registry / @zenith-open/zenithcms-cli / 1.0.0-beta.8

@zenith-open/zenithcms-cli@1.0.0-beta.8

Static Scan Results

scanned 5h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 1 file(s), 35.6 KB of source, external domains: zenithcms.com

Source & flagged code

3 flagged

dist/index.jsView file

Lines 1-53javascript

1#!/usr/bin/env node

2import { Command } from 'commander';

3import chalk from 'chalk';

4import path from 'path';

5import { execSync } from 'child_process';

6import fs from 'fs';

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L4

7import readline from 'readline';

8const question = (query) => {

9 const rl = readline.createInterface({

10 input: process.stdin,

11 output: process.stdout,

12 });

13 return new Promise((resolve) => rl.question(query, (answer) => {

14 rl.close();

15 resolve(answer);

16 }));

17};

18const program = new Command();

19/**

20 * Zenith CMS CLI

21 * ─────────────

22 * The official command-line tool for managing Zenith CMS.

23 */

24program.name('zenithcms').description('Official Zenith CMS CLI').version('0.1.0');

25program

26 .command('start')

27 .description('Start the Zenith CMS server')

28 .option('-p, --port <number>', 'Port to run on', '4001')

29 .action((options) => {

30 console.log(chalk.bold.hex('#00F5FF')(' Zenith CMS starting on port ' + options.port));

31 // In a real environment, this would run the server.ts from the installed package

32 // For this monorepo, we'll simulate the startup

33 try {

34 execSync('npx tsx server.ts', { stdio: 'inherit' });

35 }

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L33

36 catch (err) {

37 process.exit(1);

38 }

39});

40program

41 .command('generate-types')

42 .description('Generate TypeScript types from zenith.config.ts')

43 .option('-o, --output <path>', 'Output file path', 'zenith-types.d.ts')

44 .action(async (options) => {

45 console.log(chalk.bold.hex('#00F5FF')(' Analyzing schema and generating types...'));

46 try {

47 let configPath = path.join(process.cwd(), 'zenith.config.ts');

48 if (!fs.existsSync(configPath)) {

49 configPath = path.join(process.cwd(), 'cms.config.ts');

50 }

51 if (!fs.existsSync(configPath)) {

52 console.error(chalk.red('Error: Neither zenith.config.ts nor cms.config.ts was found in current directory'));

53 return;

Lines 871-911javascript

871 if (!fs.existsSync(blocksDir)) {

872 console.log('No config/blocks directory found. Nothing to sync.')

873 return

874 }

875

876 const files = fs.readdirSync(blocksDir).filter(f => f.endsWith('.json'))

Source & flagged code

3 flagged · loading source

dist/index.jsView file

4import path from 'path'; L5: import { execSync } from 'child_process'; L6: import fs from 'fs';

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L4

33try { L34: execSync('npx tsx server.ts', { stdio: 'inherit' }); L35: }

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L33

891// Dynamically import the TS file using file URL L892: const blockModule = await import(pathToFileURL(filePath).href) L893:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L891

Findings

3 High3 Medium5 Low

HighChild Processdist/index.js

HighShell

HighRuntime Package Installdist/index.js

MediumDynamic Requiredist/index.js

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

3 flagged

dist/index.jsView file

Lines 1-53javascript

1#!/usr/bin/env node

2import { Command } from 'commander';

3import chalk from 'chalk';

4import path from 'path';

5import { execSync } from 'child_process';

6import fs from 'fs';

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L4

7import readline from 'readline';

8const question = (query) => {

9 const rl = readline.createInterface({

10 input: process.stdin,

11 output: process.stdout,

12 });

13 return new Promise((resolve) => rl.question(query, (answer) => {

14 rl.close();

15 resolve(answer);

16 }));

17};

18const program = new Command();

19/**

20 * Zenith CMS CLI

21 * ─────────────

22 * The official command-line tool for managing Zenith CMS.

23 */

24program.name('zenithcms').description('Official Zenith CMS CLI').version('0.1.0');

25program

26 .command('start')

27 .description('Start the Zenith CMS server')

28 .option('-p, --port <number>', 'Port to run on', '4001')

29 .action((options) => {

30 console.log(chalk.bold.hex('#00F5FF')(' Zenith CMS starting on port ' + options.port));

31 // In a real environment, this would run the server.ts from the installed package

32 // For this monorepo, we'll simulate the startup

33 try {

34 execSync('npx tsx server.ts', { stdio: 'inherit' });

35 }

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L33

36 catch (err) {

37 process.exit(1);

38 }

39});

40program

41 .command('generate-types')

42 .description('Generate TypeScript types from zenith.config.ts')

43 .option('-o, --output <path>', 'Output file path', 'zenith-types.d.ts')

44 .action(async (options) => {

45 console.log(chalk.bold.hex('#00F5FF')(' Analyzing schema and generating types...'));

46 try {

47 let configPath = path.join(process.cwd(), 'zenith.config.ts');

48 if (!fs.existsSync(configPath)) {

49 configPath = path.join(process.cwd(), 'cms.config.ts');

50 }

51 if (!fs.existsSync(configPath)) {

52 console.error(chalk.red('Error: Neither zenith.config.ts nor cms.config.ts was found in current directory'));

53 return;

Lines 871-911javascript

871 if (!fs.existsSync(blocksDir)) {

872 console.log('No config/blocks directory found. Nothing to sync.')

873 return

874 }

875

876 const files = fs.readdirSync(blocksDir).filter(f => f.endsWith('.json'))