registry / busabase / 0.1.4

busabase@0.1.4

Open-source Busabase review app + CLI. `busabase server` boots a zero-setup local instance (pglite); other subcommands act as an OpenAPI client.

Static Scan Results

scanned 15d ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 8 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

DynamicRequireEnvironmentVarsFilesystem

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 8.47 KB of source

Source & flagged code

4 flagged

bin/busabase.mjsView file

Lines 164-204javascript

164 await mkdir(pgDir, { recursive: true });

165 await mkdir(storageDir, { recursive: true });

166 process.env.PORT = String(port);

167 process.env.HOSTNAME = host;

168 // pglite + local storage persist here so data survives restarts regardless of cwd.

169 process.env.PG_DATABASE_URL ??= `pglite://${pgDir}`;

170 process.env.STORAGE_URL ??= `local:${storageDir}?base_url=/api/dev/attachment`;

171 process.env.NODE_ENV ??= "production";

172

173 const entry = findServerEntry();

174 if (!entry) {

175 console.error(

176 "busabase: no built server found.\n" +

177 "This package must ship the Next standalone build. If you are running from\n" +

178 "source, build it first: pnpm --filter busabase build\n",

179 );

180 process.exit(1);

181 }

182 // Standalone server.js resolves static/public relative to its own directory.

183 process.chdir(dirname(entry));

184 printSplash({ host, port, dataDir });

185 await import(entry);

186}

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/busabase.mjsView on unpkg · L184

187

188async function runClientCli(argv) {

189 try {

190 const { runCli } = await import("busabase-cli");

191 return await runCli(argv);

192 } catch (error) {

193 const sourceCliWrapper = resolve(pkgRoot, "../busabase-cli/bin/busabase-cli.mjs");

194 if (existsSync(sourceCliWrapper)) {

195 const previousArgv = process.argv;

196 process.argv = [process.execPath, sourceCliWrapper, ...argv];

197 try {

198 await import(pathToFileURL(sourceCliWrapper).href);

199 } finally {

200 process.argv = previousArgv;

201 }

202 return 0;

203 }

204

.next/standalone/apps/busabase/.next/static/media/c5957c763502833a-s.056avqpz8txyo.woff2View file

•path = .next/standalone/apps/busabase/.[redacted]-s.056avqpz8txyo.woff2 kind = high_entropy_blob sizeBytes = 81528 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

.next/standalone/apps/busabase/.next/static/media/c5957c763502833a-s.056avqpz8txyo.woff2View on unpkg

.next/standalone/apps/busabase/.next/server/chunks/ssr/[root-of-the-server]__07g4z_8._.jsView file

•path = .next/standalone/apps/busabase/.next/server/chunks/ssr/[root-of-the-server]__07g4z_8._.js kind = payload_in_excluded_dir sizeBytes = 2308905 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.next/standalone/apps/busabase/.next/server/chunks/ssr/[root-of-the-server]__07g4z_8._.jsView on unpkg

•path = .next/standalone/apps/busabase/.next/server/chunks/ssr/[root-of-the-server]__07g4z_8._.js kind = oversized_source_file sizeBytes = 2308905 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

.next/standalone/apps/busabase/.next/server/chunks/ssr/[root-of-the-server]__07g4z_8._.jsView on unpkg

Source & flagged code

4 flagged · loading source

bin/busabase.mjsView file

184printSplash({ host, port, dataDir }); L185: await import(entry); L186: }

Medium

Dynamic Require

Package source references dynamic require/import behavior.

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code