registry / boardui / 0.1.0

boardui@0.1.0

Add BoardUI components to your project.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 16.4 KB of source, external domains: www.boardui.com

Source & flagged code

3 flagged

dist/index.jsView file

Lines 1-34javascript

1#!/usr/bin/env node

3// src/index.ts

4import { Command } from "commander";

5import pc4 from "picocolors";

7// src/commands/add.ts

8import { existsSync as existsSync2, mkdirSync, writeFileSync } from "fs";

9import path2 from "path";

10import ora from "ora";

11import pc from "picocolors";

12import prompts from "prompts";

14// src/lib/install.ts

15import { spawn } from "child_process";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L14

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L14

17// src/lib/project.ts

18import { existsSync, readFileSync } from "fs";

19import path from "path";

20function detectPackageManager(cwd) {

21 if (existsSync(path.join(cwd, "pnpm-lock.yaml"))) return "pnpm";

22 if (existsSync(path.join(cwd, "yarn.lock"))) return "yarn";

23 if (existsSync(path.join(cwd, "bun.lock")) || existsSync(path.join(cwd, "bun.lockb"))) {

24 return "bun";

25 }

26 return "npm";

27}

28function installCommand(pm, packages) {

29 switch (pm) {

30 case "pnpm":

31 return ["pnpm", "add", ...packages];

32 case "yarn":

33 return ["yarn", "add", ...packages];

34 case "bun":

Lines 104-144javascript

104 break;

105 }

106 const usesSrcDir = existsSync(path.join(cwd, "src")) && (aliasBase.includes("src") || existsSync(path.join(cwd, "src", "app")) || existsSync(path.join(cwd, "src", "pages"

Source & flagged code

3 flagged · loading source

dist/index.jsView file

14// src/lib/install.ts L15: import { spawn } from "child_process"; L16:

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L14

124await new Promise((resolve, reject) => { L125: const child = spawn(command, args, { cwd, stdio: "ignore", shell: process.platform === "win32" }); L126: child.on("error", reject); ... L134: // src/lib/registry.ts L135: var DEFAULT_REGISTRY_URL = "https://www.boardui.com/r"; L136: function registryBaseUrl() { L137: return (process.env.BOARDUI_REGISTRY_URL ?? DEFAULT_REGISTRY_URL).replace(/\/$/, ""); L138: }

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L124

14// src/lib/install.ts L15: import { spawn } from "child_process"; L16: ... L75: } L76: return JSON.parse(out.replace(/,\s*([}\]])/g, "$1")); L77: } L78: function readProject(cwd) { L79: const pkgPath = path.join(cwd, "package.json"); L80: if (!existsSync(pkgPath)) { ... L124: await new Promise((resolve, reject) => { L125: const child = spawn(command, args, { cwd, stdio: "ignore", shell: process.platform === "win32" }); L126: child.on("error", reject);

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L14

Findings

4 High3 Medium5 Low

HighChild Processdist/index.js

HighShell

HighSame File Env Network Executiondist/index.js

HighSandbox Evasion Gated Capabilitydist/index.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

dist/index.jsView file

Lines 1-34javascript

1#!/usr/bin/env node

3// src/index.ts

4import { Command } from "commander";

5import pc4 from "picocolors";

7// src/commands/add.ts

8import { existsSync as existsSync2, mkdirSync, writeFileSync } from "fs";

9import path2 from "path";

10import ora from "ora";

11import pc from "picocolors";

12import prompts from "prompts";

14// src/lib/install.ts

15import { spawn } from "child_process";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L14

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L14

17// src/lib/project.ts

18import { existsSync, readFileSync } from "fs";

19import path from "path";

20function detectPackageManager(cwd) {

21 if (existsSync(path.join(cwd, "pnpm-lock.yaml"))) return "pnpm";

22 if (existsSync(path.join(cwd, "yarn.lock"))) return "yarn";

23 if (existsSync(path.join(cwd, "bun.lock")) || existsSync(path.join(cwd, "bun.lockb"))) {

24 return "bun";

25 }

26 return "npm";

27}

28function installCommand(pm, packages) {

29 switch (pm) {

30 case "pnpm":

31 return ["pnpm", "add", ...packages];

32 case "yarn":

33 return ["yarn", "add", ...packages];

34 case "bun":

Lines 104-144javascript

104 break;

105 }

106 const usesSrcDir = existsSync(path.join(cwd, "src")) && (aliasBase.includes("src") || existsSync(path.join(cwd, "src", "app")) || existsSync(path.join(cwd, "src", "pages"