registry / @techninja/clearstack / 0.4.4

@techninja/clearstack@0.4.4

A no-build web component framework specification — scaffold, validate, and evolve spec-compliant projects

Static Scan Results

scanned 6d ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 55 file(s), 120 KB of source, external domains: data.tn42.com, json-schema.org, www.sitemaps.org

Source & flagged code

4 flagged

templates/shared/.envView file

6patternName = blocked_file severity = critical matchedText = templates/shared/.env redactedSecretContext = secretLikeLines = 1 L6: SPEC_IGNORE_DIRS=<redacted:37 token-like>

Critical

Critical Secret

Package contains a critical-looking secret pattern.

templates/shared/.envView on unpkg · L6

lib/spec-i18n-locales.jsView file

Lines 1-26javascript

1/**

2 * Locale file parsing helpers for i18n spec check.

3 * @module lib/spec-i18n-locales

4 */

6import { readFileSync, readdirSync, existsSync } from 'node:fs';

7import { execSync } from 'node:child_process';

8import { resolve } from 'node:path';

High

Child Process

Package source references child process execution.

lib/spec-i18n-locales.jsView on unpkg · L6

10/**

11 * Try to run `npx hybrids extract ./src` and parse the JSON output.

12 * @param {string} root

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

lib/spec-i18n-locales.jsView on unpkg · L6

13 * @returns {Record<string, object>|null}

14 */

15export function tryHybridsExtract(root) {

16 const srcDir = resolve(root, 'src');

17 if (!existsSync(srcDir)) return null;

18 try {

19 const out = execSync('npx hybrids extract ./src', {

20 cwd: root,

21 encoding: 'utf-8',

22 timeout: 30000,

23 stdio: ['pipe', 'pipe', 'pipe'],

24 });

25 return JSON.parse(out);

26 } catch {

lib/check.jsView file

Lines 7-47javascript

7import { existsSync, readdirSync } from 'node:fs';

8import { resolve } from 'node:path';

9import { checkFileLines, runCmd, countFiles, checkImports } from './spec-utils.js';

10import { checkI18n } from './spec-i18n.js';

Source & flagged code

4 flagged · loading source

templates/shared/.envView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code