, "node_modules", "@teamvelix", "velix", "dist", "runtime", "start-build.js"),

16 path.join(cwd, "packages", "velix", "dist", "runtime", "start-build.js"),

17 path.join(cwd, "packages", "velix", "runtime", "start-build.ts")

18 ];

19 const buildScript = candidates.find((c) => fs.existsSync(c));

20 if (!buildScript) {

21 log.error("Could not find Velix runtime. Run `npm install` first.");

22 process.exit(1);

23 }

24 const child = spawn(`npx tsx "${buildScript}"`, {

25 stdio: "inherit",

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/build-UNC2I4XB.jsView on unpkg · L23

26 cwd,

27 shell: true

28 });

29 child.on("error", (err) => {

30 log.error(`Failed to build: ${err.message}`);

31 process.exit(1);

32 });

33}

34async function startCommand() {

35 showBanner();

36 log.info("Starting production server...");

37 const { spawn } = await import("child_process");

38 const cwd = process.cwd();

39 const candidates = [

40 path.join(cwd, "node_modules", "@teamvelix", "velix", "dist", "runtime", "start-prod.js"),

41 path.join(cwd, "packages", "velix", "dist", "runtime", "start-prod.js"),

42 path.join(cwd, "packages", "velix", "runtime", "start-prod.ts")

43 ];

Source & flagged code

2 flagged · loading source

dist/build-UNC2I4XB.jsView file

11log.info("Building for production..."); L12: const { spawn } = await import("child_process"); L13: const cwd = process.cwd();

High

Child Process

Package source references child process execution.

dist/build-UNC2I4XB.jsView on unpkg · L11

23} L24: const child = spawn(`npx tsx "${buildScript}"`, { L25: stdio: "inherit",

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/build-UNC2I4XB.jsView on unpkg · L23

Findings

2 High1 Medium4 Low

HighChild Processdist/build-UNC2I4XB.js

HighRuntime Package Installdist/build-UNC2I4XB.js

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

dist/build-UNC2I4XB.jsView file

Lines 1-43javascript

1import {

2 log,

3 showBanner

4} from "./chunk-A7YBQRHF.js";

6// commands/build.ts

7import fs from "fs";

8import path from "path";

9async function buildCommand() {

10 showBanner();

11 log.info("Building for production...");

12 const { spawn } = await import("child_process");

13 const cwd = process.cwd();

High

Child Process

Package source references child process execution.

dist/build-UNC2I4XB.jsView on unpkg · L11

14 const candidates = [

15 path.join(cwd, "node_modules", "@teamvelix", "velix", "dist", "runtime", "start-build.js"),

16 path.join(cwd, "packages", "velix", "dist", "runtime", "start-build.js"),

17 path.join(cwd, "packages", "velix", "runtime", "start-build.ts")

18 ];

19 const buildScript = candidates.find((c) => fs.existsSync(c));

20 if (!buildScript) {

21 log.error("Could not find Velix runtime. Run `npm install` first.");

22 process.exit(1);

23 }

24 const child = spawn(`npx tsx "${buildScript}"`, {

25 stdio: "inherit",

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/build-UNC2I4XB.jsView on unpkg · L23

26 cwd,

27 shell: true

28 });

29 child.on("error", (err) => {

30 log.error(`Failed to build: ${err.message}`);

31 process.exit(1);

32 });

33}

34async function startCommand() {

35 showBanner();

36 log.info("Starting production server...");

37 const { spawn } = await import("child_process");

38 const cwd = process.cwd();

39 const candidates = [

40 path.join(cwd, "node_modules", "@teamvelix", "velix", "dist", "runtime", "start-prod.js"),

41 path.join(cwd, "packages", "velix", "dist", "runtime", "start-prod.js"),

42 path.join(cwd, "packages", "velix", "runtime", "start-prod.ts")

43 ];