registry / @techninja/clearstack / 0.3.49

@techninja/clearstack@0.3.49

A no-build web component framework specification — scaffold, validate, and evolve spec-compliant projects

Static Scan Results

scanned 17d ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 52 file(s), 109 KB of source, external domains: data.tn42.com, json-schema.org, www.sitemaps.org

Source & flagged code

4 flagged

templates/shared/.envView file

6patternName = blocked_file severity = critical matchedText = templates/shared/.env redactedSecretContext = secretLikeLines = 1 L6: SPEC_IGNORE_DIRS=<redacted:37 token-like>

Critical

Critical Secret

Package contains a critical-looking secret pattern.

templates/shared/.envView on unpkg · L6

lib/spec-utils.jsView file

Lines 1-28javascript

1/**

2 * Shared spec utilities — file scanning, command running, timing.

3 * Used by both the clearstack CLI and the POC spec runner.

4 * @module lib/spec-utils

5 */

7import { readFileSync, readdirSync } from 'node:fs';

8import { resolve, extname, relative } from 'node:path';

9import { execSync } from 'node:child_process';

High

Child Process

Package source references child process execution.

lib/spec-utils.jsView on unpkg · L8

11/** @param {number} start */

12export function elapsed(start) {

13 const d = performance.now() - start;

14 return d < 1000 ? `${Math.round(d)}ms` : `${(d / 1000).toFixed(1)}s`;

15}

17/** Recursively find files matching extensions, skipping ignored dirs. */

18export function findFiles(dir, extensions, ignoreDirs, root = dir) {

19 const results = [];

20 for (const entry of readdirSync(dir, { withFileTypes: true })) {

21 const full = resolve(dir, entry.name);

22 const rel = relative(root, full);

23 if (entry.isDirectory()) {

24 if (ignoreDirs.some((ig) => entry.name === ig || rel === ig || rel.startsWith(ig + '/'))) continue;

25 results.push(...findFiles(full, extensions, ignoreDirs, root));

26 } else if (extensions.includes(extname(entry.name))) {

27 results.push(rel);

28 }

lib/report.jsView file

Lines 78-107javascript

78 console.log(` Checks: ${summary.passed}/${summary.totalChecks} passed`);

79 console.log(` Project size: ${summary.totalFiles} files`);

80 console.log(` Compliance: ${

templates/shared/scripts/test.jsView file

Lines 26-58javascript

26 return results;

27}

29const componentDir = resolve(ROOT, 'src/components');

30const allTests =

Source & flagged code

4 flagged · loading source

templates/shared/.envView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code