registry / @vyriy/scripts / 0.9.2

@vyriy/scripts@0.9.2

Shared scripts package for Vyriy projects

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 3 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessShell

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 10 file(s), 8.92 KB of source

Source & flagged code

2 flagged

kaniko.jsView file

Lines 1-17javascript

1import { exec } from '@vyriy/exec';

2import { script } from '@vyriy/script';

3import { createLogger } from '@vyriy/logger';

4import { output } from '@vyriy/cdk';

5export const kaniko = (path, repositoryUri = 'RepositoryUri') => script(async () => {

6 const logger = createLogger();

7 logger.info('Kaniko deploying...');

8 const repository = output()[repositoryUri];

9 logger.info('Repository:', repository);

10 await exec(`/kaniko/executor \

11 --context "${path}" \

High

Child Process

Package source references child process execution.

kaniko.jsView on unpkg · L9

12 --dockerfile "${path}/Dockerfile" \

13 --destination "${repository}:latest" \

14 --single-snapshot > cdk.out/kaniko.logs.txt`);

15 logger.info('Kaniko deploying finished!');

16});

deploy.jsView file

Lines 1-13javascript

1import { script } from '@vyriy/script';

2import { createLogger } from '@vyriy/logger';

3import { exec } from '@vyriy/exec';

4export const deploy = () => script(async () => {

Source & flagged code

2 flagged · loading source

kaniko.jsView file

9logger.info('Repository:', repository); L10: await exec(`/kaniko/executor \ L11: --context "${path}" \

High

Child Process

Package source references child process execution.

kaniko.jsView on unpkg · L9

deploy.jsView file

7await exec('mkdir cdk.out'); L8: await exec('npx cdk synth > cdk.out/cloudformation.yml'); L9: await exec('npx aws-cdk diff');

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

deploy.jsView on unpkg · L7

Findings

3 High

HighChild Processkaniko.js

HighShell

HighRuntime Package Installdeploy.js

Source & flagged code

2 flagged

kaniko.jsView file

Lines 1-17javascript

1import { exec } from '@vyriy/exec';

2import { script } from '@vyriy/script';

3import { createLogger } from '@vyriy/logger';

4import { output } from '@vyriy/cdk';

5export const kaniko = (path, repositoryUri = 'RepositoryUri') => script(async () => {

6 const logger = createLogger();

7 logger.info('Kaniko deploying...');

8 const repository = output()[repositoryUri];

9 logger.info('Repository:', repository);

10 await exec(`/kaniko/executor \

11 --context "${path}" \

High

Child Process

Package source references child process execution.

kaniko.jsView on unpkg · L9

12 --dockerfile "${path}/Dockerfile" \

13 --destination "${repository}:latest" \

14 --single-snapshot > cdk.out/kaniko.logs.txt`);

15 logger.info('Kaniko deploying finished!');

16});

deploy.jsView file

Lines 1-13javascript

1import { script } from '@vyriy/script';

2import { createLogger } from '@vyriy/logger';

3import { exec } from '@vyriy/exec';

4export const deploy = () => script(async () => {