registry / @vaharoni/devops / 1.3.6

@vaharoni/devops@1.3.6

Devops utility

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

WildcardDependency

scanned 85 file(s), 343 KB of source, external domains: 127.0.0.1

Source & flagged code

4 flagged

dist/src/target-templates/lang-variants-common/typescript/config/.env.developmentView file

•patternName = blocked_file severity = critical matchedText = dist/src/target-templates/lang-variants-common/typescript/config/.env.development redactedSecretContext = secretLikeLines = 0 notes = no secret-like key/value lines found in sampled text

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/src/target-templates/lang-variants-common/typescript/config/.env.developmentView on unpkg

dist/devops.jsView file

Lines 3178-3218javascript

3178 return [keyInYaml, { oneLiner: oneLiner24, keyExamples: keyExamples24, run: run24, key }];

3179 })

3180 );

3181 for (const extension of activeExtensions) {

3182 const extensionData = availableExtensionsLookup[extension];

3183 if (!extensionData) {

3184 console.error(`

3185Extension "${extension}" referenced in constants.yaml is not supported

3186

3187`);

3188 process.exit(1);

3189 }

3190 extensionCommands[extensionData.key] = extensionData;

3191 }

3192}

3193var extensionCommandsKeyLength = maxKeyLength(extensionCommands);

3194var pluginCommands = {};

3195if (existsSync(".devops/plugins")) {

3196 const pluginsDir = path7.join(process.cwd(), ".devops/plugins");

3197 const pluginFiles = globSync2(path7.join(pluginsDir, "*.ts"));

3198 for (const pluginFile of pluginFiles) {

3199 const plugin = await import(pluginFile);

3200 const keys = Object.keys(plugin);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/devops.jsView on unpkg · L3198

3201 if (keys.length !== 1) {

3202 console.error(`Plugin ${pluginFile} must export exactly one command`);

3203 process.exit(1);

3204 }

3205 const constKey = keys[0];

3206 const { oneLiner: oneLiner24, keyExamples: keyExamples24, run: run24, command } = plugin[constKey];

3207 const key = command ?? constKey;

3208 if (!oneLiner24 || !keyExamples24 || !run24) {

3209 console.error(`Plugin ${pluginFile} must export oneLiner, keyExamples, and run`);

3210 process.exit(1);

3211 }

3212 if (typeof run24 !== "function") {

3213 console.error(`Plugin ${pluginFile} must export a run function`);

3214 process.exit(1);

3215 }

3216 pluginCommands[key] = { oneLiner: oneLiner24, keyExamples: keyExamples24, run: run24, key };

3217 }

3218}

dist/cli/exec.shView file

•path = dist/cli/exec.sh kind = build_helper sizeBytes = 526 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/cli/exec.shView on unpkg

dist/src/target-templates/lang-variants-common/python/.devops/docker-images/python-services/python-run.shView file

•path = dist/src/target-templates/lang-variants-common/python/.devops/docker-images/python-services/python-run.sh kind = payload_in_excluded_dir sizeBytes = 140 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

dist/src/target-templates/lang-variants-common/python/.devops/docker-images/python-services/python-run.shView on unpkg

Source & flagged code

4 flagged · loading source

dist/src/target-templates/lang-variants-common/typescript/config/.env.developmentView file

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/src/target-templates/lang-variants-common/typescript/config/.env.developmentView on unpkg

dist/devops.jsView file

3198for (const pluginFile of pluginFiles) { L3199: const plugin = await import(pluginFile); L3200: const keys = Object.keys(plugin);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/devops.jsView on unpkg · L3198

dist/cli/exec.shView file

•path = dist/cli/exec.sh kind = build_helper sizeBytes = 526 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/cli/exec.shView on unpkg

dist/src/target-templates/lang-variants-common/python/.devops/docker-images/python-services/python-run.shView file

•path = dist/src/target-templates/lang-variants-common/python/.devops/docker-images/python-services/python-run.sh kind = payload_in_excluded_dir sizeBytes = 140 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

dist/src/target-templates/lang-variants-common/python/.devops/docker-images/python-services/python-run.shView on unpkg

Findings

1 Critical1 High5 Medium4 Low

CriticalCritical Secretdist/src/target-templates/lang-variants-common/typescript/config/.env.development

HighPayload In Excluded Dirdist/src/target-templates/lang-variants-common/python/.devops/docker-images/python-services/python-run.sh

MediumDynamic Requiredist/devops.js

MediumEnvironment Vars

MediumShips Build Helperdist/cli/exec.sh

MediumStructural Risk Force Deep Review

MediumWildcard Dependency

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

dist/src/target-templates/lang-variants-common/typescript/config/.env.developmentView file

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/src/target-templates/lang-variants-common/typescript/config/.env.developmentView on unpkg

dist/devops.jsView file

Lines 3178-3218javascript

3178 return [keyInYaml, { oneLiner: oneLiner24, keyExamples: keyExamples24, run: run24, key }];

3179 })

3180 );

3181 for (const extension of activeExtensions) {

3182 const extensionData = availableExtensionsLookup[extension];

3183 if (!extensionData) {

3184 console.error(`

3185Extension "${extension}" referenced in constants.yaml is not supported

3186

3187`);

3188 process.exit(1);

3189 }

3190 extensionCommands[extensionData.key] = extensionData;

3191 }

3192}

3193var extensionCommandsKeyLength = maxKeyLength(extensionCommands);

3194var pluginCommands = {};

3195if (existsSync(".devops/plugins")) {

3196 const pluginsDir = path7.join(process.cwd(), ".devops/plugins");

3197 const pluginFiles = globSync2(path7.join(pluginsDir, "*.ts"));

3198 for (const pluginFile of pluginFiles) {

3199 const plugin = await import(pluginFile);

3200 const keys = Object.keys(plugin);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/devops.jsView on unpkg · L3198

3201 if (keys.length !== 1) {

3202 console.error(`Plugin ${pluginFile} must export exactly one command`);

3203 process.exit(1);

3204 }

3205 const constKey = keys[0];

3206 const { oneLiner: oneLiner24, keyExamples: keyExamples24, run: run24, command } = plugin[constKey];

3207 const key = command ?? constKey;

3208 if (!oneLiner24 || !keyExamples24 || !run24) {

3209 console.error(`Plugin ${pluginFile} must export oneLiner, keyExamples, and run`);

3210 process.exit(1);

3211 }

3212 if (typeof run24 !== "function") {

3213 console.error(`Plugin ${pluginFile} must export a run function`);

3214 process.exit(1);

3215 }

3216 pluginCommands[key] = { oneLiner: oneLiner24, keyExamples: keyExamples24, run: run24, key };

3217 }

3218}

dist/cli/exec.shView file

•path = dist/cli/exec.sh kind = build_helper sizeBytes = 526 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/cli/exec.shView on unpkg

dist/src/target-templates/lang-variants-common/python/.devops/docker-images/python-services/python-run.shView file

•path = dist/src/target-templates/lang-variants-common/python/.devops/docker-images/python-services/python-run.sh kind = payload_in_excluded_dir sizeBytes = 140 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

dist/src/target-templates/lang-variants-common/python/.devops/docker-images/python-services/python-run.shView on unpkg