registry / @webjsdev/cli / 0.10.37

@webjsdev/cli@0.10.37

⚠ Under review

webjs CLI - dev, start, create, db

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 16 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 98 file(s), 640 KB of source, external domains: app.example.com, bugs.chromium.org, bugs.webkit.org, bugzilla.mozilla.org, docs.webjs.dev, github.com, nodejs.org, tailwindcss.com, ui.webjs.dev, webjs.dev, www.w3.org

Source & flagged code

10 flagged

lib/saas-template.jsView file

Lines 261-301javascript

261 " const app = await makeHandler();",

262 " const res = await testRequest(app.handle, '/dashboard');",

263 " if (res.status >= 500) {",

264 " t.skip('app deps not ready (run `npm run db:generate` + `npm run db:migrate`)');",

265 " return;",

266 " }",

267 " // The dashboard middleware calls auth(); with no session cookie it 302s to",

268 " // /login. This needs no DB row, only a cookie read, so it is always real",

269 " // once the modules import.",

270 " assert.equal(res.status, 302, 'unauthenticated dashboard is gated');",

271 " assert.equal(res.headers.get('location'), '/login');",

272 "});",

273 "",

274 "test('signup -> login -> dashboard renders for the authenticated user', async (t) => {",

275 " const app = await makeHandler();",

276 " // Probe readiness: a 5xx on the dashboard means deps/DB are not set up.",

277 " const probe = await testRequest(app.handle, '/dashboard');",

278 " if (probe.status >= 500) { t.skip('app deps not ready; run `npm run db:generate` + `npm run db:migrate`'); return; }",

279 "",

280 " const email = `harness+${Date.now()}@example.com`;",

281 " const password = 'password123';",

Medium

Secret Pattern

Package contains a possible secret pattern.

lib/saas-template.jsView on unpkg · L281

282 "",

283 " // Real signup through the page server action (the no-JS form write-path).",

284 " let canSignup = true;",

285 " try {",

286 " const signupRes = await testRequest(app.handle, '/signup', {",

287 " method: 'POST',",

288 " headers: { 'content-type': 'application/x-www-form-urlencoded' },",

289 " body: new URLSearchParams({ name: 'Harness', email, password }).toString(),",

290 " });",

291 " // Success auto-logs-in and 302s to /dashboard (carrying the session",

292 " // cookie); a 422 means validation failed. Either way the action ran.",

293 " assert.ok([302, 422].includes(signupRes.status), 'signup action ran');",

294 " if (signupRes.status === 302) assert.equal(signupRes.headers.get('location'), '/dashboard', 'signup lands on the dashboard');",

295 " if (signupRes.status !== 302) canSignup = false;",

296 " } catch {",

297 " // No migrated DB table -> the action throws. Skip the DB-backed assertions.",

298 " canSignup = false;",

299 " }",

300 " if (!canSignup) { t.skip('no migrated DB; run `npm run db:migrate` to enable the full flow'); return; }",

301 "",

Lines 380-420javascript

380 "import { cardClass, cardHeaderClass, cardTitleClass, cardDescriptionClass, cardContentClass, cardFooterClass } from '#components/ui/card.ts';",

381 "import { buttonClass } from '#components/ui/button.ts';",

382 "import { inputClass } from '#components/ui/input.ts';",

383 "import { labelClass } from '#components/ui/label.ts';",

384 "",

385 "export const metadata = { title: 'Sign up' };",

386 "",

387 "// Page server action: handles the POST from the form below. With JS",

bin/webjs.jsView file

Lines 1-22javascript

1#!/usr/bin/env node

2import { resolve, join, dirname } from 'node:path';

3import { spawn } from 'node:child_process';

4import { fileURLToPath } from 'node:url';

High

Child Process

Package source references child process execution.

bin/webjs.jsView on unpkg · L2

5import { resolveBin } from '../lib/resolve-bin.js'

lib/run-tasks.jsView file

Lines 25-65javascript

25 return { ...env, PATH: [...bins, env.PATH || ''].join(delimiter) };

26}

28/**

29 * Run the configured `before` steps (#550) sequentially to completion. Returns

30 * the FIRST failure so the caller can abort the boot, or `{ ok: true }`. Pure of

31 * `process.exit` and `console` (the bin owns the exit code + logging via the

32 * `onStep` hook) so the orchestration is deterministically unit-testable, with

lib/doctor.jsView file

Lines 255-295javascript

255 };

256}

257

258/**

259 * CHECK 4, vendor pin freshness. Applies ONLY when a pin file exists. PASS/skip

260 * for an unpinned app (it resolves live, which is fine in dev). BEST-EFFORT +

261 * NETWORK-TOLERANT: any error (network, timeout) is a WARN "could not check",

262 * never a hard fail and never a throw. PASS when all pins current, WARN listing

263 * outdated packages otherwise.

264 *

265 * The vendor functions are injected via `opts.vendor` so a test can supply a

266 * stub without a real network call; absent the override, they are dynamically

templates/.cursor/hooks/nudge-uncommitted.shView file

•path = templates/.cursor/hooks/nudge-uncommitted.sh kind = payload_in_excluded_dir sizeBytes = 1432 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

templates/.cursor/hooks/nudge-uncommitted.shView on unpkg

•path = templates/.cursor/hooks/nudge-uncommitted.sh kind = build_helper sizeBytes = 1432 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/.cursor/hooks/nudge-uncommitted.shView on unpkg

lib/create.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @webjsdev/cli@0.10.32 matchedIdentity = npm:QHdlYmpzZGV2L2NsaQ:0.10.32 similarity = 0.806 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/create.jsView on unpkg

Source & flagged code

10 flagged · loading source

lib/saas-template.jsView file

281patternName = generic_password severity = medium line = 281 matchedText = " const...';",

Medium

Secret Pattern

Package contains a possible secret pattern.

lib/saas-template.jsView on unpkg · L281

400patternName = generic_password severity = medium line = 400 matchedText = " if (p...';",

Medium

Secret Pattern

Hardcoded password in lib/saas-template.js

lib/saas-template.jsView on unpkg · L400

bin/webjs.jsView file

2import { resolve, join, dirname } from 'node:path'; L3: import { spawn } from 'node:child_process'; L4: import { fileURLToPath } from 'node:url';

High

Child Process

Package source references child process execution.

bin/webjs.jsView on unpkg · L2

2Cross-file remote execution chain: bin/webjs.js spawns lib/create.js; helper contains network access plus dynamic code execution. L2: import { resolve, join, dirname } from 'node:path'; L3: import { spawn } from 'node:child_process'; L4: import { fileURLToPath } from 'node:url'; ... L9: L10: const __dirname = dirname(fileURLToPath(import.meta.url)); L11: const [cmd, ...rest] = process.argv.slice(2); ... L25: const { readFileSync } = await import('node:fs'); L26: const pkg = JSON.parse( L27: readFileSync(join(__dirname, '..', 'package.json'), 'utf8'), L28: ); ... L130: // start the server directly. L131: if (process.env.__WEBJS_DEV_CHILD === '1') {

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

bin/webjs.jsView on unpkg · L2

238'webjs db: drizzle-kit is not installed in this project.\n' + L239: 'Install it with `npm install -D drizzle-kit`, then re-run `webjs db ' + sub + '`.', L240: ); ... L242: } L243: const child = spawn(process.execPath, [dkPath, ...kitArgs, ...args], { stdio: 'inherit', cwd: process.cwd() }); L244: child.on('exit', (code) => process.exit(code ?? 0));

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/webjs.jsView on unpkg · L238

lib/run-tasks.jsView file

45const code = await new Promise((res) => { L46: const c = spawn(step, { shell: true, stdio: 'inherit', cwd, env }); L47: c.on('exit', (code) => res(code ?? 0));

High

Shell

Package source references shell execution.

lib/run-tasks.jsView on unpkg · L45

lib/doctor.jsView file

275package = @webjsdev/cli; repositoryIdentity = webjs; dependency = @webjsdev/server L275: try { L276: const mod = await import('@webjsdev/server'); L277: vendor = { hasVendorPin: mod.hasVendorPin, findOutdated: mod.findOutdated };

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

lib/doctor.jsView on unpkg · L275

templates/.cursor/hooks/nudge-uncommitted.shView file

•path = templates/.cursor/hooks/nudge-uncommitted.sh kind = payload_in_excluded_dir sizeBytes = 1432 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

templates/.cursor/hooks/nudge-uncommitted.shView on unpkg

•path = templates/.cursor/hooks/nudge-uncommitted.sh kind = build_helper sizeBytes = 1432 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/.cursor/hooks/nudge-uncommitted.shView on unpkg

lib/create.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/create.jsView on unpkg

Findings

1 Critical6 High6 Medium3 Low

CriticalPrevious Version Dangerous Deltalib/create.js

HighChild Processbin/webjs.js

HighShelllib/run-tasks.js

HighCopied Package Dependency Bridgelib/doctor.js

HighCross File Remote Execution Contextbin/webjs.js

HighRuntime Package Installbin/webjs.js

HighPayload In Excluded Dirtemplates/.cursor/hooks/nudge-uncommitted.sh

MediumSecret Patternlib/saas-template.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helpertemplates/.cursor/hooks/nudge-uncommitted.sh

MediumStructural Risk Force Deep Review

MediumSecret Patternlib/saas-template.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

10 flagged

lib/saas-template.jsView file

Lines 261-301javascript

261 " const app = await makeHandler();",

262 " const res = await testRequest(app.handle, '/dashboard');",

263 " if (res.status >= 500) {",

264 " t.skip('app deps not ready (run `npm run db:generate` + `npm run db:migrate`)');",

265 " return;",

266 " }",

267 " // The dashboard middleware calls auth(); with no session cookie it 302s to",

268 " // /login. This needs no DB row, only a cookie read, so it is always real",

269 " // once the modules import.",

270 " assert.equal(res.status, 302, 'unauthenticated dashboard is gated');",

271 " assert.equal(res.headers.get('location'), '/login');",

272 "});",

273 "",

274 "test('signup -> login -> dashboard renders for the authenticated user', async (t) => {",

275 " const app = await makeHandler();",

276 " // Probe readiness: a 5xx on the dashboard means deps/DB are not set up.",

277 " const probe = await testRequest(app.handle, '/dashboard');",

278 " if (probe.status >= 500) { t.skip('app deps not ready; run `npm run db:generate` + `npm run db:migrate`'); return; }",

279 "",

280 " const email = `harness+${Date.now()}@example.com`;",

281 " const password = 'password123';",

Medium

Secret Pattern

Package contains a possible secret pattern.

lib/saas-template.jsView on unpkg · L281

282 "",

283 " // Real signup through the page server action (the no-JS form write-path).",

284 " let canSignup = true;",

285 " try {",

286 " const signupRes = await testRequest(app.handle, '/signup', {",

287 " method: 'POST',",

288 " headers: { 'content-type': 'application/x-www-form-urlencoded' },",

289 " body: new URLSearchParams({ name: 'Harness', email, password }).toString(),",

290 " });",

291 " // Success auto-logs-in and 302s to /dashboard (carrying the session",

292 " // cookie); a 422 means validation failed. Either way the action ran.",

293 " assert.ok([302, 422].includes(signupRes.status), 'signup action ran');",

294 " if (signupRes.status === 302) assert.equal(signupRes.headers.get('location'), '/dashboard', 'signup lands on the dashboard');",

295 " if (signupRes.status !== 302) canSignup = false;",

296 " } catch {",

297 " // No migrated DB table -> the action throws. Skip the DB-backed assertions.",

298 " canSignup = false;",

299 " }",

300 " if (!canSignup) { t.skip('no migrated DB; run `npm run db:migrate` to enable the full flow'); return; }",

301 "",

Lines 380-420javascript

380 "import { cardClass, cardHeaderClass, cardTitleClass, cardDescriptionClass, cardContentClass, cardFooterClass } from '#components/ui/card.ts';",

381 "import { buttonClass } from '#components/ui/button.ts';",

382 "import { inputClass } from '#components/ui/input.ts';",

383 "import { labelClass } from '#components/ui/label.ts';",

384 "",

385 "export const metadata = { title: 'Sign up' };",

386 "",

387 "// Page server action: handles the POST from the form below. With JS",

bin/webjs.jsView file

Lines 1-22javascript

1#!/usr/bin/env node

2import { resolve, join, dirname } from 'node:path';

3import { spawn } from 'node:child_process';

4import { fileURLToPath } from 'node:url';

High

Child Process

Package source references child process execution.

bin/webjs.jsView on unpkg · L2

5import { resolveBin } from '../lib/resolve-bin.js'

lib/run-tasks.jsView file

Lines 25-65javascript

25 return { ...env, PATH: [...bins, env.PATH || ''].join(delimiter) };

26}

28/**

29 * Run the configured `before` steps (#550) sequentially to completion. Returns

30 * the FIRST failure so the caller can abort the boot, or `{ ok: true }`. Pure of

31 * `process.exit` and `console` (the bin owns the exit code + logging via the

32 * `onStep` hook) so the orchestration is deterministically unit-testable, with

lib/doctor.jsView file

Lines 255-295javascript

255 };

256}

257

258/**

259 * CHECK 4, vendor pin freshness. Applies ONLY when a pin file exists. PASS/skip

260 * for an unpinned app (it resolves live, which is fine in dev). BEST-EFFORT +

261 * NETWORK-TOLERANT: any error (network, timeout) is a WARN "could not check",

262 * never a hard fail and never a throw. PASS when all pins current, WARN listing

263 * outdated packages otherwise.

264 *

265 * The vendor functions are injected via `opts.vendor` so a test can supply a

266 * stub without a real network call; absent the override, they are dynamically

templates/.cursor/hooks/nudge-uncommitted.shView file

•path = templates/.cursor/hooks/nudge-uncommitted.sh kind = payload_in_excluded_dir sizeBytes = 1432 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

templates/.cursor/hooks/nudge-uncommitted.shView on unpkg

•path = templates/.cursor/hooks/nudge-uncommitted.sh kind = build_helper sizeBytes = 1432 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/.cursor/hooks/nudge-uncommitted.shView on unpkg

lib/create.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/create.jsView on unpkg