registry / @uge/payo / 1.4.0

@uge/payo@1.4.0

CLI tool to generate AI rules and skills for your project

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 511 KB of source, external domains: github.com, json-schema.org

Source & flagged code

5 flagged

dist/index.jsView file

Lines 63-103javascript

63`);d.length>1&&n.write(Wr.cursor.up(d.length-1)),n.write(Wr.cursor.to(0)),n.write(Wr.erase.down())},w=(d)=>d.replace(/\.+$/,""),p=(d)=>{let u$=(performance.now()-d)/1000,B$=Math.floor(u$/60),l$=Math.floor(u$%60);return B$>0?`[${B$}m ${l$}s]`:`[${l$}s]`},$$=U.withGuide??r$.withGuide,Nr=(d="")=>{_=!0,D=y0({output:n}),W=w(d),O=performance.now(),$$&&n.write(`${X("gray",c)}

64`);let u$=0,B$=0;y(),z=setInterval(()=>{if(b&&W===F)return;C(),F=W;let l$=s(g[u$]),gn;if(b)gn=`${l$} ${W}...`;else if($==="timer")gn=`${l$} ${W} ${p(O)}`;else{let kJ=".".repeat(Math.floor(B$)).slice(0,3);gn=`${l$} ${W}${kJ}`}let XJ=w$(gn,R,{hard:!0,trim:!1});n.write(XJ),u$=u$+1<g.length?u$+1:0,B$=B$<4?B$+0.125:0},u)},s$=(d="",u$=0,B$=!1)=>{if(!_)return;_=!1,clearInterval(z),C();let l$=u$===0?X("green",jn):u$===1?X("red",gb):X("red",Ib);W=d??W,B$||($==="timer"?n.write(`${l$} ${W} ${p(O)}

65`):n.write(`${l$} ${W}

66`)),H(),D()};return{start:Nr,stop:(d="")=>s$(d,0),message:(d="")=>{W=w(d??W)},cancel:(d="")=>s$(d,1),error:(d="")=>s$(d,2),clear:()=>s$("",0,!0),get isCancelled(){return j}}},Dk={light:m("─","-"),heavy:m("━","="),block:m("█","#")};var _n=($,r)=>$.includes(`

67`)?$.split(`

68`).map((n)=>r(n)).join(`

69`):r($),Wv=($)=>{let r=(n,I)=>{let v=n.label??String(n.value);switch(I){case"disabled":return`${X("gray",Nn)} ${_n(v,(g)=>X("gray",g))}${n.hint?` ${X("dim",`(${n.hint??"disabled"})`)}`:""}`;case"selected":return`${_n(v,(g)=>X("dim",g))}`;case"active":return`${X("green",p4)} ${v}${n.hint

70`:""}${g}

71`;switch(this.state){case"submit":{let i=n?`${X("gray",c)} `:"",U=vv($.output,r(this.options[this.cursor],"selected"),i);return`${u}${U}`}case"cancel":{let i=n

72${X("gray",c)}`:""}`}default:{let i=n?`${X("cyan",c)} `:"",U=n?X("cyan",rv):"",b=u.split(`

73`).length,D=n?2:1;return`${u}${i}${e4({output:$.output,cursor:this.cursor,options:this.options,maxItems:$.maxItems,columnPadding:i.length,rowPadding:b+D,style:(z,_)=>

74${i}`)}

75${U}

76`}}}}).prompt()};var zk=`${X("gray",c)} `;var Xn=($)=>new y4({validate:$.validate,placeholder:$.placeholder,defaultValue:$.defaultValue,initialValue:$.initialValue,output:$.output,signal:$.signal,input:$.input,render(){let r=$?.withGuide??r$.withGuide,n=`${`${r?`${X("gray",c)}

77`:""}${Jn(this.state)} `}${$.message}

78`,I=$.placeholder?X("inverse",$.placeholder[0])+X("dim",$.placeholder.slice(1)):X(["inverse","hidden"],"_"),v=this.userInput?this.userInputWithCursor:I,g=this.value??"";switch(this.state){case

79${i}${v}

80${U}${u}

81`}case"submit":{let u=g?` ${X("dim",g)}`:"",i=r?X("gray",c):"";return`${n}${i}${u}`}case"cancel":{let u=g?` ${X(["strikethrough"

82${i}`:""}`}default:{let u=r?`${X("cyan",c)} `:"",i=r?X("cyan",rv):"";return`${n}${u}${v}

83${i}

84`}}}}).prompt();import sr from"fs";import I9 from"path";import{randomUUID as u9}from"crypto";var F$={};f$(F$,{xor:()=>xD,xid:()=>bD,void:()=>MD,uuidv7:()=>vD,uuidv6:()=>$D,

85`)}var Sv=($)=>(r,n,I,v)=>{let g=I?{...I,async:!1}:{async:!1},u=r._zod.run({value:n,issues:[]},g);if(u instanceof Promise)throw new c$;if(u.issues.length){let i=new(v?.Err??$)(u.issues.map((U)=>J$(U,g,e())));throw Kn(i,v?.callee),i}return u.value},Yn=Sv(Q$),Zv=($)=>async(r,n,I,v)=>{let g=I?{...I,async:!0}:{async:!0},u=r._zod.run({value:n,issues:[]},g);if(u instanceof Promise)u=await u;if(u.issues.length){let i=new(v?.Err??$)(u.issues.map((U)=>J$(U,g,e())));throw Kn(i,v?.callee),i}return u.value},Qn=Zv(Q$),Bv=($)=>(r,n,I)=>{let v=I?{...I,async:!1}:{async:!1},g=r._zod.run({value:n,issues:[]},v); ...

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/index.jsView on unpkg · L83

86`).filter((g)=>g),I=Math.min(...n.map((g)=>g.length-g.trimStart().length)),v=n.map((g)=>g.slice(I)).map((g)=>" ".repeat(this.indent*

87`))}}var bI={major:4,minor:4,patch:3};var S=N("$ZodType",($,r)=>{var n;$??($={}),$._zod.def=r,$._zod.bag=$._zod.bag||{},$._zod.version=bI;let I=[...$._zod.def.checks??[]];if($._zod.traits.has("$ZodCheck"

88 if (${Z}.issues.length) {

89 if (${E} in input) {

90 payload.issues = payload.issues.concat(${Z}.issues.map(iss => ({

91 ...iss,

92 path: iss.path ? [${E}, ...iss.path] : [${E}]

93 })));

94 }

95 }

97 if (${Z}.value === undefined) {

98 if (${E} in input) {

99 newResult[${E}] = undefined;

100 }

101 } else {

102 newResult[${E}] = ${Z}.value;

103 }

Long lines were clipped for display.

Lines 148-204javascript

148Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.`)}for(let u of $.seen.entries()){let i=u[1];if(r===u[0]){g(u);continue}if($.external){let b=$.external.registry.get(u[0])?.id;if(r

Source & flagged code

5 flagged · loading source

dist/index.jsView file

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L178

178`)} L179: ---`}var P_={id:"cursor",displayName:"Cursor",knownArtifacts:[".cursorrules",".cursor/rules"],generate:($)=>[{path:".cursorrules",content:I$("Cursor Rules",$.sections)}],agent:{bin... L180: `),b=r.map((z)=>`- ${z}: one of [${z0(z,I).join(", ")}]`).join(` ... L183: `),"Review your stack"),await I()==="generate")return r;let g=g8($,r),u=await v(g);if(!u)continue;let i=g.find((U)=>U.id===u);if(!i)continue;if(i.kind==="gate")r=I8($,r,u);else{let... L184: `),`Recommended ${I.title} settings`)}let b=await Ir({id:I.id,type:"select",message:`${I.title} — how to proceed?`,options:U,allowOther:!1},r.answers);r=e$(r,I.id,b),i=W0(b)}if(i==... L185: `)}];var HN={id:"laravel",title:"Laravel",category:"framework",appliesTo:($)=>$4($)&&($.projectType==="backend"||$.projectType==="full-stack"),options:()=>[{value:"laravel",label:"...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L178

168`)});let s=[],T=k$($,"formatter");if(T)s.push(`- Formatter: ${T}`);let Z=k$($,"linter");if(Z)s.push(`- Linter: ${Z}`);if(s.length)r.push({title:"Tooling",body:s.join(` L169: `)});let E=k$($,"gitWorkflow");if(E){let H=[`Follow the ${E} workflow.`,"- Maintain a comprehensive .gitignore (build output, dependencies, environment/secret files, OS/editor arti... L170: `)})}r.push(...L_($));let y=Object.keys($).filter((H)=>H.includes(".")&&$[H]!==void 0&&$[H]!=="").map((H)=>`- ${S9(H)}: ${Z9($[H])}`);if(y.length)r.push({title:"Tech Details",body:... ... L178: `)} L179: ---`}var P_={id:"cursor",displayName:"Cursor",knownArtifacts:[".cursorrules",".cursor/rules"],generate:($)=>[{path:".cursorrules",content:I$("Cursor Rules",$.sections)}],agent:{bin... L180: `),b=r.map((z)=>`- ${z}: one of [${z0(z,I).join(", ")}]`).join(` ... L183: `),"Review your stack"),await I()==="generate")return r;let g=g8($,r),u=await v(g);if(!u)continue;let i=g.find((U)=>U.id===u);if(!i)continue;if(i.kind==="gate")r=I8($,r,u);else{let... L184: `),`Recommended ${I.title} settings`)}let b=await Ir({id:I.id,type:"select",message:`${I.title} — how to proceed?`,options:U,allowOther:!1},r.answers);r=e$(r,I.id,b),i=W0(

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L168

184`),`Recommended ${I.title} settings`)}let b=await Ir({id:I.id,type:"select",message:`${I.title} — how to proceed?`,options:U,allowOther:!1},r.answers);r=e$(r,I.id,b),i=W0(b)}if(i==... L185: `)}];var HN={id:"laravel",title:"Laravel",category:"framework",appliesTo:($)=>$4($)&&($.projectType==="backend"||$.projectType==="full-stack"),options:()=>[{value:"laravel",label:"... L186: `)}function _8($){let r=Z4($),n=Y0($,"packageManager"),I=Y0($,"formatter"),v=Y0($,"linter"),g=[];if(g.push(r.scaffold?`Scaffold the project by running \`${r.scaffold}\` — the offic...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L184

83${i} L84: `}}}}).prompt();import sr from"fs";import I9 from"path";import{randomUUID as u9}from"crypto";var F$={};f$(F$,{xor:()=>xD,xid:()=>bD,void:()=>MD,uuidv7:()=>vD,uuidv6:()=>$D,uuidv4:(... L85: `)}var Sv=($)=>(r,n,I,v)=>{let g=I?{...I,async:!1}:{async:!1},u=r._zod.run({value:n,issues:[]},g);if(u instanceof Promise)throw new c$;if(u.issues.length){let i=new(v?.Err??$)(u.is...

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/index.jsView on unpkg · L83

Findings

3 High4 Medium5 Low

HighChild Processdist/index.js

HighSame File Env Network Executiondist/index.js

HighCommand Output Exfiltrationdist/index.js

MediumDynamic Requiredist/index.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvaldist/index.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

5 flagged

dist/index.jsView file

Lines 63-103javascript

65`):n.write(`${l$} ${W}

67`)?$.split(`

68`).map((n)=>r(n)).join(`

70`:""}${g}

71`;switch(this.state){case"submit":{let i=n?`${X("gray",c)} `:"",U=vv($.output,r(this.options[this.cursor],"selected"),i);return`${u}${U}`}case"cancel":{let i=n

72${X("gray",c)}`:""}`}default:{let i=n?`${X("cyan",c)} `:"",U=n?X("cyan",rv):"",b=u.split(`

73`).length,D=n?2:1;return`${u}${i}${e4({output:$.output,cursor:this.cursor,options:this.options,maxItems:$.maxItems,columnPadding:i.length,rowPadding:b+D,style:(z,_)=>

74${i}`)}

75${U}

77`:""}${Jn(this.state)} `}${$.message}

78`,I=$.placeholder?X("inverse",$.placeholder[0])+X("dim",$.placeholder.slice(1)):X(["inverse","hidden"],"_"),v=this.userInput?this.userInputWithCursor:I,g=this.value??"";switch(this.state){case

79${i}${v}

80${U}${u}

81`}case"submit":{let u=g?` ${X("dim",g)}`:"",i=r?X("gray",c):"";return`${n}${i}${u}`}case"cancel":{let u=g?` ${X(["strikethrough"

82${i}`:""}`}default:{let u=r?`${X("cyan",c)} `:"",i=r?X("cyan",rv):"";return`${n}${u}${v}

83${i}

84`}}}}).prompt();import sr from"fs";import I9 from"path";import{randomUUID as u9}from"crypto";var F$={};f$(F$,{xor:()=>xD,xid:()=>bD,void:()=>MD,uuidv7:()=>vD,uuidv6:()=>$D,

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/index.jsView on unpkg · L83

86`).filter((g)=>g),I=Math.min(...n.map((g)=>g.length-g.trimStart().length)),v=n.map((g)=>g.slice(I)).map((g)=>" ".repeat(this.indent*

88 if (${Z}.issues.length) {

89 if (${E} in input) {

90 payload.issues = payload.issues.concat(${Z}.issues.map(iss => ({

91 ...iss,

92 path: iss.path ? [${E}, ...iss.path] : [${E}]

93 })));

94 }

95 }

97 if (${Z}.value === undefined) {

98 if (${E} in input) {

99 newResult[${E}] = undefined;

100 }

101 } else {

102 newResult[${E}] = ${Z}.value;

103 }

Long lines were clipped for display.

Lines 148-204javascript