registry / @treeseed/core / 0.12.55

@treeseed/core@0.12.55

Treeseed web framework package for Astro/Starlight site runtimes.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

CopyleftLicense

scanned 205 file(s), 1.07 MB of source, external domains: api.treeseed.dev, challenges.cloudflare.com, docs.astro.build, example.com, github.com, pagefind.app, starlight.astro.build, treeseed.dev

Source & flagged code

2 flagged

dist/dev.jsView file

Lines 2063-2103javascript

2063 return {

2064 ...step,

2065 status: "completed",

2066 detail: [result.stdout, result.stderr].filter(Boolean).join("\n").trim() || step.detail

2067 };

2068 }

2069 const timedOut = result.error && "code" in result.error && result.error.code === "ETIMEDOUT";

2070 const timeoutDetail = timedOut ? `${step.label} timed out after ${Math.round(DEFAULT_SETUP_STEP_TIMEOUT_MS / 1e3)} seconds.` : null;

2071 return {

2072 ...step,

2073 status: step.required ? "failed" : "degraded",

2074 detail: [timeoutDetail, result.stdout, result.stderr].filter(Boolean).join("\n").trim() || `Exited with ${result.status ?? 1}.`

2075 };

2076}

2077function marketPostgresConfig(env) {

2078 return {

2079 container: env.TREESEED_MARKET_LOCAL_POSTGRES_CONTAINER?.trim() || TREESEED_DEFAULT_MARKET_POSTGRES_CONTAINER,

2080 volume: env.TREESEED_MARKET_LOCAL_POSTGRES_VOLUME?.trim() || TREESEED_DEFAULT_MARKET_POSTGRES_VOLUME,

2081 port: env.TREESEED_MARKET_LOCAL_POSTGRES_PORT?.trim() || String(TREESEED_DEFAULT_MARKET_POSTGRES_PORT),

2082 user: "treeseed",

2083 password: "treeseed",

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/dev.jsView on unpkg · L2083

2084 database: "market_local"

2085 };

2086}

2087function dockerBinary(env) {

2088 return resolveTreeseedToolBinary("docker", { env }) ?? "docker";

2089}

2090function spawnDocker(args, env, deps, timeout = 3e4) {

2091 return deps.spawnSync(dockerBinary(env), args, {

2092 cwd: process.cwd(),

2093 env,

2094 encoding: "utf8",

2095 timeout

2096 });

2097}

2098function dockerResultText(result) {

2099 return [result.stdout, result.stderr].filter(Boolean).join("\n").trim();

2100}

2101function dockerVolumeIsMissing(result) {

2102 if (result.error) return false;

2103 const text = dockerResultText(result).toLowerCase();

dist/scripts/verify-driver.jsView file

Lines 1-26javascript

1#!/usr/bin/env node

2import { spawnSync } from 'node:child_process';

3import { existsSync } from 'node:fs';

4import { createRequire } from 'node:module';

5import { resolve } from 'node:path';

6import { pathToFileURL } from

Source & flagged code

2 flagged · loading source

dist/dev.jsView file

2083patternName = generic_password severity = medium line = 2083 matchedText = password...ed",

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/dev.jsView on unpkg · L2083

dist/scripts/verify-driver.jsView file

6import { pathToFileURL } from 'node:url'; L7: const require = createRequire(import.meta.url); L8: function hasSourceRunnerDependencies() {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/scripts/verify-driver.jsView on unpkg · L6

Findings

5 Medium6 Low

MediumSecret Patterndist/dev.js

MediumDynamic Requiredist/scripts/verify-driver.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowCopyleft License

Source & flagged code

2 flagged

dist/dev.jsView file

Lines 2063-2103javascript

2063 return {

2064 ...step,

2065 status: "completed",

2066 detail: [result.stdout, result.stderr].filter(Boolean).join("\n").trim() || step.detail

2067 };

2068 }

2069 const timedOut = result.error && "code" in result.error && result.error.code === "ETIMEDOUT";

2070 const timeoutDetail = timedOut ? `${step.label} timed out after ${Math.round(DEFAULT_SETUP_STEP_TIMEOUT_MS / 1e3)} seconds.` : null;

2071 return {

2072 ...step,

2073 status: step.required ? "failed" : "degraded",

2074 detail: [timeoutDetail, result.stdout, result.stderr].filter(Boolean).join("\n").trim() || `Exited with ${result.status ?? 1}.`

2075 };

2076}

2077function marketPostgresConfig(env) {

2078 return {

2079 container: env.TREESEED_MARKET_LOCAL_POSTGRES_CONTAINER?.trim() || TREESEED_DEFAULT_MARKET_POSTGRES_CONTAINER,

2080 volume: env.TREESEED_MARKET_LOCAL_POSTGRES_VOLUME?.trim() || TREESEED_DEFAULT_MARKET_POSTGRES_VOLUME,

2081 port: env.TREESEED_MARKET_LOCAL_POSTGRES_PORT?.trim() || String(TREESEED_DEFAULT_MARKET_POSTGRES_PORT),

2082 user: "treeseed",

2083 password: "treeseed",

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/dev.jsView on unpkg · L2083

2084 database: "market_local"

2085 };

2086}

2087function dockerBinary(env) {

2088 return resolveTreeseedToolBinary("docker", { env }) ?? "docker";

2089}

2090function spawnDocker(args, env, deps, timeout = 3e4) {

2091 return deps.spawnSync(dockerBinary(env), args, {

2092 cwd: process.cwd(),

2093 env,

2094 encoding: "utf8",

2095 timeout

2096 });

2097}

2098function dockerResultText(result) {

2099 return [result.stdout, result.stderr].filter(Boolean).join("\n").trim();

2100}

2101function dockerVolumeIsMissing(result) {

2102 if (result.error) return false;

2103 const text = dockerResultText(result).toLowerCase();

dist/scripts/verify-driver.jsView file

Lines 1-26javascript

1#!/usr/bin/env node

2import { spawnSync } from 'node:child_process';

3import { existsSync } from 'node:fs';

4import { createRequire } from 'node:module';

5import { resolve } from 'node:path';

6import { pathToFileURL } from