registry / @venturekit/cli / 0.0.7

@venturekit/cli@0.0.7

⚠ Under review

CLI for VentureKit - scaffolding and deploy orchestration

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 36 file(s), 467 KB of source, external domains: app.example.com, doc.venturekit.dev, github.com, schema.getpostman.com, token.actions.githubusercontent.com, venturekit.dev, www.npmjs.com

Source & flagged code

6 flagged

dist/commands/generate.jsView file

Lines 423-463javascript

423 '});',

424 '',

425 ].join('\n');

426 const globalSetup = [

427 "import { waitForReady } from '@venturekit/testing';",

428

Source & flagged code

6 flagged · loading source

dist/commands/generate.jsView file

443patternName = generic_password severity = medium line = 443 matchedText = " // ...',",

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/commands/generate.jsView on unpkg · L443

dist/utils/docker.jsView file

3*/ L4: import { execSync } from 'child_process'; L5: import { existsSync } from 'fs';

High

Child Process

Package source references child process execution.

dist/utils/docker.jsView on unpkg · L3

dist/utils/typecheck.jsView file

9* L10: * `tsc` is invoked through `npx` (with `shell: true`, matching the L11: * `npx cdk` invocation in `deploy.ts`). npx resolves the project's

High

Shell

Package source references shell execution.

dist/utils/typecheck.jsView on unpkg · L9

9* L10: * `tsc` is invoked through `npx` (with `shell: true`, matching the L11: * `npx cdk` invocation in `deploy.ts`). npx resolves the project's L12: * locally-installed `typescript` before fetching, so the check uses

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/utils/typecheck.jsView on unpkg · L9

dist/utils/config-loader.jsView file

28}); L29: const mod = await jiti.import(configPath); L30: const config = mod?.default ?? mod;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/utils/config-loader.jsView on unpkg · L28

dist/commands/deploy.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @venturekit/cli@0.0.1 matchedIdentity = npm:QHZlbnR1cmVraXQvY2xp:0.0.1 similarity = 0.848 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/commands/deploy.jsView on unpkg

Findings

1 Critical3 High5 Medium4 Low

CriticalPrevious Version Dangerous Deltadist/commands/deploy.js

HighChild Processdist/utils/docker.js

HighShelldist/utils/typecheck.js

HighRuntime Package Installdist/utils/typecheck.js

MediumSecret Patterndist/commands/generate.js

MediumDynamic Requiredist/utils/config-loader.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

dist/utils/typecheck.jsView file

Lines 1-29javascript

1/**

2 * Shared TypeScript type-check helper.

3 *

4 * Backs both `vk check` (explicit type-check command) and the

5 * pre-deploy gate in `vk deploy`. Runs `tsc --noEmit -p <tsconfig>`

6 * against the consumer project so type errors in routes, functions,

7 * and `vk.config.ts` surface locally instead of as a half-applied

8 * CloudFormation stack.

9 *

10 * `tsc` is invoked through `npx` (with `shell: true`, matching the

11 * `npx cdk` invocation in `deploy.ts`). npx resolves the project's

High

Shell

Package source references shell execution.

dist/utils/typecheck.jsView on unpkg · L9

12 * locally-installed `typescript` before fetching, so the check uses

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/utils/typecheck.jsView on unpkg · L9

13 * the exact compiler version the project pins.

14 */

15import { spawn } from 'node:child_process';

16import { existsSync } from 'node:fs';

17import { join } from 'node:path';

18/**

19 * Resolve the project's `tsconfig.json`, or null if it has none.

20 */

21export function findTsconfig(projectDir) {

22 const candidate = join(projectDir, 'tsconfig.json');

23 return existsSync(candidate) ? candidate : null;

24}

25/**

26 * Run `tsc --noEmit` against the project's tsconfig.

27 *

28 * Resolves (never rejects) with a {@link TypecheckResult}. When no

29 * tsconfig is found, returns `{ ran: false, ok: true }` so callers can

dist/utils/config-loader.jsView file

Lines 8-48javascript

8import { join } from 'path';

9import { createJiti } from 'jiti';

10const VENTURE_CONFIG_FILE = 'vk.config.ts';

11/**

12 * Load vk.config.ts from the given project directory.

13 *

14 * Uses jiti for runtime TypeScript transpilation so consumers

15 * don't need tsx/ts-node installed.

16 *

17 * @throws if vk.config.ts is not found or fails to load

18 */

19export async function loadVentureConfig(projectDir, stage) {

20 const configPath = join(projectDir, VENTURE_CONFIG_FILE);

21 if (!existsSync(configPath)) {

22 throw new Error(`No ${VENTURE_CONFIG_FILE} found in ${projectDir}. Run \`vk init <name>\` first.`);

23 }

24 // Create a jiti instance rooted at the project dir

25 const jiti = createJiti(projectDir, {

26 interopDefault: true,

27 moduleCache: false,

28 });

29 const mod = await jiti.import(configPath);

30 const config = mod?.default ?? mod;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/utils/config-loader.jsView on unpkg · L28

31 // defineVenture() returns { app(), _routesDir, _resolveInfrastructure, _definition }

32 if (typeof config?.app === 'function') {

33 const currentStage = stage || 'dev';

34 const appConfig = config.app({ stage: currentStage });

35 // Extract infrastructure intents from the env config for the current stage

36 const resolvedInfra = typeof config._resolveInfrastructure === 'function'

37 ? config._resolveInfrastructure(currentStage)

38 : undefined;

39 return {

40 name: appConfig.name || 'venture-app',

41 region: appConfig.providers?.aws?.region || 'us-east-1',

42 routesDir: config._routesDir || 'src/routes',

43 functionsDir: config._functionsDir || 'src/functions',

44 queuesDir: config._queuesDir || 'src/queues',

45 cronsDir: config._cronsDir || 'src/crons',

46 wsDir: config._wsDir || 'src/ws',

47 infrastructure: resolvedInfra,

48 definition: config._definition,