base-ui-cli@1.1.63: Clean npm security report (Allow)

Static Scan Results

scanned 2d ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 7 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 44.5 KB of source, external domains: base-ui.net, github.com, pro.base-ui.net, registry.npmjs.org

Source & flagged code

1 flagged

dist/index.jsView file

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. dist/index.js: var SITE_URL = "https://base-ui.net"; var PRO_REGISTRY_URL = process.env.BASE_UI_PRO_REGISTRY_URL || "https://pro.base-ui.net/registry"; import_fs.default.writeFileSync(lockfilePath(), JSON.stringify(lock, null, 2) + "\n", "utf8"); import_fs2.default.writeFileSync(import_path2.default.join(targetDir, name), body); $schema: "https://base-ui.net/schema.json", import_fs2.default.writeFileSync(configPath, JSON.stringify(config, null, 2), "utf8"); import_fs2.default.writeFileSync(baseCssPath, BASE_CSS, "utf8"); import_fs2.default.writeFileSync(stylesPath, `${importLine}

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

dist/index.jsView on unpkg

Source & flagged code

1 flagged · loading source

dist/index.jsView file

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. dist/index.js: var SITE_URL = "https://base-ui.net"; var PRO_REGISTRY_URL = process.env.BASE_UI_PRO_REGISTRY_URL || "https://pro.base-ui.net/registry"; import_fs.default.writeFileSync(lockfilePath(), JSON.stringify(lock, null, 2) + "\n", "utf8"); import_fs2.default.writeFileSync(import_path2.default.join(targetDir, name), body); $schema: "https://base-ui.net/schema.json", import_fs2.default.writeFileSync(configPath, JSON.stringify(config, null, 2), "utf8"); import_fs2.default.writeFileSync(baseCssPath, BASE_CSS, "utf8"); import_fs2.default.writeFileSync(stylesPath, `${importLine}

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code