registry / betterstart-cli / 0.0.77

betterstart-cli@0.0.77

Scaffold a preset-based Admin into any Next.js 16 application

Static Scan Results

scanned 4h ago · by rust-scanner

Static analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 422 file(s), 2.22 MB of source, external domains: assets.betterstart.dev, betterstart.io, biomejs.dev, example.com, openapi.vercel.sh, schema.org, ui.shadcn.com, vercel.com, www.w3.org

Source & flagged code

2 flagged

dist/cli.jsView file

54const options = command.opts(); L55: return typeof options.cwd === "string" ? path2.resolve(options.cwd) : process.cwd(); L56: } ... L230: // core-engine/utils/package-manager.ts L231: import { execFileSync } from "child_process"; L232: import fs3 from "fs"; ... L235: "pnpm-lock.yaml": "pnpm", L236: "package-lock.json": "npm", L237: "yarn.lock": "yarn", ... L252: try { L253: const pkg = JSON.parse(fs3.readFileSync(pkgPath, "utf-8")); L254: if (typeof pkg.packageManager === "string") {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli.jsView on unpkg · L54

39async function loadConfigFile(configPath) { L40: const { createJiti } = await import("jiti"); L41: const alias = {};

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/cli.jsView on unpkg · L39

Source & flagged code

2 flagged · loading source

dist/cli.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code