registry / camelmind / 0.2.5

camelmind@0.2.5

Create and manage CamelMind documentation sites

Static Scan Results

scanned 2d ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 73 file(s), 232 KB of source, external domains: example.com, registry.npmjs.org

Source & flagged code

4 flagged

dist/index.jsView file

Lines 1-31javascript

1#!/usr/bin/env node

3// src/index.ts

4import { Command } from "commander";

5import { fileURLToPath as fileURLToPath3 } from "url";

6import path3 from "path";

7import fs3 from "fs";

9// src/commands/init.ts

10import path from "path";

11import { fileURLToPath } from "url";

12import { execSync } from "child_process";

13import fs from "fs-extra";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L11

14import chalk from "chalk";

15import ora from "ora";

16import prompts from "prompts";

17var __dirname = path.dirname(fileURLToPath(import.meta.url));

18var TEMPLATE_DIR = path.join(__dirname, "../template");

19var BANNER = `

20 ${chalk.hex("#D8A15B").bold("\u{1F42A} CamelMind")} ${chalk.hex("#F4D6A7")("Doc site spun up in minutes.")}

21`;

22function validateProjectName(name) {

23 if (!/^[a-z0-9][a-z0-9-_]*$/.test(name)) {

24 return "Use lowercase letters, numbers, hyphens, or underscores (must start with a letter or digit)";

25 }

26 return true;

27}

28async function init(projectName, options) {

29 console.log(BANNER);

30 if (!projectName) {

31 const response = await prompts(

Lines 91-131javascript

91 await fs.remove(pkgSrc);

92 }

93 const gitignoreSrc = path.join(targetDir, "_gitignore");

94 if (await fs.pathExists(gitignoreSrc)) {

95 await fs.move(gitignoreSrc, path.join(targetDir, ".gitignore"));

96 }

template/scripts/build-pdf.shView file

•path = template/scripts/build-pdf.sh kind = build_helper sizeBytes = 1183 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

template/scripts/build-pdf.shView on unpkg

template/app/favicon.icoView file

•path = template/app/favicon.ico kind = high_entropy_blob sizeBytes = 4650 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

template/app/favicon.icoView on unpkg

Source & flagged code

4 flagged · loading source

dist/index.jsView file

11import { fileURLToPath } from "url"; L12: import { execSync } from "child_process"; L13: import fs from "fs-extra";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L11

111try { L112: execSync("npm install", { L113: cwd: targetDir, ... L118: installSpinner.warn( L119: "Supply run failed \u2014 try npm install inside your project" L120: );

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L111

template/scripts/build-pdf.shView file

•path = template/scripts/build-pdf.sh kind = build_helper sizeBytes = 1183 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

template/scripts/build-pdf.shView on unpkg

template/app/favicon.icoView file

•path = template/app/favicon.ico kind = high_entropy_blob sizeBytes = 4650 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

template/app/favicon.icoView on unpkg

Findings

4 High4 Medium5 Low

HighChild Processdist/index.js

HighShell

HighRuntime Package Installdist/index.js

HighShips High Entropy Blobtemplate/app/favicon.ico

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helpertemplate/scripts/build-pdf.sh

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

dist/index.jsView file

Lines 1-31javascript

1#!/usr/bin/env node

3// src/index.ts

4import { Command } from "commander";

5import { fileURLToPath as fileURLToPath3 } from "url";

6import path3 from "path";

7import fs3 from "fs";

9// src/commands/init.ts

10import path from "path";

11import { fileURLToPath } from "url";

12import { execSync } from "child_process";

13import fs from "fs-extra";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L11

14import chalk from "chalk";

15import ora from "ora";

16import prompts from "prompts";

17var __dirname = path.dirname(fileURLToPath(import.meta.url));

18var TEMPLATE_DIR = path.join(__dirname, "../template");

19var BANNER = `

20 ${chalk.hex("#D8A15B").bold("\u{1F42A} CamelMind")} ${chalk.hex("#F4D6A7")("Doc site spun up in minutes.")}

21`;

22function validateProjectName(name) {

23 if (!/^[a-z0-9][a-z0-9-_]*$/.test(name)) {

24 return "Use lowercase letters, numbers, hyphens, or underscores (must start with a letter or digit)";

25 }

26 return true;

27}

28async function init(projectName, options) {

29 console.log(BANNER);

30 if (!projectName) {

31 const response = await prompts(

Lines 91-131javascript

91 await fs.remove(pkgSrc);

92 }

93 const gitignoreSrc = path.join(targetDir, "_gitignore");

94 if (await fs.pathExists(gitignoreSrc)) {

95 await fs.move(gitignoreSrc, path.join(targetDir, ".gitignore"));

96 }

template/scripts/build-pdf.shView file

•path = template/scripts/build-pdf.sh kind = build_helper sizeBytes = 1183 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

template/scripts/build-pdf.shView on unpkg

template/app/favicon.icoView file

•path = template/app/favicon.ico kind = high_entropy_blob sizeBytes = 4650 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

template/app/favicon.icoView on unpkg