registry / @xrmforge/devkit / 0.7.40

@xrmforge/devkit@0.7.40

⚠ Under review

Build orchestration and project tooling for Dynamics 365 WebResources

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 9 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEvalFilesystemShell

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 9 file(s), 50.3 KB of source

Source & flagged code

4 flagged

dist/templates/validate-form.mjsView file

Lines 1-62javascript

1/**

2 * validate-form.mjs - Quality Gate for XrmForge Form Scripts

3 *

4 * Runs three checks in one command:

5 * 1. TypeScript Compiler (tsc --noEmit)

6 * 2. ESLint (src/ --max-warnings=0)

7 * 3. Pattern Compliance (critical rule violations via text search)

8 *

9 * Exit code: 0 = all green, 1 = errors found

10 *

11 * Usage:

12 * node scripts/validate-form.mjs

13 * npm run validate

14 */

16import { execSync } from 'node:child_process';

17import { readdirSync, readFileSync } from 'node:fs';

High

Child Process

Package source references child process execution.

dist/templates/validate-form.mjsView on unpkg · L15

18import { join, relative } from 'node:path';

20const RED = '\x1b[31m';

21const GREEN = '\x1b[32m';

22const YELLOW = '\x1b[33m';

23const NC = '\x1b[0m';

25// Error-handling wrappers an exported entry point may use (Check 3l). Single

26// source of truth - keep in sync with src/shared/error-handler.ts. wrapGridCommand

27// (subgrid ribbon commands, F-MK9-02), wrapWebResource (HTML WebResource init,

28// Runde 10 F-LMA10-02) and wrapEnableRule (ribbon Enable Rules, sync boolean) are

29// NOT substrings of wrapCommand, so they must be listed explicitly or the gate

30// false-flags correct code (FW-3 / F-LMA10-02).

31const HANDLER_WRAPPERS = ['wrapHandler', 'wrapCommand', 'wrapGridCommand', 'wrapWebResource', 'wrapEnableRule'];

33let totalErrors = 0;

35// ============================================================

36// 1. TypeScript Compiler

37// ============================================================

39console.log('=== XrmForge Quality Gate ===\n');

40console.log('--- TypeScript ---');

42try {

43 execSync('npx tsc --noEmit', { stdio: 'pipe', encoding: 'utf-8' });

44 console.log(`${GREEN}OK${NC} tsc --noEmit`);

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/templates/validate-form.mjsView on unpkg · L42

45} catch (err) {

46 const output = (err.stdout || '') + (err.stderr || '');

47 const errorCount = (output.match(/error TS/g) || []).length;

48 console.log(`${RED}FAIL${NC} tsc --noEmit (${errorCount} errors)`);

49 console.log(output.split('\n').slice(0, 20).join('\n'));

50 totalErrors += errorCount || 1;

51}

53// ============================================================

54// 2. ESLint

55// ============================================================

57console.log('\n--- ESLint ---');

59try {

60 execSync('npx eslint src/ --max-warnings=0', { stdio: 'pipe', encoding: 'utf-8' });

61 console.log(`${GREEN}OK${NC} eslint src/ --max-warnings=0`);

62} catch (err) {

Lines 207-247javascript

207 'Magic number 86400000 (use named constant MS_PER_DAY)',

208 allSrcFiles,

209 /86400000/,

210);

211

212// 3h. Raw notification level strings (must use FormNotificationLevel)

213checkPattern(

214 'Raw notification level strings (use FormNotificationLevel from @xrmforge/helpers)',

215 allSrcFiles,

216 /setFormNotification\s*\([^)]*

•matchType = previous_version_dangerous_delta matchedPackage = @xrmforge/devkit@0.7.37 matchedIdentity = npm:QHhybWZvcmdlL2RldmtpdA:0.7.37 similarity = 0.667 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/templates/validate-form.mjsView on unpkg

Source & flagged code

4 flagged · loading source

dist/templates/validate-form.mjsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/templates/validate-form.mjsView on unpkg

15L16: import { execSync } from 'node:child_process'; L17: import { readdirSync, readFileSync } from 'node:fs';

High

Child Process

Package source references child process execution.

dist/templates/validate-form.mjsView on unpkg · L15

42try { L43: execSync('npx tsc --noEmit', { stdio: 'pipe', encoding: 'utf-8' }); L44: console.log(`${GREEN}OK${NC} tsc --noEmit`);

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/templates/validate-form.mjsView on unpkg · L42

227L228: // 3j. eval() usage L229: checkPattern(

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/templates/validate-form.mjsView on unpkg · L227

Findings

1 Critical3 High1 Medium4 Low

CriticalPrevious Version Dangerous Deltadist/templates/validate-form.mjs

HighChild Processdist/templates/validate-form.mjs

HighShell

HighRuntime Package Installdist/templates/validate-form.mjs

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvaldist/templates/validate-form.mjs

LowFilesystem

LowHigh Entropy Strings

Source & flagged code

4 flagged

dist/templates/validate-form.mjsView file

Lines 1-62javascript

1/**

2 * validate-form.mjs - Quality Gate for XrmForge Form Scripts

3 *

4 * Runs three checks in one command:

5 * 1. TypeScript Compiler (tsc --noEmit)

6 * 2. ESLint (src/ --max-warnings=0)

7 * 3. Pattern Compliance (critical rule violations via text search)

8 *

9 * Exit code: 0 = all green, 1 = errors found

10 *

11 * Usage:

12 * node scripts/validate-form.mjs

13 * npm run validate

14 */

16import { execSync } from 'node:child_process';

17import { readdirSync, readFileSync } from 'node:fs';

High

Child Process

Package source references child process execution.

dist/templates/validate-form.mjsView on unpkg · L15

18import { join, relative } from 'node:path';

20const RED = '\x1b[31m';

21const GREEN = '\x1b[32m';

22const YELLOW = '\x1b[33m';

23const NC = '\x1b[0m';

25// Error-handling wrappers an exported entry point may use (Check 3l). Single

26// source of truth - keep in sync with src/shared/error-handler.ts. wrapGridCommand

27// (subgrid ribbon commands, F-MK9-02), wrapWebResource (HTML WebResource init,

28// Runde 10 F-LMA10-02) and wrapEnableRule (ribbon Enable Rules, sync boolean) are

29// NOT substrings of wrapCommand, so they must be listed explicitly or the gate

30// false-flags correct code (FW-3 / F-LMA10-02).

31const HANDLER_WRAPPERS = ['wrapHandler', 'wrapCommand', 'wrapGridCommand', 'wrapWebResource', 'wrapEnableRule'];

33let totalErrors = 0;

35// ============================================================

36// 1. TypeScript Compiler

37// ============================================================

39console.log('=== XrmForge Quality Gate ===\n');

40console.log('--- TypeScript ---');

42try {

43 execSync('npx tsc --noEmit', { stdio: 'pipe', encoding: 'utf-8' });

44 console.log(`${GREEN}OK${NC} tsc --noEmit`);

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/templates/validate-form.mjsView on unpkg · L42

45} catch (err) {

46 const output = (err.stdout || '') + (err.stderr || '');

47 const errorCount = (output.match(/error TS/g) || []).length;

48 console.log(`${RED}FAIL${NC} tsc --noEmit (${errorCount} errors)`);

49 console.log(output.split('\n').slice(0, 20).join('\n'));

50 totalErrors += errorCount || 1;

51}

53// ============================================================

54// 2. ESLint

55// ============================================================

57console.log('\n--- ESLint ---');

59try {

60 execSync('npx eslint src/ --max-warnings=0', { stdio: 'pipe', encoding: 'utf-8' });

61 console.log(`${GREEN}OK${NC} eslint src/ --max-warnings=0`);

62} catch (err) {

Lines 207-247javascript

207 'Magic number 86400000 (use named constant MS_PER_DAY)',

208 allSrcFiles,

209 /86400000/,

210);

211

212// 3h. Raw notification level strings (must use FormNotificationLevel)

213checkPattern(

214 'Raw notification level strings (use FormNotificationLevel from @xrmforge/helpers)',

215 allSrcFiles,

216 /setFormNotification\s*\([^)]*

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/templates/validate-form.mjsView on unpkg