registry / @venturekit/cli / 0.0.2

@venturekit/cli@0.0.2

⚠ Under review

CLI for VentureKit - scaffolding and deploy orchestration

Static Scan Results

scanned 7d ago · by rust-scanner

Static analysis flagged 13 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 35 file(s), 459 KB of source, external domains: app.example.com, doc.venturekit.dev, github.com, schema.getpostman.com, token.actions.githubusercontent.com, venturekit.dev, www.npmjs.com

Source & flagged code

6 flagged

dist/commands/generate.jsView file

Lines 423-463javascript

423 '});',

424 '',

425 ].join('\n');

426 const globalSetup = [

427 "import { waitForReady } from '@venturekit/testing';",

428 '',

429 `const API_PORT = Number(process.env.E2E_API_PORT ?? ${port});`,

430 'const API_URL = `http://localhost:${API_PORT}`;',

431 '',

432 'export default async function globalSetup() {',

433 " // The webServer block boots `vk dev`; confirm it's actually ready",

434 ' // (and really a vk dev server) before any spec runs.',

435 ' await waitForReady({ baseUrl: API_URL });',

436 '',

437 ' // If your API declares an `auth` intent, seed a known login here:',

438 ' //',

439 " // import { createTestUser } from '@venturekit/testing';",

440 ' // await createTestUser({',

441 ' // baseUrl: API_URL,',

442 " // email: 'admin@example.com',",

443 " // password: 'Passw0rd!',",

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/commands/generate.jsView on unpkg · L443

444 " // attributes: { tenantId: 'global' },",

445 ' // });',

446 '',

447 ' // To reset the DB between runs (needs @venturekit/data + DB env):',

448 ' //',

449 " // import { truncateAllTables } from '@venturekit/testing';",

450 ' // await truncateAllTables();',

451 '}',

452 '',

453 ].join('\n');

454 const healthSpec = [

455 "import { test, expect } from '@playwright/test';",

456 '',

457 `const API_PORT = Number(process.env.E2E_API_PORT ?? ${port});`,

458 'const API_URL = `http://localhost:${API_PORT}`;',

459 '',

460 "test('the API dev server is up', async ({ request }) => {",

461 ' const res = await request.get(`${API_URL}/_dev/health`);',

462 ' expect(res.ok()).toBeTruthy();',

463 ' const body = await res.json();',

dist/utils/docker.jsView file

Lines 1-23javascript

1/**

2 * Docker utilities shared across CLI commands.

3 */

4import { execSync } from 'child_process';

5import { existsSync } from 'fs';

High

Child Process

Package source references child process execution.

dist/utils/docker.jsView on unpkg · L3

6import { join } from 'path';

dist/utils/typecheck.jsView file

Lines 1-29javascript

1/**

2 * Shared TypeScript type-check helper.

3 *

4 * Backs both `vk check` (explicit type-check command) and the

5 * pre-deploy gate in `vk deploy`. Runs `tsc --noEmit -p <tsconfig>`

6 * against the consumer project so type errors in routes, functions,

7 * and `vk.config.ts` surface locally instead of as a half-applied

8 * CloudFormation stack.

9 *

10 * `tsc` is invoked through `npx` (with `shell: true`, matching the

11 * `npx cdk` invocation in `deploy.ts`). npx resolves the project's

dist/utils/config-loader.jsView file

Lines 8-48javascript

8import { join } from 'path';

9import { createJiti } from 'jiti';

10const VENTURE_CONFIG_FILE = 'vk.config.ts';

11/**

12 * Load vk.config.ts from the given project directory.

13 *

14 * Uses jiti for runtime TypeScript transpilation so consumers

dist/commands/init.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @venturekit/cli@0.0.1 matchedIdentity = npm:QHZlbnR1cmVraXQvY2xp:0.0.1 similarity = 0.939 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/commands/init.jsView on unpkg

Source & flagged code

6 flagged · loading source

dist/commands/generate.jsView file

443patternName = generic_password severity = medium line = 443 matchedText = " // ...',",

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/commands/generate.jsView on unpkg · L443

dist/utils/docker.jsView file

3*/ L4: import { execSync } from 'child_process'; L5: import { existsSync } from 'fs';

High

Child Process

Package source references child process execution.

dist/utils/docker.jsView on unpkg · L3

dist/utils/typecheck.jsView file

9* L10: * `tsc` is invoked through `npx` (with `shell: true`, matching the L11: * `npx cdk` invocation in `deploy.ts`). npx resolves the project's

High

Shell

Package source references shell execution.

dist/utils/typecheck.jsView on unpkg · L9

9* L10: * `tsc` is invoked through `npx` (with `shell: true`, matching the L11: * `npx cdk` invocation in `deploy.ts`). npx resolves the project's L12: * locally-installed `typescript` before fetching, so the check uses

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/utils/typecheck.jsView on unpkg · L9

dist/utils/config-loader.jsView file

28}); L29: const mod = await jiti.import(configPath); L30: const config = mod?.default ?? mod;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/utils/config-loader.jsView on unpkg · L28

dist/commands/init.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/commands/init.jsView on unpkg

Findings

1 Critical3 High5 Medium4 Low

CriticalPrevious Version Dangerous Deltadist/commands/init.js

HighChild Processdist/utils/docker.js

HighShelldist/utils/typecheck.js

HighRuntime Package Installdist/utils/typecheck.js

MediumSecret Patterndist/commands/generate.js

MediumDynamic Requiredist/utils/config-loader.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

6 flagged

dist/commands/generate.jsView file

Lines 423-463javascript

423 '});',

424 '',

425 ].join('\n');

426 const globalSetup = [

427 "import { waitForReady } from '@venturekit/testing';",

428 '',

429 `const API_PORT = Number(process.env.E2E_API_PORT ?? ${port});`,

430 'const API_URL = `http://localhost:${API_PORT}`;',

431 '',

432 'export default async function globalSetup() {',

433 " // The webServer block boots `vk dev`; confirm it's actually ready",

434 ' // (and really a vk dev server) before any spec runs.',

435 ' await waitForReady({ baseUrl: API_URL });',

436 '',

437 ' // If your API declares an `auth` intent, seed a known login here:',

438 ' //',

439 " // import { createTestUser } from '@venturekit/testing';",

440 ' // await createTestUser({',

441 ' // baseUrl: API_URL,',

442 " // email: 'admin@example.com',",

443 " // password: 'Passw0rd!',",

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/commands/generate.jsView on unpkg · L443

444 " // attributes: { tenantId: 'global' },",

445 ' // });',

446 '',

447 ' // To reset the DB between runs (needs @venturekit/data + DB env):',

448 ' //',

449 " // import { truncateAllTables } from '@venturekit/testing';",

450 ' // await truncateAllTables();',

451 '}',

452 '',

453 ].join('\n');

454 const healthSpec = [

455 "import { test, expect } from '@playwright/test';",

456 '',

457 `const API_PORT = Number(process.env.E2E_API_PORT ?? ${port});`,

458 'const API_URL = `http://localhost:${API_PORT}`;',

459 '',

460 "test('the API dev server is up', async ({ request }) => {",

461 ' const res = await request.get(`${API_URL}/_dev/health`);',

462 ' expect(res.ok()).toBeTruthy();',

463 ' const body = await res.json();',

dist/utils/docker.jsView file

Lines 1-23javascript

1/**

2 * Docker utilities shared across CLI commands.

3 */

4import { execSync } from 'child_process';

5import { existsSync } from 'fs';

High

Child Process

Package source references child process execution.

dist/utils/docker.jsView on unpkg · L3

6import { join } from 'path';

dist/utils/typecheck.jsView file

Lines 1-29javascript

1/**

2 * Shared TypeScript type-check helper.

3 *

4 * Backs both `vk check` (explicit type-check command) and the

5 * pre-deploy gate in `vk deploy`. Runs `tsc --noEmit -p <tsconfig>`

6 * against the consumer project so type errors in routes, functions,

7 * and `vk.config.ts` surface locally instead of as a half-applied

8 * CloudFormation stack.

9 *

10 * `tsc` is invoked through `npx` (with `shell: true`, matching the

11 * `npx cdk` invocation in `deploy.ts`). npx resolves the project's

dist/utils/config-loader.jsView file

Lines 8-48javascript

8import { join } from 'path';

9import { createJiti } from 'jiti';

10const VENTURE_CONFIG_FILE = 'vk.config.ts';

11/**

12 * Load vk.config.ts from the given project directory.

13 *

14 * Uses jiti for runtime TypeScript transpilation so consumers

dist/commands/init.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/commands/init.jsView on unpkg