registry / busabase / 0.9.3

busabase@0.9.3

Open-source Busabase review app + CLI. `busabase server` boots a zero-setup local instance (pglite); other subcommands act as an OpenAPI client.

Static Scan Results

scanned 12d ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 8 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

DynamicRequireEnvironmentVarsFilesystem

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 8.21 KB of source

Source & flagged code

4 flagged

bin/busabase.mjsView file

Lines 164-204javascript

164 await mkdir(pgDir, { recursive: true });

165 await mkdir(storageDir, { recursive: true });

166 process.env.PORT = String(port);

167 process.env.HOSTNAME = host;

168 // pglite + local storage persist here so data survives restarts regardless of cwd.

169 process.env.PG_DATABASE_URL ??= `pglite://${pgDir}`;

170 process.env.STORAGE_URL ??= `local:${storageDir}?base_url=/api/dev/attachment`;

171 process.env.NODE_ENV ??= "production";

172

173 const entry = findServerEntry();

174 if (!entry) {

175 console.error(

176 "busabase: no built server found.\n" +

177 "This package must ship the Next standalone build. If you are running from\n" +

178 "source, build it first: pnpm --filter busabase build\n",

179 );

180 process.exit(1);

181 }

182 // Standalone server.js resolves static/public relative to its own directory.

183 process.chdir(dirname(entry));

184 printSplash({ host, port, dataDir });

185 await import(entry);

186}

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/busabase.mjsView on unpkg · L184

187

188async function runClientCli(argv) {

189 let runCli;

190 try {

191 ({ runCli } = await import("busabase-cli"));

192 } catch (error) {

193 const siblingBin = resolve(pkgRoot, "../busabase-cli/bin/busabase-cli.mjs");

194 if (existsSync(siblingBin)) {

195 process.env.BUSABASE_CLI_DELEGATED_ARGV = JSON.stringify(argv);

196 await import(siblingBin);

197 return 0;

198 }

199 const message = error instanceof Error ? error.message : String(error);

200 console.error(

201 "busabase: could not load busabase-cli.\n" +

202 `Cause: ${message}\n\n` +

203 "If you are running from source, build the CLI first:\n" +

204 " pnpm --filter busabase-cli build\n\n" +

.next/standalone/apps/busabase/.next/static/media/c5957c763502833a-s.056avqpz8txyo.woff2View file

•path = .next/standalone/apps/busabase/.[redacted]-s.056avqpz8txyo.woff2 kind = high_entropy_blob sizeBytes = 81528 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

.next/standalone/apps/busabase/.next/static/media/c5957c763502833a-s.056avqpz8txyo.woff2View on unpkg

.next/standalone/apps/busabase/.next/server/chunks/ssr/[root-of-the-server]__0a7lc3g._.jsView file

•path = .next/standalone/apps/busabase/.next/server/chunks/ssr/[root-of-the-server]__0a7lc3g._.js kind = payload_in_excluded_dir sizeBytes = 2537789 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.next/standalone/apps/busabase/.next/server/chunks/ssr/[root-of-the-server]__0a7lc3g._.jsView on unpkg

•path = .next/standalone/apps/busabase/.next/server/chunks/ssr/[root-of-the-server]__0a7lc3g._.js kind = oversized_source_file sizeBytes = 2537789 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

.next/standalone/apps/busabase/.next/server/chunks/ssr/[root-of-the-server]__0a7lc3g._.jsView on unpkg

Source & flagged code

4 flagged · loading source

bin/busabase.mjsView file

184printSplash({ host, port, dataDir }); L185: await import(entry); L186: }

Medium

Dynamic Require

Package source references dynamic require/import behavior.

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code