registry / @yearhe9900/mb-toolbox-cli / 1.1.3

@yearhe9900/mb-toolbox-cli@1.1.3

MB ToolBox CLI - 项目创建与模板管理工具

Static Scan Results

scanned 5d ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 9 file(s), 24.5 KB of source, external domains: dot.net, dotnet.microsoft.com

Source & flagged code

5 flagged

src/utils/dotnet.jsView file

Lines 1-21javascript

1const { execSync } = require('child_process');

2const path = require('path');

High

Child Process

Package source references child process execution.

src/utils/dotnet.jsView on unpkg · L1

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

src/utils/dotnet.jsView on unpkg · L1

3const fs = require('fs');

4const chalk = require('chalk');

5const { getNugetSourceUrl } = require('./config');

7const PACKAGE_ID = 'MB.ToolBox.FurionTemp';

8const SHORT_NAME = 'mb-furion';

10/**

11 * 获取 NuGet 源地址（从配置读取）

12 */

13function getSourceUrl() {

14 const url = getNugetSourceUrl();

15 if (!url) {

16 console.error(chalk.red('错误: NuGet 源地址未配置'));

17 console.error(chalk.gray(' 请先运行: mb-cli config --nuget-source <url>'));

18 process.exit(1);

19 }

20 return url;

21}

Lines 44-84javascript

44 console.log(chalk.green(`✓ .NET SDK 版本: ${version}`));

45 return true;

46}

48/**

49 * 检查是否安装了 .NET 10 SDK

50 */

51function isDotnet10Installed() {

52 const output = exec('dotnet --list-sdks');

53 if (!output) return false;

54 return output.split('\n').some(line => line.trim().startsWith('10.'));

55}

57/**

58 * 自动安装 .NET 10 SDK

59 */

60function installDotnet10() {

61 const isWin = process.platform === 'win32';

63 try {

64 if (isWin) {

65 // Windows: 使用 PowerShell 脚本安装

66 console.log(chalk.blue('正在通过 PowerShell 脚本安装 .NET 10 SDK...'));

High

Shell

Package source references shell execution.

src/utils/dotnet.jsView on unpkg · L64

67 execSync(

68 'powershell -NoProfile -ExecutionPolicy Bypass -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; & ([scriptblock]::Create((Invoke-WebRequest -UseBasicParsing \'https://dot.net/v1/dotnet-install.ps1\'))) -Channel 10.0 -InstallDir \'$env:LOCALAPPDATA\\dotnet\'"',

69 { encoding: 'utf8', stdio: 'inherit' }

70 );

71 } else {

72 // Linux/macOS: 使用 shell 脚本安装

73 console.log(chalk.blue('正在通过脚本安装 .NET 10 SDK...'));

74 execSync(

75 'curl -sSL https://dot.net/v1/dotnet-install.sh | bash /dev/stdin --channel 10.0',

76 { encoding: 'utf8', stdio: 'inherit' }

77 );

78 }

79 return true;

80 } catch (err) {

81 return false;

82 }

83}

src/utils/config.jsView file

Lines 1-21javascript

1const fs = require('fs');

2const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/utils/config.jsView on unpkg · L1

3const os = require('os');

5const CONFIG_DIR = path.join(os.homedir(), '.mb-cli');

6const CONFIG_FILE = path.join(CONFIG_DIR, 'config.json');

8/**

9 * 确保配置目录存在

10 */

11function ensureConfigDir() {

12 if (!fs.existsSync(CONFIG_DIR)) {

13 fs.mkdirSync(CONFIG_DIR, { recursive: true });

14 }

15}

17/**

18 * 读取配置

19 */

20function loadConfig() {

21 ensureConfigDir();

src/commands/update.jsView file

Lines 1-31javascript

1const chalk = require('chalk');

2const ora = require('ora');

3const gradient = require('gradient-string');

4const { exec } = require('../utils/dotnet');

5const { showBanner, showCommandTitle, showSuccess, showError } = require('../utils/banner');

7async function update() {

8 showBanner();

9 showCommandTitle('更新 CLI 工具', '🔄');

11 // 获取当前版本

12 const currentVersion = exec('mb-cli --version');

13 console.log(chalk.gray(`当前版本: ${currentVersion || '未知'}`));

14 console.log('');

16 // 执行更新 - 使用 @latest 强制安装最新版本

17 console.log(gradient.cristal('▸ 正在从 npmjs 更新...'));

18 const spinner = ora({ text: '正在更新 mb-toolbox-cli...', spinner: 'dots2' }).start();

20 try {

21 // 使用 npm install -g @latest 强制更新到最新版本

22 exec('npm install -g @yearhe9900/mb-toolbox-cli@latest', { stdio: 'inherit' });

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/commands/update.jsView on unpkg · L11

23 spinner.succeed('更新完成');

25 // 获取新版本

26 const newVersion = exec('mb-cli --version');

27 if (newVersion && newVersion !== currentVersion) {

28 showSuccess(`已更新: ${currentVersion} → ${newVersion}`);

29 } else {

30 showSuccess('已是最新版本');

31 }

Source & flagged code

5 flagged · loading source

src/utils/dotnet.jsView file

1const { execSync } = require('child_process'); L2: const path = require('path');

High

Child Process

Package source references child process execution.

src/utils/dotnet.jsView on unpkg · L1

64if (isWin) { L65: // Windows: 使用 PowerShell 脚本安装 L66: console.log(chalk.blue('正在通过 PowerShell 脚本安装 .NET 10 SDK...'));

High

Shell

Package source references shell execution.

src/utils/dotnet.jsView on unpkg · L64

1const { execSync } = require('child_process'); L2: const path = require('path'); ... L40: console.error(chalk.red('错误: 未找到 dotnet 命令，请先安装 .NET SDK')); L41: console.error(chalk.gray(' 下载地址: https://dotnet.microsoft.com/download')); L42: return false; ... L60: function installDotnet10() { L61: const isWin = process.platform === 'win32'; L62: ... L126: try { L127: const parsed = JSON.parse(searchResult); L128: const version = parsed.searchResult?.[0]?.packages?.[0]?.latestVersion;

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

src/utils/dotnet.jsView on unpkg · L1

src/utils/config.jsView file

1const fs = require('fs'); L2: const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/utils/config.jsView on unpkg · L1

src/commands/update.jsView file

11// 获取当前版本 L12: const currentVersion = exec('mb-cli --version'); L13: console.log(chalk.gray(`当前版本: ${currentVersion || '未知'}`)); ... L20: try { L21: // 使用 npm install -g @latest 强制更新到最新版本 L22: exec('npm install -g @yearhe9900/mb-toolbox-cli@latest', { stdio: 'inherit' });

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/commands/update.jsView on unpkg · L11

Findings

4 High2 Medium4 Low

HighChild Processsrc/utils/dotnet.js

HighShellsrc/utils/dotnet.js

HighSandbox Evasion Gated Capabilitysrc/utils/dotnet.js

HighRuntime Package Installsrc/commands/update.js

MediumDynamic Requiresrc/utils/config.js

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

5 flagged

src/utils/dotnet.jsView file

Lines 1-21javascript

1const { execSync } = require('child_process');

2const path = require('path');

High

Child Process

Package source references child process execution.

src/utils/dotnet.jsView on unpkg · L1

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

src/utils/dotnet.jsView on unpkg · L1

3const fs = require('fs');

4const chalk = require('chalk');

5const { getNugetSourceUrl } = require('./config');

7const PACKAGE_ID = 'MB.ToolBox.FurionTemp';

8const SHORT_NAME = 'mb-furion';

10/**

11 * 获取 NuGet 源地址（从配置读取）

12 */

13function getSourceUrl() {

14 const url = getNugetSourceUrl();

15 if (!url) {

16 console.error(chalk.red('错误: NuGet 源地址未配置'));

17 console.error(chalk.gray(' 请先运行: mb-cli config --nuget-source <url>'));

18 process.exit(1);

19 }

20 return url;

21}

Lines 44-84javascript

44 console.log(chalk.green(`✓ .NET SDK 版本: ${version}`));

45 return true;

46}

48/**

49 * 检查是否安装了 .NET 10 SDK

50 */

51function isDotnet10Installed() {

52 const output = exec('dotnet --list-sdks');

53 if (!output) return false;

54 return output.split('\n').some(line => line.trim().startsWith('10.'));

55}

57/**

58 * 自动安装 .NET 10 SDK

59 */

60function installDotnet10() {

61 const isWin = process.platform === 'win32';

63 try {

64 if (isWin) {

65 // Windows: 使用 PowerShell 脚本安装

66 console.log(chalk.blue('正在通过 PowerShell 脚本安装 .NET 10 SDK...'));

High

Shell

Package source references shell execution.

src/utils/dotnet.jsView on unpkg · L64

67 execSync(

69 { encoding: 'utf8', stdio: 'inherit' }

70 );

71 } else {

72 // Linux/macOS: 使用 shell 脚本安装

73 console.log(chalk.blue('正在通过脚本安装 .NET 10 SDK...'));

74 execSync(

75 'curl -sSL https://dot.net/v1/dotnet-install.sh | bash /dev/stdin --channel 10.0',

76 { encoding: 'utf8', stdio: 'inherit' }

77 );

78 }

79 return true;

80 } catch (err) {

81 return false;

82 }

83}

src/utils/config.jsView file

Lines 1-21javascript

1const fs = require('fs');

2const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/utils/config.jsView on unpkg · L1

3const os = require('os');

5const CONFIG_DIR = path.join(os.homedir(), '.mb-cli');

6const CONFIG_FILE = path.join(CONFIG_DIR, 'config.json');

8/**

9 * 确保配置目录存在

10 */

11function ensureConfigDir() {

12 if (!fs.existsSync(CONFIG_DIR)) {

13 fs.mkdirSync(CONFIG_DIR, { recursive: true });

14 }

15}

17/**

18 * 读取配置

19 */

20function loadConfig() {

21 ensureConfigDir();

src/commands/update.jsView file

Lines 1-31javascript

1const chalk = require('chalk');

2const ora = require('ora');

3const gradient = require('gradient-string');

4const { exec } = require('../utils/dotnet');

5const { showBanner, showCommandTitle, showSuccess, showError } = require('../utils/banner');

7async function update() {

8 showBanner();

9 showCommandTitle('更新 CLI 工具', '🔄');

11 // 获取当前版本

12 const currentVersion = exec('mb-cli --version');

13 console.log(chalk.gray(`当前版本: ${currentVersion || '未知'}`));

14 console.log('');

16 // 执行更新 - 使用 @latest 强制安装最新版本

17 console.log(gradient.cristal('▸ 正在从 npmjs 更新...'));

18 const spinner = ora({ text: '正在更新 mb-toolbox-cli...', spinner: 'dots2' }).start();

20 try {

21 // 使用 npm install -g @latest 强制更新到最新版本

22 exec('npm install -g @yearhe9900/mb-toolbox-cli@latest', { stdio: 'inherit' });

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/commands/update.jsView on unpkg · L11

23 spinner.succeed('更新完成');

25 // 获取新版本

26 const newVersion = exec('mb-cli --version');

27 if (newVersion && newVersion !== currentVersion) {

28 showSuccess(`已更新: ${currentVersion} → ${newVersion}`);

29 } else {

30 showSuccess('已是最新版本');

31 }