registry / @treeseed/core / 0.12.42

@treeseed/core@0.12.42

Treeseed web framework package for Astro/Starlight site runtimes.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

CopyleftLicense

scanned 205 file(s), 1.07 MB of source, external domains: api.treeseed.dev, challenges.cloudflare.com, docs.astro.build, example.com, github.com, pagefind.app, starlight.astro.build, treeseed.dev

Source & flagged code

4 flagged

dist/dev.jsView file

Lines 1-21javascript

1import { appendFileSync, closeSync, existsSync, mkdirSync, openSync, readFileSync, readSync, readdirSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";

2import { spawn, spawnSync } from "node:child_process";

3import { createHash } from "node:crypto";

High

Child Process

Package source references child process execution.

dist/dev.jsView on unpkg · L1

4import { createRequire } from "node:module";

5import { homedir } from "node:os";

6import { dirname, isAbsolute, relative, resolve, sep } from "node:path";

7import { fileURLToPath } from "node:url";

8import { setTimeout as delay } from "node:timers/promises";

9import { DatabaseSync } from "node:sqlite";

10import {

11 applyTreeseedEnvironmentToProcess,

12 assertTreeseedCommandEnvironment,

13 createPersistentDeployTarget,

14 ensureGeneratedWranglerConfig,

15 ensureLocalWorkspaceLinks,

16 findNearestTreeseedWorkspaceRoot,

17 packageScriptPath,

18 resolveTreeseedMachineEnvironmentValues,

19 resolveTreeseedToolBinary,

20 resolveWranglerBin,

21 runTreeseedGit

Lines 2063-2103javascript

2063 return {

2064 ...step,

2065 status: "completed",

2066 detail: [result.stdout, result.stderr].filter(Boolean).join("\n").trim() || step.detail

2067 };

2068 }

2069 const timedOut = result.error && "code" in result.error && result.error.code === "ETIMEDOUT";

2070 const timeoutDetail = timedOut ? `${step.label} timed out after ${Math.round(DEFAULT_SETUP_STEP_TIMEOUT_MS / 1e3)} seconds.` : null;

2071 return {

2072 ...step,

2073 status: step.required ? "failed" : "degraded",

2074 detail: [timeoutDetail, result.stdout, result.stderr].filter(Boolean).join("\n").trim() || `Exited with ${result.status ?? 1}.`

2075 };

2076}

2077function marketPostgresConfig(env) {

2078 return {

2079 container: env.TREESEED_MARKET_LOCAL_POSTGRES_CONTAINER?.trim() || TREESEED_DEFAULT_MARKET_POSTGRES_CONTAINER,

2080 volume: env.TREESEED_MARKET_LOCAL_POSTGRES_VOLUME?.trim() || TREESEED_DEFAULT_MARKET_POSTGRES_VOLUME,

2081 port: env.TREESEED_MARKET_LOCAL_POSTGRES_PORT?.trim() || String(TREESEED_DEFAULT_MARKET_POSTGRES_PORT),

2082 user: "treeseed",

2083 password: "treeseed",

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/dev.jsView on unpkg · L2083

2084 database: "market_local"

2085 };

2086}

2087function dockerBinary(env) {

2088 return resolveTreeseedToolBinary("docker", { env }) ?? "docker";

2089}

2090function spawnDocker(args, env, deps, timeout = 3e4) {

2091 return deps.spawnSync(dockerBinary(env), args, {

2092 cwd: process.cwd(),

2093 env,

2094 encoding: "utf8",

2095 timeout

2096 });

2097}

2098function dockerResultText(result) {

2099 return [result.stdout, result.stderr].filter(Boolean).join("\n").trim();

2100}

2101function dockerVolumeIsMissing(result) {

2102 if (result.error) return false;

2103 const text = dockerResultText(result).toLowerCase();

dist/scripts/verify-driver.jsView file

Lines 1-26javascript

1#!/usr/bin/env node

2import { spawnSync } from 'node:child_process';

3import { existsSync } from 'node:fs';

4import { createRequire } from 'node:module';

5import { resolve } from 'node:path';

6import { pathToFileURL } from 'node:url';

7const require = createRequire(import.meta.url);

8function hasSourceRunnerDependencies() {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/scripts/verify-driver.jsView on unpkg · L6

9 try {

10 require.resolve('esbuild');

11 return true;

12 }

13 catch {

14 return false;

15 }

16}

17function ensureSourceRunnerDependencies() {

18 if (hasSourceRunnerDependencies()) {

19 return;

20 }

21 const result = spawnSync('npm', ['install'], {

22 cwd: process.cwd(),

23 env: { ...process.env, npm_config_ignore_scripts: 'true' },

24 stdio: 'inherit',

25 });

26 if (result.status !== 0) {

dist/scripts/run-fixture-astro-command.jsView file

Lines 13-50javascript

13 packageRoot,

14 declarations: [

15 {

16 packageName: '@treeseed/sdk',

17 workspaceDirName: 'sdk',

18 modes: ['workspace-link', 'installed-link'],

19 },

20 {

21 packageName: '@treeseed/agent',

22 workspaceDirName: 'agent',

23 entrySpecifier: '@treeseed/agent/runtime-types',

24 contractsShim: 'agent-contracts',

25 modes: ['workspace-link', 'installed-link', 'contracts-only'],

26 },

27 {

28 packageName: '@treeseed/core',

29 workspaceDirName: 'core',

30 modes: ['workspace-link', 'installed-link'],

31 },

32 ],

33});

34const result = spawnSync('npx', ['astro', command, '--root', fixtureRoot, ...rest], {

35 cwd: packageRoot,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/scripts/run-fixture-astro-command.jsView on unpkg · L33

36 stdio: 'inherit',

37 env: {

38 ...process.env,

39 ASTRO_TELEMETRY_DISABLED: process.env.ASTRO_TELEMETRY_DISABLED ?? '1',

40 TREESEED_TENANT_ROOT: fixtureRoot,

41 XDG_CONFIG_HOME: process.env.XDG_CONFIG_HOME ?? resolve(tmpdir(), 'treeseed-core-xdg-config'),

42 },

43 shell: process.platform === 'win32',

44});

45if (result.error) {

46 console.error(result.error.message);

47 process.exit(1);

48}

49process.exit(result.status ?? 1);

Source & flagged code

4 flagged · loading source

dist/dev.jsView file

1import { appendFileSync, closeSync, existsSync, mkdirSync, openSync, readFileSync, readSync, readdirSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs"; L2: import { spawn, spawnSync } from "node:child_process"; L3: import { createHash } from "node:crypto";

High

Child Process

Package source references child process execution.

dist/dev.jsView on unpkg · L1

2083patternName = generic_password severity = medium line = 2083 matchedText = password...ed",

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/dev.jsView on unpkg · L2083

dist/scripts/verify-driver.jsView file

6import { pathToFileURL } from 'node:url'; L7: const require = createRequire(import.meta.url); L8: function hasSourceRunnerDependencies() {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/scripts/verify-driver.jsView on unpkg · L6

dist/scripts/run-fixture-astro-command.jsView file

33}); L34: const result = spawnSync('npx', ['astro', command, '--root', fixtureRoot, ...rest], { L35: cwd: packageRoot,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/scripts/run-fixture-astro-command.jsView on unpkg · L33

Findings

3 High5 Medium6 Low

HighChild Processdist/dev.js

HighShell

HighRuntime Package Installdist/scripts/run-fixture-astro-command.js

MediumSecret Patterndist/dev.js

MediumDynamic Requiredist/scripts/verify-driver.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowCopyleft License

Source & flagged code

4 flagged

dist/dev.jsView file

Lines 1-21javascript

1import { appendFileSync, closeSync, existsSync, mkdirSync, openSync, readFileSync, readSync, readdirSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";

2import { spawn, spawnSync } from "node:child_process";

3import { createHash } from "node:crypto";

High

Child Process

Package source references child process execution.

dist/dev.jsView on unpkg · L1

4import { createRequire } from "node:module";

5import { homedir } from "node:os";

6import { dirname, isAbsolute, relative, resolve, sep } from "node:path";

7import { fileURLToPath } from "node:url";

8import { setTimeout as delay } from "node:timers/promises";

9import { DatabaseSync } from "node:sqlite";

10import {

11 applyTreeseedEnvironmentToProcess,

12 assertTreeseedCommandEnvironment,

13 createPersistentDeployTarget,

14 ensureGeneratedWranglerConfig,

15 ensureLocalWorkspaceLinks,

16 findNearestTreeseedWorkspaceRoot,

17 packageScriptPath,

18 resolveTreeseedMachineEnvironmentValues,

19 resolveTreeseedToolBinary,

20 resolveWranglerBin,

21 runTreeseedGit

Lines 2063-2103javascript

2063 return {

2064 ...step,

2065 status: "completed",

2066 detail: [result.stdout, result.stderr].filter(Boolean).join("\n").trim() || step.detail

2067 };

2068 }

2069 const timedOut = result.error && "code" in result.error && result.error.code === "ETIMEDOUT";

2070 const timeoutDetail = timedOut ? `${step.label} timed out after ${Math.round(DEFAULT_SETUP_STEP_TIMEOUT_MS / 1e3)} seconds.` : null;

2071 return {

2072 ...step,

2073 status: step.required ? "failed" : "degraded",

2074 detail: [timeoutDetail, result.stdout, result.stderr].filter(Boolean).join("\n").trim() || `Exited with ${result.status ?? 1}.`

2075 };

2076}

2077function marketPostgresConfig(env) {

2078 return {

2079 container: env.TREESEED_MARKET_LOCAL_POSTGRES_CONTAINER?.trim() || TREESEED_DEFAULT_MARKET_POSTGRES_CONTAINER,

2080 volume: env.TREESEED_MARKET_LOCAL_POSTGRES_VOLUME?.trim() || TREESEED_DEFAULT_MARKET_POSTGRES_VOLUME,

2081 port: env.TREESEED_MARKET_LOCAL_POSTGRES_PORT?.trim() || String(TREESEED_DEFAULT_MARKET_POSTGRES_PORT),

2082 user: "treeseed",

2083 password: "treeseed",

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/dev.jsView on unpkg · L2083

2084 database: "market_local"

2085 };

2086}

2087function dockerBinary(env) {

2088 return resolveTreeseedToolBinary("docker", { env }) ?? "docker";

2089}

2090function spawnDocker(args, env, deps, timeout = 3e4) {

2091 return deps.spawnSync(dockerBinary(env), args, {

2092 cwd: process.cwd(),

2093 env,

2094 encoding: "utf8",

2095 timeout

2096 });

2097}

2098function dockerResultText(result) {

2099 return [result.stdout, result.stderr].filter(Boolean).join("\n").trim();

2100}

2101function dockerVolumeIsMissing(result) {

2102 if (result.error) return false;

2103 const text = dockerResultText(result).toLowerCase();

dist/scripts/verify-driver.jsView file

Lines 1-26javascript

1#!/usr/bin/env node

2import { spawnSync } from 'node:child_process';

3import { existsSync } from 'node:fs';

4import { createRequire } from 'node:module';

5import { resolve } from 'node:path';

6import { pathToFileURL } from 'node:url';

7const require = createRequire(import.meta.url);

8function hasSourceRunnerDependencies() {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/scripts/verify-driver.jsView on unpkg · L6

9 try {

10 require.resolve('esbuild');

11 return true;

12 }

13 catch {

14 return false;

15 }

16}

17function ensureSourceRunnerDependencies() {

18 if (hasSourceRunnerDependencies()) {

19 return;

20 }

21 const result = spawnSync('npm', ['install'], {

22 cwd: process.cwd(),

23 env: { ...process.env, npm_config_ignore_scripts: 'true' },

24 stdio: 'inherit',

25 });

26 if (result.status !== 0) {

dist/scripts/run-fixture-astro-command.jsView file

Lines 13-50javascript

13 packageRoot,

14 declarations: [

15 {

16 packageName: '@treeseed/sdk',

17 workspaceDirName: 'sdk',

18 modes: ['workspace-link', 'installed-link'],

19 },

20 {

21 packageName: '@treeseed/agent',

22 workspaceDirName: 'agent',

23 entrySpecifier: '@treeseed/agent/runtime-types',

24 contractsShim: 'agent-contracts',

25 modes: ['workspace-link', 'installed-link', 'contracts-only'],

26 },

27 {

28 packageName: '@treeseed/core',

29 workspaceDirName: 'core',

30 modes: ['workspace-link', 'installed-link'],

31 },

32 ],

33});

34const result = spawnSync('npx', ['astro', command, '--root', fixtureRoot, ...rest], {

35 cwd: packageRoot,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/scripts/run-fixture-astro-command.jsView on unpkg · L33

36 stdio: 'inherit',

37 env: {

38 ...process.env,

39 ASTRO_TELEMETRY_DISABLED: process.env.ASTRO_TELEMETRY_DISABLED ?? '1',

40 TREESEED_TENANT_ROOT: fixtureRoot,

41 XDG_CONFIG_HOME: process.env.XDG_CONFIG_HOME ?? resolve(tmpdir(), 'treeseed-core-xdg-config'),

42 },

43 shell: process.platform === 'win32',

44});

45if (result.error) {

46 console.error(result.error.message);

47 process.exit(1);

48}

49process.exit(result.status ?? 1);