base-ui-cli: Clean npm security report (Allow)

Static Scan Results

scanned 18h ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 8 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsPossibleObfuscationUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 968 KB of source, external domains: base-ui.net, github.com, json-schema.org, pro.base-ui.net, registry.npmjs.org

Source & flagged code

1 flagged

dist/index.jsView file

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. dist/index.js: // node_modules/kleur/index.js "node_modules/kleur/index.js"(exports2, module2) { // node_modules/prompts/dist/util/action.js "node_modules/prompts/dist/util/action.js"(exports2, module2) { // node_modules/prompts/dist/util/strip.js "node_modules/prompts/dist/util/strip.js"(exports2, module2) { // node_modules/sisteransi/src/index.js "node_modules/sisteransi/src/index.js"(exports2, module2) {

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

dist/index.jsView on unpkg

Source & flagged code

1 flagged · loading source

dist/index.jsView file

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. dist/index.js: // node_modules/kleur/index.js "node_modules/kleur/index.js"(exports2, module2) { // node_modules/prompts/dist/util/action.js "node_modules/prompts/dist/util/action.js"(exports2, module2) { // node_modules/prompts/dist/util/strip.js "node_modules/prompts/dist/util/strip.js"(exports2, module2) { // node_modules/sisteransi/src/index.js "node_modules/sisteransi/src/index.js"(exports2, module2) {

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

dist/index.jsView on unpkg

Findings

1 High2 Medium5 Low

HighEntrypoint Foreign Package Code Overwritedist/index.js

MediumNetwork

MediumEnvironment Vars

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings