registry / @wealthx/shadcn / 1.5.67

@wealthx/shadcn@1.5.67

WealthX component library built on [shadcn/ui](https://ui.shadcn.com), Tailwind CSS v4, and Radix primitives.

Static Scan Results

scanned 5d ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessFilesystemShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

NoLicenseWildcardDependency

scanned 839 file(s), 9.65 MB of source, external domains: d1rndq5v7rs3ry.cloudfront.net, fonts.googleapis.com, tailwindcss.com, www.cdr.gov.au, www.w3.org

Source & flagged code

2 flagged

scripts/build-css.tsView file

Lines 1-34typescript

1/* eslint-disable @typescript-eslint/no-unsafe-assignment, @typescript-eslint/no-unsafe-call -- Node.js build script; imports are safe */

2import { execSync } from "node:child_process";

3import { readFileSync, writeFileSync, mkdirSync } from "node:fs";

High

Child Process

Package source references child process execution.

scripts/build-css.tsView on unpkg · L1

4import { resolve, dirname } from "node:path";

5import { fileURLToPath } from "node:url";

7const __filename: string = fileURLToPath(import.meta.url);

8const __dirname: string = dirname(__filename);

10const root: string = resolve(__dirname, "..");

11const distDir: string = resolve(root, "dist");

12const outCss: string = resolve(distDir, "styles.css");

13const stylesTsPath: string = resolve(root, "src/styles/styles-css.ts");

15// Ensure dist/ exists

16mkdirSync(distDir, { recursive: true });

18// Compile globals.css → dist/styles.css using @tailwindcss/cli

19execSync(

20 `npx @tailwindcss/cli -i src/styles/globals.css -o dist/styles.css --minify`,

21 { cwd: root, stdio: "inherit" }

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/build-css.tsView on unpkg · L18

22);

24// Read compiled CSS and write as TS string constant

25const css: string = readFileSync(outCss, "utf-8");

26const escaped: string = css.replace(/\\/g, "\\\\").replace(/`/g, "\\`").replace(/\$/g, "\\$");

27writeFileSync(

28 stylesTsPath,

29 `export const STYLES_CSS = \`${escaped}\`;\n`

30);

32// eslint-disable-next-line no-console -- Build script output

33console.log("Built dist/styles.css and src/styles/styles-css.ts");

Source & flagged code

2 flagged · loading source

scripts/build-css.tsView file

1/* eslint-disable @typescript-eslint/no-unsafe-assignment, @typescript-eslint/no-unsafe-call -- Node.js build script; imports are safe */ L2: import { execSync } from "node:child_process"; L3: import { readFileSync, writeFileSync, mkdirSync } from "node:fs";

High

Child Process

Package source references child process execution.

scripts/build-css.tsView on unpkg · L1

18// Compile globals.css → dist/styles.css using @tailwindcss/cli L19: execSync( L20: `npx @tailwindcss/cli -i src/styles/globals.css -o dist/styles.css --minify`, L21: { cwd: root, stdio: "inherit" }

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/build-css.tsView on unpkg · L18

Findings

3 High2 Medium5 Low

HighChild Processscripts/build-css.ts

HighShell

HighRuntime Package Installscripts/build-css.ts

MediumStructural Risk Force Deep Review

MediumWildcard Dependency

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

2 flagged

scripts/build-css.tsView file

Lines 1-34typescript

1/* eslint-disable @typescript-eslint/no-unsafe-assignment, @typescript-eslint/no-unsafe-call -- Node.js build script; imports are safe */

2import { execSync } from "node:child_process";

3import { readFileSync, writeFileSync, mkdirSync } from "node:fs";

High

Child Process

Package source references child process execution.

scripts/build-css.tsView on unpkg · L1

4import { resolve, dirname } from "node:path";

5import { fileURLToPath } from "node:url";

7const __filename: string = fileURLToPath(import.meta.url);

8const __dirname: string = dirname(__filename);

10const root: string = resolve(__dirname, "..");

11const distDir: string = resolve(root, "dist");

12const outCss: string = resolve(distDir, "styles.css");

13const stylesTsPath: string = resolve(root, "src/styles/styles-css.ts");

15// Ensure dist/ exists

16mkdirSync(distDir, { recursive: true });

18// Compile globals.css → dist/styles.css using @tailwindcss/cli

19execSync(

20 `npx @tailwindcss/cli -i src/styles/globals.css -o dist/styles.css --minify`,

21 { cwd: root, stdio: "inherit" }

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/build-css.tsView on unpkg · L18

22);

24// Read compiled CSS and write as TS string constant

25const css: string = readFileSync(outCss, "utf-8");

26const escaped: string = css.replace(/\\/g, "\\\\").replace(/`/g, "\\`").replace(/\$/g, "\\$");

27writeFileSync(

28 stylesTsPath,

29 `export const STYLES_CSS = \`${escaped}\`;\n`

30);

32// eslint-disable-next-line no-console -- Build script output

33console.log("Built dist/styles.css and src/styles/styles-css.ts");