betterstart-cli@0.0.63

Scaffold a preset-based Admin into any Next.js 16 application

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 419 file(s), 2.16 MB of source, external domains: assets.betterstart.dev, betterstart.io, biomejs.dev, example.com, schema.org, ui.shadcn.com, vercel.com, www.w3.org

Source & flagged code

2 flagged

dist/cli.jsView file

54const options = command.opts(); L55: return typeof options.cwd === "string" ? path2.resolve(options.cwd) : process.cwd(); L56: } ... L224: // core-engine/utils/package-manager.ts L225: import { execFileSync } from "child_process"; L226: import fs3 from "fs"; ... L229: "pnpm-lock.yaml": "pnpm", L230: "package-lock.json": "npm", L231: "yarn.lock": "yarn", ... L246: try { L247: const pkg = JSON.parse(fs3.readFileSync(pkgPath, "utf-8")); L248: if (typeof pkg.packageManager === "string") {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli.jsView on unpkg · L54

39async function loadConfigFile(configPath) { L40: const { createJiti } = await import("jiti"); L41: const alias = {};

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/cli.jsView on unpkg · L39

Source & flagged code

2 flagged · loading source

dist/cli.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Behavioral surface

Source & flagged code