registry / @venturekit/cli / 0.0.0-dev.20260627215235

@venturekit/cli@0.0.0-dev.20260627215235

⚠ Under review

CLI for VentureKit - scaffolding and deploy orchestration

Static Scan Results

scanned 10d ago · by rust-scanner

Static analysis flagged 12 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 32 file(s), 428 KB of source, external domains: app.example.com, doc.venturekit.dev, github.com, schema.getpostman.com, token.actions.githubusercontent.com, venturekit.dev, www.npmjs.com

Source & flagged code

5 flagged

dist/utils/docker.jsView file

Lines 1-23javascript

1/**

2 * Docker utilities shared across CLI commands.

3 */

4import { execSync } from 'child_process';

5import { existsSync } from 'fs';

High

Child Process

Package source references child process execution.

dist/utils/docker.jsView on unpkg · L3

6import { join } from 'path';

7import { homedir } from 'os';

8import chalk from 'chalk';

9const VK_HOME = join(homedir(), '.vk');

10/**

11 * Path to the shared docker-compose.yml.

12 */

13export function composePath() {

14 return join(VK_HOME, 'docker-compose.yml');

15}

16/**

17 * Check if Docker daemon is available.

18 */

19export function isDockerAvailable() {

20 try {

21 execSync('docker info', { stdio: 'pipe' });

22 return true;

23 }

dist/commands/remove.jsView file

Lines 24-64javascript

24 initial: false,

25 });

26 if (!response.confirm) {

27 console.log(chalk.gray('Cancelled'));

28 return;

29 }

30 }

31 console.

dist/utils/config-loader.jsView file

Lines 8-48javascript

8import { join } from 'path';

9import { createJiti } from 'jiti';

10const VENTURE_CONFIG_FILE = 'vk.config.ts';

11/**

12 * Load vk.config.ts from the given project directory.

13 *

14 * Uses jiti for runtime TypeScript transpilation so consumers

dist/utils/auto-deps.jsView file

Lines 163-203javascript

163 for (const entry of readdirSync(scopeDir, { withFileTypes: true })) {

164 const fullPath = join(scopeDir, entry.name);

165 try {

166 if (lstatSync(fullPath).isSymbolicLink()) {

dist/commands/deploy.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @venturekit/cli@0.0.1 matchedIdentity = npm:QHZlbnR1cmVraXQvY2xp:0.0.1 similarity = 0.733 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

dist/commands/deploy.jsView on unpkg

Source & flagged code

5 flagged · loading source

dist/utils/docker.jsView file

3*/ L4: import { execSync } from 'child_process'; L5: import { existsSync } from 'fs';

High

Child Process

Package source references child process execution.

dist/utils/docker.jsView on unpkg · L3

dist/commands/remove.jsView file

44stdio: 'inherit', L45: shell: true, L46: cwd: cdkDir,

High

Shell

Package source references shell execution.

dist/commands/remove.jsView on unpkg · L44

dist/utils/config-loader.jsView file

28}); L29: const mod = await jiti.import(configPath); L30: const config = mod?.default ?? mod;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/utils/config-loader.jsView on unpkg · L28

dist/utils/auto-deps.jsView file

183const cmd = pm === 'pnpm' L184: ? `pnpm add ${packages}` L185: : pm === 'yarn' ... L188: try { L189: execSync(cmd, { cwd: projectDir, stdio: 'pipe' }); L190: }

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/utils/auto-deps.jsView on unpkg · L183

dist/commands/deploy.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

dist/commands/deploy.jsView on unpkg

Findings

1 Critical3 High4 Medium4 Low

CriticalPrevious Version Dangerous Deltadist/commands/deploy.js

HighChild Processdist/utils/docker.js

HighShelldist/commands/remove.js

HighRuntime Package Installdist/utils/auto-deps.js

MediumDynamic Requiredist/utils/config-loader.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

5 flagged

dist/utils/docker.jsView file

Lines 1-23javascript

1/**

2 * Docker utilities shared across CLI commands.

3 */

4import { execSync } from 'child_process';

5import { existsSync } from 'fs';

High

Child Process

Package source references child process execution.

dist/utils/docker.jsView on unpkg · L3

6import { join } from 'path';

7import { homedir } from 'os';

8import chalk from 'chalk';

9const VK_HOME = join(homedir(), '.vk');

10/**

11 * Path to the shared docker-compose.yml.

12 */

13export function composePath() {

14 return join(VK_HOME, 'docker-compose.yml');

15}

16/**

17 * Check if Docker daemon is available.

18 */

19export function isDockerAvailable() {

20 try {

21 execSync('docker info', { stdio: 'pipe' });

22 return true;

23 }

dist/commands/remove.jsView file

Lines 24-64javascript

24 initial: false,

25 });

26 if (!response.confirm) {

27 console.log(chalk.gray('Cancelled'));

28 return;

29 }

30 }

31 console.

dist/utils/config-loader.jsView file

Lines 8-48javascript

8import { join } from 'path';

9import { createJiti } from 'jiti';

10const VENTURE_CONFIG_FILE = 'vk.config.ts';

11/**

12 * Load vk.config.ts from the given project directory.

13 *

14 * Uses jiti for runtime TypeScript transpilation so consumers

dist/utils/auto-deps.jsView file

Lines 163-203javascript

163 for (const entry of readdirSync(scopeDir, { withFileTypes: true })) {

164 const fullPath = join(scopeDir, entry.name);

165 try {

166 if (lstatSync(fullPath).isSymbolicLink()) {

dist/commands/deploy.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

dist/commands/deploy.jsView on unpkg