registry / @tutorialkit-rb/cli / 1.0.0-rc.3

@tutorialkit-rb/cli@1.0.0-rc.3

Interactive tutorials powered by WebContainer API

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 28 file(s), 104 KB of source, external domains: api.example.com, github.com, httpbin.org, stackblitz.com

Source & flagged code

5 flagged

dist/index.jsView file

Lines 33-73javascript

33 exports: {

34 ".": "./dist/index.js"

35 },

36 scripts: {

37 build: "node scripts/build.js",

38 "build-release": "node scripts/build-release.js",

Source & flagged code

5 flagged · loading source

dist/index.jsView file

854// src/utils/shell.ts L855: import { spawn } from "node:child_process"; L856: async function runShellCommand(command, flags, opts = {}) {

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L854

53"detect-indent": "7.0.1", L54: execa: "^9.2.0", L55: ignore: "^5.3.1",

High

Shell

Package source references shell execution.

dist/index.jsView on unpkg · L53

template/src/templates/default/scripts/smoke-test.jsView file

81const templateDir = new URL('..', import.meta.url).pathname; L82: execSync('npm install --ignore-scripts', { cwd: templateDir, stdio: 'inherit' }); L83: }

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

template/src/templates/default/scripts/smoke-test.jsView on unpkg · L81

template/ruby-wasm/boot.rbView file

•path = template/ruby-wasm/boot.rb kind = build_helper sizeBytes = 1273 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

template/ruby-wasm/boot.rbView on unpkg

template/src/templates/default/workspace/_debug_app/test/test_helper.rbView file

•path = [redacted]_debug_app/test/test_helper.rb kind = payload_in_excluded_dir sizeBytes = 426 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

template/src/templates/default/workspace/_debug_app/test/test_helper.rbView on unpkg

Findings

4 High4 Medium5 Low

HighChild Processdist/index.js

HighShelldist/index.js

HighRuntime Package Installtemplate/src/templates/default/scripts/smoke-test.js

HighPayload In Excluded Dirtemplate/src/templates/default/workspace/_debug_app/test/test_helper.rb

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helpertemplate/ruby-wasm/boot.rb

MediumStructural Risk Force Deep Review

LowScripts Present

LowEval

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Lines 834-874javascript

834 for (const extra of extraFiles) {

835 const extraPath = path5.join(resolvedDest, extra.filename);

836 fs4.mkdirSync(path5.dirname(extraPath), { recursive: true });

837 fs4.writeFileSync(extraPath, extra.content);

838 added.push(extraPath);

839 }

840 }

841 return added.map((f) => `Added ${f}`).join("\n");

842 }

843 });

844 }

845 return provider;

846}

847

848// src/commands/create/git.ts

849import fs5 from "node:fs";

850import path6 from "node:path";

851import * as prompts5 from "@clack/prompts";

852import chalk6 from "chalk";

853

854// src/utils/shell.ts

855import { spawn } from "node:child_process";

856async function runShellCommand(command, flags, opts = {}) {

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L854

857 let child;

858 let stdout = "";

859 let stderr = "";

860 try {

861 child = spawn(command, flags, {

862 cwd: opts.cwd,

863 shell: true,

864 stdio: opts.stdio,

865 timeout: opts.timeout

866 });

867 const done = new Promise((resolve, reject) => {

868 child.on("close", (code) => {

869 if (code !== 0) {

870 reject(code);

871 return;

872 }

873 resolve(code);

874 });

template/src/templates/default/scripts/smoke-test.jsView file

Lines 61-101javascript

61function timer() {

62 const start = performance.now();

63 return () => {

64 const ms = performance.now() - start;

65 return ms < 1000 ? `${Math.round(ms)}ms` : `${(ms / 1000).toFixed(1)}s`;

66 };

67}

69function log(msg) {

70 console.log(`[smoke] ${msg}`);

71}

73// ---------------------------------------------------------------------------

74// Resolve WASM binary

75// ---------------------------------------------------------------------------

76const nodeModules = new URL('../node_modules', import.meta.url).pathname;

78if (!existsSync(nodeModules)) {

79 log('node_modules/ not found — running npm install --ignore-scripts...');

80 const { execSync } = await import('node:child_process');

81 const templateDir = new URL('..', import.meta.url).pathname;

82 execSync('npm install --ignore-scripts', { cwd: templateDir, stdio: 'inherit' });

83}

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

template/src/templates/default/scripts/smoke-test.jsView on unpkg · L81

85const wasmCandidates = [

86 { path: process.env.RAILS_WASM_PATH, label: 'RAILS_WASM_PATH env var' },

87 { path: new URL('../../../../public/ruby.wasm', import.meta.url).pathname, label: 'public/ruby.wasm (dynamic packing)' },

88 { path: new URL('../node_modules/@ruby/wasm-wasi/dist/ruby.wasm', import.meta.url).pathname, label: '@ruby/wasm-wasi' },

89 { path: new URL('../node_modules/@rails-tutorial/wasm/dist/rails.wasm', import.meta.url).pathname, label: '@rails-tutorial/wasm' },

90].filter(c => c.path);

92const resolved = wasmCandidates.find(c => existsSync(c.path));

94if (!resolved) {

95 console.error(

96 '\n Could not find a Ruby WASM binary. Searched:\n' +

97 wasmCandidates.map(c => ` - ${c.label}: ${c.path}`).join('\n') + '\n\n' +

98 ' Set RAILS_WASM_PATH to the path of your monolithic ruby.wasm binary,\n' +

99 ' or ensure @rails-tutorial/wasm is installed.\n',

100 );

101 process.exit(1);