registry / @whatalo/cli-kit / 1.1.5

@whatalo/cli-kit@1.1.5

Shared CLI utilities for Whatalo plugin development tools

Static Scan Results

scanned 4h ago · by rust-scanner

Static analysis flagged 8 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 16 file(s), 186 KB of source, external domains: developers.cloudflare.com, github.com, registry.npmjs.org

Source & flagged code

2 flagged

dist/config/index.cjsView file

Lines 25-65javascript

25 isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,

26 mod

27));

28var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);

30// src/config/index.ts

31var config_exports = {};

32__export(config_exports, {

33 CONFIG_FILE_NAME: () => CONFIG_FILE_NAME,

34 REQUIRED_FIELDS: () => REQUIRED_FIELDS,

35 loadManifest: () => loadManifest,

36 parseEnvFile: () => parseEnvFile,

37 pluginConfigSchema: () => pluginConfigSchema,

38 readConfig: () => readConfig,

39 updateEnvFile: () => updateEnvFile,

40 validateConfig: () => validateConfig,

41 writeConfig: () => writeConfig

42});

43module.exports = __toCommonJS(config_exports);

45// src/config/toml.ts

46var import_promises = require("fs/promises");

47var import_node_path = __toESM(require("path"), 1);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/config/index.cjsView on unpkg · L45

48var import_toml = __toESM(require("@iarna/toml"), 1);

50// src/config/types.ts

51var REQUIRED_FIELDS = [

52 "plugin.name",

53 "plugin.plugin_id",

54 "plugin.slug",

55 "build.dev_command",

56 "build.build_command",

57 "build.output_dir",

58 "dev.port"

59];

60var CONFIG_FILE_NAME = "whatalo.app.toml";

62// src/config/toml.ts

63async function readConfig(dir) {

64 const filePath = import_node_path.default.join(dir, CONFIG_FILE_NAME);

65 let raw;

dist/tunnel/index.cjsView file

Lines 18-58javascript

18 return to;

19};

20var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(

Source & flagged code

2 flagged · loading source

dist/config/index.cjsView file

45// src/config/toml.ts L46: var import_promises = require("fs/promises"); L47: var import_node_path = __toESM(require("path"), 1);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/config/index.cjsView on unpkg · L45

dist/tunnel/index.cjsView file

38// src/tunnel/cloudflared.ts L39: var import_node_child_process = require("child_process"); L40: var import_node_fs = require("fs"); ... L43: var import_node_os = __toESM(require("os"), 1); L44: var import_node_https = __toESM(require("https"), 1); L45: ... L68: function getBinDir() { L69: return import_node_path.default.join(import_node_os.default.homedir(), ".whatalo", "bin"); L70: } ... L74: function findOnSystemPath() { L75: const cmd = process.platform === "win32" ? "where" : "which"; L76: const result = (0, import_node_child_process.spawnSync)(cmd, ["cloudflared"], { encoding: "utf-8" });

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/tunnel/index.cjsView on unpkg · L38

Findings

1 High4 Medium3 Low

HighSandbox Evasion Gated Capabilitydist/tunnel/index.cjs

MediumDynamic Requiredist/config/index.cjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowUrl Strings

Source & flagged code

2 flagged

dist/config/index.cjsView file

Lines 25-65javascript

25 isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,

26 mod

27));

28var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);

30// src/config/index.ts

31var config_exports = {};

32__export(config_exports, {

33 CONFIG_FILE_NAME: () => CONFIG_FILE_NAME,

34 REQUIRED_FIELDS: () => REQUIRED_FIELDS,

35 loadManifest: () => loadManifest,

36 parseEnvFile: () => parseEnvFile,

37 pluginConfigSchema: () => pluginConfigSchema,

38 readConfig: () => readConfig,

39 updateEnvFile: () => updateEnvFile,

40 validateConfig: () => validateConfig,

41 writeConfig: () => writeConfig

42});

43module.exports = __toCommonJS(config_exports);

45// src/config/toml.ts

46var import_promises = require("fs/promises");

47var import_node_path = __toESM(require("path"), 1);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/config/index.cjsView on unpkg · L45

48var import_toml = __toESM(require("@iarna/toml"), 1);

50// src/config/types.ts

51var REQUIRED_FIELDS = [

52 "plugin.name",

53 "plugin.plugin_id",

54 "plugin.slug",

55 "build.dev_command",

56 "build.build_command",

57 "build.output_dir",

58 "dev.port"

59];

60var CONFIG_FILE_NAME = "whatalo.app.toml";

62// src/config/toml.ts

63async function readConfig(dir) {

64 const filePath = import_node_path.default.join(dir, CONFIG_FILE_NAME);

65 let raw;

dist/tunnel/index.cjsView file

Lines 18-58javascript

18 return to;

19};

20var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(