registry  /  @tutorialkit-rb/cli  /  1.0.0-rc.3

@tutorialkit-rb/cli@1.0.0-rc.3

Interactive tutorials powered by WebContainer API

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessEnvironmentVarsEvalFilesystemNetworkShell
Supply chain
HighEntropyStringsUrlStrings
ManifestNo manifest risk signals triggered.
scanned 28 file(s), 104 KB of source, external domains: api.example.com, github.com, httpbin.org, stackblitz.com

Source & flagged code

5 flagged · loading source
dist/index.jsView file
854// src/utils/shell.ts L855: import { spawn } from "node:child_process"; L856: async function runShellCommand(command, flags, opts = {}) {
High
Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L854
53"detect-indent": "7.0.1", L54: execa: "^9.2.0", L55: ignore: "^5.3.1",
High
Shell

Package source references shell execution.

dist/index.jsView on unpkg · L53
template/src/templates/default/scripts/smoke-test.jsView file
81const templateDir = new URL('..', import.meta.url).pathname; L82: execSync('npm install --ignore-scripts', { cwd: templateDir, stdio: 'inherit' }); L83: }
High
Runtime Package Install

Package source invokes a package manager install command at runtime.

template/src/templates/default/scripts/smoke-test.jsView on unpkg · L81
template/ruby-wasm/boot.rbView file
•path = template/ruby-wasm/boot.rb kind = build_helper sizeBytes = 1273 magicHex = [redacted]
Medium
Ships Build Helper

Package ships non-JavaScript build or shell helper files.

template/ruby-wasm/boot.rbView on unpkg
template/src/templates/default/workspace/_debug_app/test/test_helper.rbView file
•path = [redacted]_debug_app/test/test_helper.rb kind = payload_in_excluded_dir sizeBytes = 426 magicHex = [redacted]
High
Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

template/src/templates/default/workspace/_debug_app/test/test_helper.rbView on unpkg

Findings

4 High4 Medium5 Low
HighChild Processdist/index.js
HighShelldist/index.js
HighRuntime Package Installtemplate/src/templates/default/scripts/smoke-test.js
HighPayload In Excluded Dirtemplate/src/templates/default/workspace/_debug_app/test/test_helper.rb
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helpertemplate/ruby-wasm/boot.rb
MediumStructural Risk Force Deep Review
LowScripts Present
LowEval
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings