registry / @xframework-ca-test/cli / 1.0.39

@xframework-ca-test/cli@1.0.39

xFramework — one command to run your portal locally

AI Security Review

scanned 3h ago · by lpm-firewall-ai

The main risk is shipped repository access credentials embedded in the CLI bundle. They are used by explicit init/create commands to clone package-owned Bitbucket repositories, not by install-time code.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

User runs xframework-cli init/create or default/start/run CLI commands.

Impact

Potential unauthorized access to upstream private repos if embedded tokens are valid; local project files/logs are created or overwritten during CLI workflows.

Mechanism

hardcoded Bitbucket tokens and command-invoked project scaffolding/runtime process spawning

Rationale

Source inspection does not show unconsented install-time execution, exfiltration, persistence, or AI-agent hijacking, so a malicious block is not established. The embedded Bitbucket tokens are a concrete unresolved security risk and should be warned/quarantined until rotated or removed.

Evidence

package.jsonindex.bundle.jsscripts/prepack.jsscripts/build-aws.jsdist/ui/assets/SetupWizard-609e8434.jsdist/ui/assets/vendor-msal-69061c3a.js<project>/api<project>/ui<project>/customer-portal<project>/xframework.json<project>/api.log<project>/ui.log<project>/customer-portal.log~/.xFramework/instances/default/.pid~/.xFramework/instances/default/config.json

Network endpoints5

bitbucket.org/contentactivedev/xframework-api.gitbitbucket.org/contentactivedev/xframework.gitbitbucket.org/contentactivedev/xframework-customer.gitlocalhost:*127.0.0.1:*

Decision evidence

public snapshot

AI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

index.bundle.js embeds three Bitbucket access tokens as defaults for XFRAMEWORK_BB_TOKEN_API/UI/CP.
index.bundle.js builds authenticated https://x-token-auth URLs for bitbucket.org/contentactivedev/{xframework-api,xframework,xframework-customer}.git.
index.bundle.js init/create commands clone remote repos and delete/rewrite target project directories on explicit user command.
index.bundle.js run/start commands spawn dotnet/npm/pg_dump/psql and write logs/config under xFramework project or ~/.xFramework.

Evidence against

package.json has no preinstall/install/postinstall hook; only prepublishOnly build script.
CLI actions are command-invoked; no import-time credential harvesting or broad filesystem scan found.
Network endpoints are package-aligned Bitbucket clone URLs and localhost service URLs.
dist/ui MSAL/password fields are bundled application UI/setup flows, not confirmed phishing or exfiltration.
No AI-agent control-surface writes found.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareTelemetryUrlStrings

Manifest

NoLicenseWildcardDependency

scanned 351 file(s), 16.4 MB of source, external domains: 127.0.0.1, 169.254.169.254, accounts.google.com, acme.com, aka.ms, aomedia.org, api.ipify.org, barcode.tec-it.com, beta.com, bit.ly, cdn.jsdelivr.net, conformance.dashif.org, dashif.org, delta.com, developers.google.com, docs.microsoft.com, dotnet.microsoft.com, example.com, fast.wistia.com, fb.me, feross.org, fonts.googleapis.com, foo.bar, gamma.com, github.com, go.devexpress.com, goo.gl, httpbin.org, id.gs1.org, imf.gov, img.litix.io, js.devexpress.com, jurassic.tech, learn.microsoft.com, libertyhigh.edu, login.chinacloudapi.cn, login.microsoftonline.com, login.microsoftonline.de, login.microsoftonline.us, login.partner.microsoftonline.cn, login.sovcloud-identity.de, login.sovcloud-identity.fr, login.sovcloud-identity.sg, login.windows-ppe.net, maps.googleapis.com, momentjs.com, mui.com, npms.io, open.spotify.com, player.twitch.tv

Oversized source lightweight scan

dist/customer-portal/assets/DocumentList-f286e322.js2.74 MB file, sampled 256 KB

ChildProcessHighEntropyStringsMinifiedUrlStringsgithub.comwww.w3.org

dist/ui/assets/ReportEditor-01511a50.js3.30 MB file, sampled 256 KB

ChildProcessEvalHighEntropyStringsMinified

dist/ui/assets/index-f9dbc56a.js6.45 MB file, sampled 256 KB

NetworkDynamicRequireHighEntropyStringsMinifiedUrlStringscdn.jsdelivr.nethttpbin.orglogin.microsoftonline.commaps.googleapis.comquilljs.comreact.devwww.google.com

dist/ui/assets/vendor-devex-aec1fb1b.js2.95 MB file, sampled 256 KB

ChildProcessHighEntropyStringsMinifiedUrlStringsgithub.comjs.devexpress.comsupportcenter.devexpress.comwww.devexpress.comwww.w3.org

Source & flagged code

12 flagged

dist/ui/assets/SetupWizard-609e8434.jsView file

Lines 1-2javascript

1import{j as e}from"./vendor-mui-15c6777f.js";import{f as re,r as l}from"./vendor-react-a844883a.js";import{K as N,W as z}from"./index-f9dbc56a.js";import"./vendor-redux-d4d8780a.js";import"./vendor-pdf-b5ab85ab.js";import"./vendor-devex-aec1fb1b.js"

Source & flagged code

12 flagged · loading source

dist/ui/assets/SetupWizard-609e8434.jsView file

1patternName = generic_password severity = medium line = 1 matchedText = import{j...lt};

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/ui/assets/SetupWizard-609e8434.jsView on unpkg · L1

dist/ui/assets/vendor-pdf-b5ab85ab.jsView file

1var Bs=(h,t,e)=>{if(!t.has(h))throw TypeError("Cannot "+e)};var Z=(h,t,e)=>(Bs(h,t,"read from private field"),e?e.call(h):t.get(h)),kt=(h,t,e)=>{if(t.has(h))throw TypeError("Cannot... L2: `);return t.join("")}}function Ue(h,t){const e=t?URL.parse(h,t):URL.parse(h);return e?.protocol==="http:"||e?.protocol==="https:"}function Lt(h){h.preventDefault()}function nt(h){h... L3: `)||null;a&&this.data.comb&&(a=a.replaceAll(/\s+/g,""));const o={userValue:n,formattedValue:a,lastCommittedValue:null,commitKey:1,focused:!1};this.data.multiLine?(s=document.create...

High

Child Process

Package source references child process execution.

dist/ui/assets/vendor-pdf-b5ab85ab.jsView on unpkg · L1

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/ui/assets/vendor-pdf-b5ab85ab.jsView on unpkg · L1

1var Bs=(h,t,e)=>{if(!t.has(h))throw TypeError("Cannot "+e)};var Z=(h,t,e)=>(Bs(h,t,"read from private field"),e?e.call(h):t.get(h)),kt=(h,t,e)=>{if(t.has(h))throw TypeError("Cannot... L2: `);return t.join("")}}function Ue(h,t){const e=t?URL.parse(h,t):URL.parse(h);return e?.protocol==="http:"||e?.protocol==="https:"}function Lt(h){h.preventDefault()}function nt(h){h...

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/ui/assets/vendor-pdf-b5ab85ab.jsView on unpkg · L1

index.bundle.jsView file

1Manifest entrypoint (manifest.main) carries capability families absent from dist/build output: environment+network, sensitive-file+network, execution+network L1: #!/usr/bin/env node L2: "use strict";var Fc=Object.create;var to=Object.defineProperty;var Dc=Object.getOwnPropertyDescriptor;var Lc=Object.getOwnPropertyNames;var kc=Object.getPrototypeOf,Nc=Object.proto... L3: `).replace(/^/gm," ".repeat(o))}let c=[`Usage: ${r.commandUsage(e)}`,""],u=r.commandDescription(e);u.length>0&&(c=c.concat([r.wrap(u,i,0),""]));let f=r.visibleArguments(e).map(y=>a... ... L10: (Did you mean one of ${n.join(", ")}?)`:n.length===1?` L11: (Did you mean ${n[0]}?)`:""}io.suggestSimilar=Hc});var fo=g(uo=>{var Gc=require("events").EventEmitter,un=require("child_process"),ue=require("path"),fn=require("fs"),L=require("pr... L12: - specify the name in Command constructor or using .name()`);return r=r||{},r.isDefault&&(this._defaultCommandName=e._name),(r.noHelp||r.hidden)&&(e._hidden=!0),this.commands.push(... ... L21: Expecting one of '${n.join("', '")}'`);let i=`${e}Help`;return this.on(i,o=>{let s;typeof r=="function"?s=r({error:o.error,command:o.command}):s=r,s&&o.write(`${s} L22: `)}),this}};function …

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

index.bundle.jsView on unpkg · L1

12- specify the name in Command constructor or using .name()`);return r=r||{},r.isDefault&&(this._defaultCommandName=e._name),(r.noHelp||r.hidden)&&(e._hidden=!0),this.commands.push(... L13: Expecting one of '${n.join("', '")}'`);return this._lifeCycleHooks[e]?this._lifeCycleHooks[e].push(r):this._lifeCycleHooks[e]=[r],this}exitOverride(e){return e?this._exitCallback=e... L14: - if '${e._name}' is not meant to be an executable command, remove description parameter from '.command()' and use '.description()' instead ... L26: `],["r","\r"],["t"," "],["b","\b"],["f","\f"],["v","\v"],["0","\0"],["\\","\\"],["e","\x1B"],["a","\x07"]]);function Bo(t){let e=t[0]==="u",r=t[1]==="{";return e&&!r&&t.length===5|... L27: `);return o!==-1&&(e=Su(e,i,n,o)),n+e+i},wn,Go=(t,...e)=>{let[r]=e;if(!Bt(r)||!Bt(r.raw))return e.join(" ");let n=e.slice(1),i=[r.raw[0]];for(let o=1;o<r.length;o++)i.push(String(n... L28: `))this.lineCount+=Math.max(1,Math.ceil(Jd(n)/e))}get isEnabled(){return this._isEnabled&&!this.isSilent}set isEnabled(e){if(typeof e!="boolean")throw new TypeError("The `isEnabled...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

index.bundle.jsView on unpkg · L12

12- specify the name in Command constructor or using .name()`);return r=r||{},r.isDefault&&(this._defaultCommandName=e._name),(r.noHelp||r.hidden)&&(e._hidden=!0),this.commands.push(... L13: Expecting one of '${n.join("', '")}'`);return this._lifeCycleHooks[e]?this._lifeCycleHooks[e].push(r):this._lifeCycleHooks[e]=[r],this}exitOverride(e){return e?this._exitCallback=e... L14: - if '${e._name}' is not meant to be an executable command, remove description parameter from '.command()' and use '.description()' instead ... L19: `),this.outputHelp({error:!0}));let n=r||{},i=n.exitCode||1,o=n.code||"commander.error";this._exit(i,o,e)}_parseOptionsEnv(){this.options.forEach(e=>{if(e.envVar&&e.envVar in L.env... L20: `),this._exit(0,"commander.version",e)}),this}description(e,r){return e===void 0&&r===void 0?this._description:(this._description=e,r&&(this._argsDescription=r),this)}summary(e){re... L21: Expecting one of '${n.join("', '")}'`);let i=`${e}Help`;return this.on(i,o=>{let s;typeof r=="function"?s=r({error:o.error,command:o.command}):s=r,s&&o.write(`${s} ... L26: `],["r","\r"],["t"," "],["b","\b"],["f","\f"],["v","\v"],["0","\0"],["\\","\\"],["e","\x1B"],["a","\x07"]]);function

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

index.bundle.jsView on unpkg · L12

dist/ui/assets/vendor-msal-69061c3a.jsView file

1import{r as Ke,c as xs}from"./vendor-react-a844883a.js";/*! @azure/msal-common v15.17.0 2026-03-18 */const f={LIBRARY_NAME:"MSAL.JS",SKU:"msal.js.common",DEFAULT_AUTHORITY:"https:/... L2: Error: ${o.errorCode} ... L4: Error: ${r.name} L5: Error Description: ${r.message}`)}return null}return n||(this.logger.warning("The developer's authority was not found within the CloudInstanceDiscoveryMetadata returned from the ne... L6: ${r}`);return}else if(t&&e.status&&e.status>=Ae.CLIENT_ERROR_RANGE_START&&e.status<=Ae.CLIENT_ERROR_RANGE_END){this.logger.warning(`executeTokenRequest:validateTokenResponse - AAD ... L7: ${r}`);return}throw Ni(e.error,e.error_description,e.suberror)?new se(e.error,e.error_description,e.suberror,e.timestamp||f.EMPTY_STRING,e.trace_id||f.EMPTY_STRING,e.correlation_id...

Critical

Browser Credential Phishing

Source appears to collect browser login credentials for exfiltration.

dist/ui/assets/vendor-msal-69061c3a.jsView on unpkg · L1

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/ui/assets/vendor-msal-69061c3a.jsView on unpkg · L1

dist/ui/favicon.icoView file

•path = dist/ui/favicon.ico kind = high_entropy_blob sizeBytes = 7910 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/ui/favicon.icoView on unpkg

dist/ui/assets/index-f9dbc56a.jsView file

•path = dist/ui/assets/index-f9dbc56a.js kind = oversized_source_file sizeBytes = 6760261 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/ui/assets/index-f9dbc56a.jsView on unpkg

dist/customer-portal/assets/index-737fd7d3.jsView file

123patternName = generic_password severity = medium line = 123 matchedText = In order...ata.

Medium

Secret Pattern

Hardcoded password in dist/customer-portal/assets/index-737fd7d3.js

dist/customer-portal/assets/index-737fd7d3.jsView on unpkg · L123

Findings

1 Critical8 High8 Medium9 Low

CriticalBrowser Credential Phishingdist/ui/assets/vendor-msal-69061c3a.js

HighChild Processdist/ui/assets/vendor-pdf-b5ab85ab.js

HighShell

HighEntrypoint Build Divergenceindex.bundle.js

HighSame File Env Network Executionindex.bundle.js

HighCommand Output Exfiltrationindex.bundle.js

HighCloud Metadata Accessdist/ui/assets/vendor-msal-69061c3a.js

HighShips High Entropy Blobdist/ui/favicon.ico

HighOversized Source Filedist/ui/assets/index-f9dbc56a.js

MediumSecret Patterndist/ui/assets/SetupWizard-609e8434.js

MediumDynamic Requiredist/ui/assets/vendor-pdf-b5ab85ab.js

MediumNetwork

MediumEnvironment Vars

MediumProtestware

MediumStructural Risk Force Deep Review

MediumWildcard Dependency

MediumSecret Patterndist/customer-portal/assets/index-737fd7d3.js

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvaldist/ui/assets/vendor-pdf-b5ab85ab.js

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

LowNo License

dist/ui/assets/vendor-pdf-b5ab85ab.jsView file

Lines 1-13javascript

1var Bs=(h,t,e)=>{if(!t.has(h))throw TypeError("Cannot "+e)};var Z=(h,t,e)=>(Bs(h,t,"read from private field"),e?e.call(h):t.get(h)),kt=(h,t,e)=>{if(t.has(h))throw TypeError("Cannot add the same private member more than once");t instanceof WeakSet?t.add(h):t.set(h,e)},Et=(h,t,e,s)=>(Bs(h,t,"write to private field"),s?s.call(h,e):t.set(h,e),e);var xi=(h,t,e,s)=>({set _(i){Et(h,t,i,e)},get _(){return Z(h,t,s)}}),Gt=(h,t,e)=>(Bs(h,t,"access private method"),e);import{j as at}from"./vendor-mui-15c6777f.js";import{g as Ar,r as D}from"./vendor-react-a844883a.js";const wr="modulepreload",vr=function(h ...

2`);return t.join("")}}function Ue(h,t){const e=t?URL.parse(h,t):URL.parse(h);return e?.protocol==="http:"||e?.protocol==="https:"}function Lt(h){h.preventDefault()}function nt(h){h.preventDefault(),h.stopPropagation()}function Fr(h){console.log("Deprecated API usage: "+h)}class ws{static#t;static toDateObject(t){if(t instanceof Date)return t;if(!t||typeof t!="string")return null;this.#t||=new RegExp("^D:(\\d{4})(\\d{2})?(\\d{2})?(\\d{2})?(\\d{2})?(\\d{2})?([Z|+|-])?(\\d{2})?'?(\\d{2})?'?");const e=this.#t.exec(t);if(!e)return null;const s=parseInt(e[1],10);let i=parseInt(e[2],10);i=i>=1&&i<=12 ...

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/ui/assets/vendor-pdf-b5ab85ab.jsView on unpkg · L1

3`)||null;a&&this.data.comb&&(a=a.replaceAll(/\s+/g,""));const o={userValue:n,formattedValue:a,lastCommittedValue:null,commitKey:1,focused:!1};this.data.multiLine?(s=document.createElement("textarea"),s.textContent=a??n,this.data.doNotScroll&&

4`))e.push({name:"span",value:n,attributes:i});return s}#z(t){t.altKey||t.shiftKey||t.ctrlKey||t.metaKey||(t.key==="Enter"||t.key==="Escape"&&this.#f

5`)}#o(){const[t,e]=this.parentDimensions;let s;if(this.isAttachedToDOM)s=this.div.getBoundingClientRect();else{const{currentLayer:i,div:n}=this,r=n.style.display,a=n.classList.contains(

6`);if(!i)return;const n=window.getSelection();if(!n.rangeCount)return;this.editorDiv.normalize(),n.deleteFromDocument();const r=n.getRangeAt(0);if(!i.includes(`

7`)){r.insertNode(document.createTextNode(i)),this.editorDiv.normalize(),n.collapseToStart();return}const{startContainer:a,startOffset:o}=r,l=[],c=[];if(a.nodeType===Node.TEXT_NODE){const

8`)}${i}${c.join(`

9`)}`,this.#l();const d=new Range;let u=Math.sumPrecise(l.map(f=>f.length));for(const{firstChild:f}of this.editorDiv.childNodes)if(f.nodeType===Node.TEXT_NODE

10`)){const e=document.createElement("div");e.append(t?document.createTextNode(t):document.createElement("br")),this.editorDiv.append(e)}}#u(){return this.#t.replaceAll(" "," ")}static#d(t

11`),position:m,pageIndex:y-1,rect:o.slice(0),rotation:l,annotationElementId:c,id:c,deleted:!1,popupRef:d,comment:f?.str||null,richText:u,

12`)){const n=document.createElement("div");n.append(i?document.createTextNode(i):document.createElement("br")),e.append(n)}return t.updateEdited({rect:this.getPDFRect(),popup:this._uiManager.hasCommentManager()||this.hasEditedComment?this.comment:{text:this.#t}}),e}resetAnnotationElement(t){super.resetAnnotationElement(t),t.resetEdited()}}class k{static PRECISION=1e-4;toSVGPath(){K("Abstract method `toSVGPath` must be implemented.")}get box(){K("Abstract getter `box` must be implemented.")}serialize(t,e){K("Abstract method `serialize` must be implemented.")}static _rescale(t,e,s,i,n,r){r||=new ...

Long lines were clipped for display.

index.bundle.jsView file

Lines 1-32javascript

1#!/usr/bin/env node

2"use strict";var Fc=Object.create;var to=Object.defineProperty;var Dc=Object.getOwnPropertyDescriptor;var Lc=Object.getOwnPropertyNames;var kc=Object.getPrototypeOf,Nc=Object.prototype.hasOwnProperty;var g=(t,e)=>()=>(e||t((e={exports:{}}).exports,e),e.exports);var Mc=(t,e,r,n)=>{if(e&&typeof e=="object"||typeof e=="function")for(let i of Lc(e))!Nc.call(t,i)&&i!==r&&to(t,i,{get:()=>e[i],enumerable:!(n=Dc(e,i))||n.enumerable});return t};var qc=(t,e,r)=>(r=t!=null?Fc(kc(t)):{},Mc(e||!t||!t.__esModule?to(r,"default",{value:t,enumerable:!0}):r,t));var ct=g(tn=>{var Lt=class extends Error{construct ...

3`).replace(/^/gm," ".repeat(o))}let c=[`Usage: ${r.commandUsage(e)}`,""],u=r.commandDescription(e);u.length>0&&(c=c.concat([r.wrap(u,i,0),""]));let f=r.visibleArguments(e).map(y=>a(r.argumentTerm(y),r.argumentDescription(y)));f.length>0&&(c=c.concat(["Arguments:",l(f),""]));let p=r.visibleOptions(e).map(y=>a(r.optionTerm(y),r.optionDescription(y)));if(p.length>0&&(c=c.concat(["Options:",l(p),""])),this.showGlobalOptions){let y=r.visibleGlobalOptions(e).map(d=>a(r.optionTerm(d),r.optionDescription(d)));y.length>0&&(c=c.concat(["Global Options:",l(y),""]))}let h=r.visibleCommands(e).map(y=>a(r.s ...

4`)}padWidth(e,r){return Math.max(r.longestOptionTermLength(e,r),r.longestGlobalOptionTermLength(e,r),r.longestSubcommandTermLength(e,r),r.longestArgumentTermLength(e,r))}wrap(e,r,n,i=40){let o=" \\f\\t\\v\xA0\u1680\u2000-\u200A\u202F\u205F\u3000\uFEFF",s=new RegExp(`[\\n][${o}]+`);if(e.match(s))return e;let a=r-n;if(a<i)return e;let l=e.slice(0

5`,`

6`),u=" ".repeat(n),p="\\s\u200B",h=new RegExp(`

7|.{1,${a-1}}([${p}]|$)|[^${p}]+?([${p}]|$)`,"g"),y=c.match(h)||[];return l+y.map((d,b)=>d===`

8`?"":(b>0?u:"")+d.trimEnd()).join(`

9`)}};ro.Help=on});var cn=g(Nt=>{var{InvalidArgumentError:Uc}=ct(),an=class{constructor(e,r){this.flags=e,this.description=r||"",this.required=e.includes("<"),this.optional=e.includes(

10(Did you mean one of ${n.join(", ")}?)`:n.length===1?`

11(Did you mean ${n[0]}?)`:""}io.suggestSimilar=Hc});var fo=g(uo=>{var Gc=require("events").EventEmitter,un=require("child_process"),ue=require("path"),fn=require("fs"),L=require("process"),{Argument

12- specify the name in Command constructor or using .name()`);return r=r||{},r.isDefault&&(this._defaultCommandName=e._name),(r.noHelp||r.hidden)&&(e._hidden=!0),this.commands.push(e),e.parent=this,this}createArgument(e,r){return new zc(e,r)}argument(e,r,n,i){let o=this.createArgument(e,r);return typeof n=="function"?o.default(i).argParser(n):o.default(n),this.addArgument(o),this}arguments(e){return e.trim().split(/ +/).forEach(r=>{this.argument(r)}),this}addArgument(e){let r=this.registeredArguments.slice(-1)[0];if(r&&r.variadic)throw new Error(`only the last argument can be variadic '${r.name ...

13Expecting one of '${n.join("', '")}'`);return this._lifeCycleHooks[e]?this._lifeCycleHooks[e].push(r):this._lifeCycleHooks[e]=[r],this}exitOverride(e){return e?this._exitCallback=e:this._exitCallback=r=>{if(r.code!=="commander.executeSubCommandAsync")throw r},this}_exit(e,r,n){this._exitCallback&&this._exitCallback(new dn(e,r,n)),L.exit(e)}action(e){let r=n=>{let i=this.registeredArguments.length,o=n.slice(0,i);return this._storeOptionsAsProperties?o[i]=this:o[i]=this.opts(),o.push(this),e.apply(this,o)};return this._actionHandler=r,this}createOption(e,r){return new so(e,r)}_callParseArg(e,r,n ...

14 - if '${e._name}' is not meant to be an executable command, remove description parameter from '.command()' and use '.description()' instead

15 - if the default executable name is not suitable, use the executableFile option to supply a custom name or path

16 - ${f}`;throw new Error(p)}else if(u.code==="EACCES")throw new Error(`'${s}' not executable`);if(!c)L.exit(1);else{let f=new dn(1,"commander.executeSubCommandAsync","(error)");f.nestedError=u,c(f)}}),this.runningCommand=l}_dispatchSubcommand(e,r,n){let i=this.

17`,this._outputConfiguration.writeErr),typeof this._showHelpAfterError=="string"?this._outputConfiguration.writeErr(`${this._showHelpAfterError}

18`):this._showHelpAfterError&&(this._outputConfiguration.writeErr(`

19`),this.outputHelp({error:!0}));let n=r||{},i=n.exitCode||1,o=n.code||"commander.error";this._exit(i,o,e)}_parseOptionsEnv(){this.options.forEach(e=>{if(e.envVar&&e.envVar in L.env){let r=e.attributeName();(this.getOptionValue(r)===void 0||["default","config","env"].includes(this.getOptionValueSource(r)))&&(e.required||e.optional?this.emit(`optionEnv:${e.name()}`,L.env[e.envVar]):this.emit(`optionEnv:${e.name()}`))}})}_parseOptionsImplied(){let e=new Xc(this.options),r=n=>this.getOptionValue(n)!==void 0&&!["default","implied"].includes(this.getOptionValueSource(n));this.options.filter(n=>n.imp ...

20`),this._exit(0,"commander.version",e)}),this}description(e,r){return e===void 0&&r===void 0?this._description:(this._description=e,r&&(this._argsDescription=r),this)}summary(e){return e===void 0?this._summary:(this._summary=

21Expecting one of '${n.join("', '")}'`);let i=`${e}Help`;return this.on(i,o=>{let s;typeof r=="function"?s=r({error:o.error,command:o.command}):s=r,s&&o.write(`${s}

22`)}),this}};function lo(t,e){t._hasHelpOption&&e.find(n=>n===t._helpLongFlag||n===t._helpShortFlag)&&(t.outputHelp(),t._exit(0,"commander.helpDisplayed","(outputHelp)"))}function co(t){return t.map(e=>{if(!e.startsWith("--inspect"))return e;let r,n="127.0.0.1",i="9229",o;return(o=e.match(/^(--inspect(-brk)?)$/))!==null?r=o[1]:(o=e.match(/^(--inspect(-brk|-port)?)=([^:]+)$/))!==null?(r=o[1],/^\d+$/.test(o[3])?i=o[3]:n=o[3]):(o=e.match(/^(--inspect(-brk|-port)?)=([^:]+):(\d+)$/))!==null&&(r=o[1],n=o[3],i=o[4]),r&&i!=="0"?`${r}=${n}:${parseInt(i)+1}`:e})}uo.Command=hn});var mo=g((ee,go)=>{var{Arg ...

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

index.bundle.jsView on unpkg · L1

23`:`

24`)+r,i=n+1,n=t.indexOf(`

25`,i)}while(n!==-1);return o+=t.substr(i),o};ko.exports={stringReplaceAll:gu,stringEncaseCRLFWithFirstIndex:mu}});var $o=g((sg,jo)=>{"use strict";var yu=/(?:\\(u(?:[a-f\d]{4}|\{[a-f\d]{1,6}\})|x[a-f\d]{2}|.))|(?:\{

26`],["r","\r"],["t"," "],["b","\b"],["f","\f"],["v","\v"],["0","\0"],["\\","\\"],["e","\x1B"],["a",

27`);return o!==-1&&(e=Su(e,i,n,o)),n+e+i},wn,Go=(t,...e)=>{let[r]=e;if(!Bt(r)||!Bt(r.raw))return e.join(" ");let n=e.slice(1),i=[r.raw[0]];for(let o=1;o<r.length;o++)i.push(String(n[o-1]).replace(/[{}\\]/g,"\\$&"),String(r.raw[o]));return wn===void 0&&(wn=$o()),wn(t,i.join(""))};Object.defineProperties(jt.prototype,Ue);var Ut=jt();Ut.supportsColor=vn;Ut.stderr=jt({level:En?En.level:0});Ut.stderr.supportsColor=En;zo.exports=Ut});var Yo=g((lg,An)=>{"use strict";var Ko=(t,e)=>{for(let r of Reflect.ownKeys(e))Object.defineProperty(t,r,Object.getOwnPropertyDescriptor(e,r));return t};An.exports=Ko;An ...

28`))this.lineCount+=Math.max(1,Math.ceil(Jd(n)/e))}get isEnabled(){return this._isEnabled&&!this.isSilent}set isEnabled(e){if(typeof e!="boolean")throw new TypeError("The `isEnabled` option must be a boolean");this._isEnabled=e}get isSilent(){return this._isSilent}set isSilent(e){if(typeof e!="boolean")throw new TypeError(

29`),this)}stop(){return this.isEnabled?(clearInterval(this.id),this.id=void 0,this.frameIndex=0,this.clear(),this.hideCursor&&qa.show(this.stream),this.discardStdin&&process.stdin.isTTY&&this.isDiscardingStdin&&(mr.stop(),this.isDiscardingStdin=!1),this):this}succeed(e){return this.stopAndPersist({symbol:gr.success,text:e})}fail(e){return this.stopAndPersist({symbol:gr.error,text:e})}warn(e){return this.stopAndPersist({symbol:gr.warning,text:e})}info(e){return this.stopAndPersist({symbol:gr.info,text:e})}stopAndPersist(e={}){if(this.isSilent)return this;let r=e.prefixText||this.prefixText,n=e.t ...

30`),this}},th=function(t){return new yr(t)};fi.exports=th;fi.exports.promise=(t,e)=>{if(typeof t.then!="function")throw new TypeError("Parameter `action` must be a Promise");let r=new yr(e);return r.start(),(async

31MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA50dyGcO0PnH7gsE5U7jd

32gfYyPF0iC1bPtQF4Kitagv0dWNrsD+APPBzCOCTE/2gZ3e3es7YthRt/rvd5/40R

Long lines were clipped for display.