registry / @vnejs/monorepo / 0.1.0

@vnejs/monorepo@0.1.0

Monorepo tooling for @vnejs

Static Scan Results

scanned 4h ago · by rust-scanner

Static analysis flagged 7 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireFilesystemShell

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 29 file(s), 41.8 KB of source

Source & flagged code

3 flagged

src/workspace/fetch-npm-version.jsView file

Lines 1-21javascript

1const { execSync } = require("child_process");

2const { parseExpectVersion, shouldWaitForExpectVersion } = require("./expect-version");

High

Child Process

Package source references child process execution.

src/workspace/fetch-npm-version.jsView on unpkg · L1

4const fetchRaw = (name) => {

5 try {

6 return execSync(`npm view ${JSON.stringify(name)} version`, {

7 encoding: "utf8",

8 stdio: ["ignore", "pipe", "ignore"],

9 }).trim();

10 } catch {

11 return null;

12 }

13};

15const clearNpmCache = () => {

16 execSync("npm cache clean --force", { stdio: "inherit" });

17};

19const sleepSync = (ms) => {

20 execSync(`sleep ${Math.max(1, Math.ceil(ms / 1000))}`, { stdio: "ignore" });

21};

src/layers/list-package-dirs.jsView file

Lines 1-10javascript

1const { existsSync, readdirSync } = require("fs");

2const path = require("path");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/layers/list-package-dirs.jsView on unpkg · L1

src/publish/utils.jsView file

Lines 7-39javascript

7const readVersion = (pkgDir) => readPackageJson(pkgDir).version;

9const readPackageName = (pkgDir) => readPackageJson(pkgDir).name;

Source & flagged code

3 flagged · loading source

src/workspace/fetch-npm-version.jsView file

1const { execSync } = require("child_process"); L2: const { parseExpectVersion, shouldWaitForExpectVersion } = require("./expect-version");

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code