registry / arkos / 1.6.6-beta

arkos@1.6.6-beta

The Express & Prisma RESTful Framework

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 257 file(s), 1.23 MB of source, external domains: arkosjs.com, www.arkosjs.com, www.w3.org

Source & flagged code

6 flagged

dist/esm/utils/cli/export-auth-action.jsView file

Lines 1-56javascript

1import { spawn } from "child_process";

2import { loadEnvironmentVariables } from "../dotenv.helpers.js";

High

Child Process

Package source references child process execution.

dist/esm/utils/cli/export-auth-action.jsView on unpkg · L1

3import path from "path";

4import fs from "fs";

5import watermarkStamper from "./utils/watermark-stamper.js";

6import { getArkosConfig } from "../helpers/arkos-config.helpers.js";

7export default async function exportAuthActionCommand(options) {

8 process.env.NO_CLI = "true";

9 process.env.CLI_COMMAND = "EXPORT_AUTH_ACTION";

10 process.env.CLI_COMMAND_OPTIONS = JSON.stringify(options);

11 if (!process.env.NODE_ENV)

12 process.env.NODE_ENV = "development";

13 const envFiles = loadEnvironmentVariables() || [];

14 let child = null;

15 try {

16 const config = getArkosConfig();

17 const entryPoint = path.resolve(process.cwd(), config.source?.entryPoint);

18 if (!fs.existsSync(entryPoint)) {

19 console.error(`Could not find application entry point at ${entryPoint}`);

20 process.exit(1);

21 }

22 const entryPointRelative = path.relative(process.cwd(), entryPoint);

23 const getEnv = () => ({

24 NODE_ENV: "development",

25 ...process.env,

26 CLI: "false",

27 });

28 const startServer = () => {

29 if (child) {

30 child.kill();

31 child = null;

32 }

33 const env = getEnv();

34 child = spawn("npx", ["tsx-strict", "--no-type-check", entryPointRelative], {

35 stdio: "inherit",

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/esm/utils/cli/export-auth-action.jsView on unpkg · L33

36 env,

37 shell: true,

38 });

High

Shell

Package source references shell execution.

dist/esm/utils/cli/export-auth-action.jsView on unpkg · L36

39 if (child)

40 child.on("error", (error) => {

41 console.error("Failed to start server:", error);

42 });

43 };

44 startServer();

45 watermarkStamper.stamp({

46 envFiles,

47 });

48 const cleanup = () => {

49 if (child) {

50 child.kill("SIGTERM");

51 setTimeout(() => {

52 if (child && !child.killed)

53 child.kill("SIGKILL");

54 }, 5000);

55 }

56 process.exit(0);

dist/esm/utils/helpers/global.helpers.jsView file

Lines 1-58javascript

1import fs from "fs";

2import path from "path";

3import { createRequire } from "module";

4import { pathToFileURL } from "url";

5export function getPackageJson() {

dist/esm/utils/cli/start.jsView file

Lines 1-22javascript

1import path from "path";

2import fs from "fs";

3import { spawn } from "child_process";

4import { loadEnvironmentVariables } from "../dotenv.helpers.js";

5import { fullCleanCwd } from "../helpers/fs.helpers.js";

Source & flagged code

6 flagged · loading source

dist/esm/utils/cli/export-auth-action.jsView file

1import { spawn } from "child_process"; L2: import { loadEnvironmentVariables } from "../dotenv.helpers.js";

High

Child Process

Package source references child process execution.

dist/esm/utils/cli/export-auth-action.jsView on unpkg · L1

36env, L37: shell: true, L38: });

High

Shell

Package source references shell execution.

dist/esm/utils/cli/export-auth-action.jsView on unpkg · L36

33const env = getEnv(); L34: child = spawn("npx", ["tsx-strict", "--no-type-check", entryPointRelative], { L35: stdio: "inherit",

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/esm/utils/cli/export-auth-action.jsView on unpkg · L33

dist/esm/utils/helpers/global.helpers.jsView file

38export async function [redacted](path) { L39: const importFn = new Function("path", "return import(path)"); L40: return await importFn(path);

High

Eval

Package source references dynamic code evaluation.

dist/esm/utils/helpers/global.helpers.jsView on unpkg · L38

19} L20: export const userRequire = createRequire(pathToFileURL(process.cwd() + "/package.json")); L21: export async function importModule(modulePath, options = { fixExtension: true }) {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/esm/utils/helpers/global.helpers.jsView on unpkg · L19

dist/esm/utils/cli/start.jsView file

2Cross-file remote execution chain: dist/esm/utils/cli/start.js spawns dist/cjs/utils/helpers/arkos-config.helpers.js; helper contains network access plus dynamic code execution. L2: import fs from "fs"; L3: import { spawn } from "child_process"; L4: import { loadEnvironmentVariables } from "../dotenv.helpers.js"; ... L11: export async function startCommand(options = {}) { L12: process.env.NO_CLI = "true"; L13: if (!process.env.NODE_ENV) ... L19: const config = getArkosConfig(); L20: const entryPoint = path.join(process.cwd(), ".build", config.source?.entryPoint.replace(".ts", ".js")); L21: if (!fs.existsSync(path.join(entryPoint))) {

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/esm/utils/cli/start.jsView on unpkg · L2

Findings

5 High4 Medium5 Low

HighChild Processdist/esm/utils/cli/export-auth-action.js

HighShelldist/esm/utils/cli/export-auth-action.js

HighEvaldist/esm/utils/helpers/global.helpers.js

HighCross File Remote Execution Contextdist/esm/utils/cli/start.js

HighRuntime Package Installdist/esm/utils/cli/export-auth-action.js

MediumDynamic Requiredist/esm/utils/helpers/global.helpers.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

6 flagged

dist/esm/utils/cli/export-auth-action.jsView file

Lines 1-56javascript

1import { spawn } from "child_process";

2import { loadEnvironmentVariables } from "../dotenv.helpers.js";

High

Child Process

Package source references child process execution.

dist/esm/utils/cli/export-auth-action.jsView on unpkg · L1

3import path from "path";

4import fs from "fs";

5import watermarkStamper from "./utils/watermark-stamper.js";

6import { getArkosConfig } from "../helpers/arkos-config.helpers.js";

7export default async function exportAuthActionCommand(options) {

8 process.env.NO_CLI = "true";

9 process.env.CLI_COMMAND = "EXPORT_AUTH_ACTION";

10 process.env.CLI_COMMAND_OPTIONS = JSON.stringify(options);

11 if (!process.env.NODE_ENV)

12 process.env.NODE_ENV = "development";

13 const envFiles = loadEnvironmentVariables() || [];

14 let child = null;

15 try {

16 const config = getArkosConfig();

17 const entryPoint = path.resolve(process.cwd(), config.source?.entryPoint);

18 if (!fs.existsSync(entryPoint)) {

19 console.error(`Could not find application entry point at ${entryPoint}`);

20 process.exit(1);

21 }

22 const entryPointRelative = path.relative(process.cwd(), entryPoint);

23 const getEnv = () => ({

24 NODE_ENV: "development",

25 ...process.env,

26 CLI: "false",

27 });

28 const startServer = () => {

29 if (child) {

30 child.kill();

31 child = null;

32 }

33 const env = getEnv();

34 child = spawn("npx", ["tsx-strict", "--no-type-check", entryPointRelative], {

35 stdio: "inherit",

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/esm/utils/cli/export-auth-action.jsView on unpkg · L33

36 env,

37 shell: true,

38 });

High

Shell

Package source references shell execution.

dist/esm/utils/cli/export-auth-action.jsView on unpkg · L36

39 if (child)

40 child.on("error", (error) => {

41 console.error("Failed to start server:", error);

42 });

43 };

44 startServer();

45 watermarkStamper.stamp({

46 envFiles,

47 });

48 const cleanup = () => {

49 if (child) {

50 child.kill("SIGTERM");

51 setTimeout(() => {

52 if (child && !child.killed)

53 child.kill("SIGKILL");

54 }, 5000);

55 }

56 process.exit(0);

dist/esm/utils/helpers/global.helpers.jsView file

Lines 1-58javascript

1import fs from "fs";

2import path from "path";

3import { createRequire } from "module";

4import { pathToFileURL } from "url";

5export function getPackageJson() {

dist/esm/utils/cli/start.jsView file

Lines 1-22javascript

1import path from "path";

2import fs from "fs";

3import { spawn } from "child_process";

4import { loadEnvironmentVariables } from "../dotenv.helpers.js";

5import { fullCleanCwd } from "../helpers/fs.helpers.js";