registry / codeplay-common / 4.2.9

codeplay-common@4.2.9

⚠ Under review

Common build scripts and files

Static Scan Results

scanned 1d ago · by rust-scanner

Static analysis flagged 13 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 13 file(s), 182 KB of source, external domains: developers.google.com, htmlcodeplay.com, schemas.android.com

Source & flagged code

5 flagged

package.jsonView file

•scripts.postinstall = node scripts/sync-files.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

files/buildCodeplay/apk-store-builder.jsView file

Lines 1-21javascript

1const { spawn } = require("child_process");

2const path = require("path");

High

Child Process

Package source references child process execution.

files/buildCodeplay/apk-store-builder.jsView on unpkg · L1

3const fs = require("fs");

5// Paths

6//const projectRoot = path.join(__dirname, "..");

7const projectRoot = process.cwd();

8const androidPath = path.join(projectRoot, "android");

9const capacitorConfigPath = path.join(projectRoot, "capacitor.config.json");

11// Read capacitor.config.json

12if (!fs.existsSync(capacitorConfigPath)) {

13 console.error("❌ capacitor.config.json not found!");

14 process.exit(1);

15}

17const config = JSON.parse(fs.readFileSync(capacitorConfigPath, "utf8"));

19const buildOptions = config.android?.buildOptions;

21if (!buildOptions) {

scripts/sync-files.jsView file

Lines 1-21javascript

1const fs = require("fs");

2const path = require("path");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

scripts/sync-files.jsView on unpkg · L1

files/buildCodeplay/codeplayBeforeBuild-6.2.jsView file

Lines 91-131javascript

91 { pattern: /IAP-(\d+\.\d+)$/, minVersion: '2.8', isFolder: true , required: true, baseDir: 'js/Ads',mandatoryUpdate: true },

92 { pattern

Source & flagged code

5 flagged · loading source

package.jsonView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code