registry / @vnejs/monorepo / 0.0.6

@vnejs/monorepo@0.0.6

Monorepo tooling for @vnejs

AI Security Review

scanned 16d ago · by lpm-firewall-ai

No confirmed malicious attack surface was established. The risky primitives are explicit monorepo maintenance commands aligned with package purpose, not automatic install/import behavior.

Static reason

One or more suspicious static signals were detected.

Trigger

User runs @vnejs/monorepo CLI commands such as publish, sync-deps, run, run-changed, package, test, bump, or clear.

Impact

Can publish packages, run workspace scripts, update package.json/package-lock.json, or delete build/cache/dependency folders when deliberately invoked.

Mechanism

User-invoked child_process shell commands for npm/git/turbo/build cleanup and package metadata writes.

Rationale

Static inspection shows a small monorepo tooling CLI with user-invoked shell/file operations and npm registry lookups, but no lifecycle execution, stealth exfiltration, persistence, or hidden payload. The scanner findings are explained by expected package-management functionality.

Evidence

package.jsonsrc/cli.jssrc/index.jssrc/publish/index.jssrc/publish/utils.jssrc/workspace/fetch-npm-version.jssrc/sync-deps/index.jssrc/clear/index.jssrc/run/index.jssrc/run-changed/index.jssrc/changed-packages.jspackage-lock.jsonnode_modules.turbodist

Decision evidence

public snapshot

AI called this Clean at 91.0% confidence as Benign with low false-positive risk.

Evidence for block

User-invoked CLI commands run shell tools such as npm, npx turbo, git, rm, and find.
src/clear/index.js intentionally deletes node_modules, .turbo, dist, and package-lock.json when the clear command is run.
src/workspace/fetch-npm-version.js queries npm via npm view and can clean npm cache while waiting for expected versions.

Evidence against

package.json has no install/preinstall/postinstall lifecycle hook.
src/index.js only exports modules; no import-time network, shell, or file mutation observed.
src/cli.js actions are explicit monorepo commands, not automatic install-time execution.
src/publish/index.js and src/sync-deps/index.js write package.json/version data for publish/dependency sync workflows.
No credential harvesting, env dumping, hidden endpoints, persistence, binary loading, or reviewer/AI control-surface writes found.

Behavioral surface

Source

ChildProcessFilesystemShell

Supply chainNo supply-chain packaging signals triggered.

Source & flagged code

2 flagged

src/workspace/fetch-npm-version.jsView file

Lines 1-21javascript

1const { execSync } = require("child_process");

2const { parseExpectVersion, shouldWaitForExpectVersion } = require("./expect-version");

High

Child Process

Package source references child process execution.

src/workspace/fetch-npm-version.jsView on unpkg · L1

4const fetchRaw = (name) => {

5 try {

6 return execSync(`npm view ${JSON.stringify(name)} version`, {

7 encoding: "utf8",

8 stdio: ["ignore", "pipe", "ignore"],

9 }).trim();

10 } catch {

11 return null;

12 }

13};

15const clearNpmCache = () => {

16 execSync("npm cache clean --force", { stdio: "inherit" });

17};

19const sleepSync = (ms) => {

20 execSync(`sleep ${Math.max(1, Math.ceil(ms / 1000))}`, { stdio: "ignore" });

21};

src/publish/utils.jsView file

Lines 7-39javascript

7const readVersion = (pkgDir) => readPackageJson(pkgDir).version;

9const readPackageName = (pkgDir) => readPackageJson(pkgDir).name;

Source & flagged code

2 flagged · loading source

src/workspace/fetch-npm-version.jsView file

1const { execSync } = require("child_process"); L2: const { parseExpectVersion, shouldWaitForExpectVersion } = require("./expect-version");

High

Child Process

Package source references child process execution.

src/workspace/fetch-npm-version.jsView on unpkg · L1

src/publish/utils.jsView file

27const run = (command, pkgDir) => { L28: execSync(command, { cwd: pkgDir, stdio: "inherit" }); L29: }; ... L34: L35: run("npx @vnejs/monorepo package --clean", pkgDir); L36: };

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/publish/utils.jsView on unpkg · L27

Findings

3 High2 Low

HighChild Processsrc/workspace/fetch-npm-version.js

HighShell

HighRuntime Package Installsrc/publish/utils.js

LowScripts Present

LowFilesystem