registry / create-b3-cf-app / 0.1.2

create-b3-cf-app@0.1.2

Scaffold a Bun + Hono + Cloudflare Workers + React monorepo in seconds

Static Scan Results

scanned 1d ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 35 file(s), 26.3 KB of source, external domains: github.com, www.w3.org

Source & flagged code

4 flagged

dist/scaffold.jsView file

Lines 1-21javascript

1import { spawn } from 'node:child_process';

2import { copyFileSync, existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync } from 'node:fs';

High

Child Process

Package source references child process execution.

dist/scaffold.jsView on unpkg · L1

3import { join, resolve } from 'node:path';

4import { log } from '@clack/prompts';

5import { cyan } from 'kleur/colors';

6const TEMPLATE_DIR = new URL('../template', import.meta.url).pathname;

7// Files that should be processed for variable substitution

8const TEXT_EXTENSIONS = new Set([

9 '.ts', '.tsx', '.js', '.jsx', '.json', '.jsonc', '.yml', '.yaml',

10 '.toml', '.md', '.css', '.html', '.txt', '.gitignore',

11 '.env', '.npmrc', '.gitattributes',

12]);

13function isTextFile(filePath) {

14 const ext = filePath.split('.').pop();

15 if (!ext)

16 return false;

17 // Handle files like .gitignore (no extension before the dot)

18 const basename = filePath.split('/').pop() ?? filePath;

19 if (basename === '.gitignore' || basename === '.env' || basename === '.npmrc')

20 return true;

21 return TEXT_EXTENSIONS.has('.' + ext);

Lines 36-99javascript

36 if (entry.name === 'node_modules')

37 continue;

38 if (entry.isDirectory()) {

39 copyDir(srcPath, destPath, vars);

40 }

41 else {

42 if (isTextFile(entry.name)) {

43 const content

template/scripts/db-migrate.shView file

•path = template/scripts/db-migrate.sh kind = build_helper sizeBytes = 418 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

template/scripts/db-migrate.shView on unpkg

Source & flagged code

4 flagged · loading source

dist/scaffold.jsView file

1import { spawn } from 'node:child_process'; L2: import { copyFileSync, existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync } from 'node:fs';

High

Child Process

Package source references child process execution.

dist/scaffold.jsView on unpkg · L1

56stdio: 'inherit', L57: shell: true, L58: });

High

Shell

Package source references shell execution.

dist/scaffold.jsView on unpkg · L56

80try { L81: await exec('git', ['init'], dest); L82: log.success('Git repository initialized.'); ... L94: catch { L95: log.warn('bun install failed — run it yourself later.'); L96: }

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/scaffold.jsView on unpkg · L80

template/scripts/db-migrate.shView file

•path = template/scripts/db-migrate.sh kind = build_helper sizeBytes = 418 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

template/scripts/db-migrate.shView on unpkg

Findings

3 High2 Medium6 Low

HighChild Processdist/scaffold.js

HighShelldist/scaffold.js

HighRuntime Package Installdist/scaffold.js

MediumShips Build Helpertemplate/scripts/db-migrate.sh

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

4 flagged

dist/scaffold.jsView file

Lines 1-21javascript

1import { spawn } from 'node:child_process';

2import { copyFileSync, existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync } from 'node:fs';

High

Child Process

Package source references child process execution.

dist/scaffold.jsView on unpkg · L1

3import { join, resolve } from 'node:path';

4import { log } from '@clack/prompts';

5import { cyan } from 'kleur/colors';

6const TEMPLATE_DIR = new URL('../template', import.meta.url).pathname;

7// Files that should be processed for variable substitution

8const TEXT_EXTENSIONS = new Set([

9 '.ts', '.tsx', '.js', '.jsx', '.json', '.jsonc', '.yml', '.yaml',

10 '.toml', '.md', '.css', '.html', '.txt', '.gitignore',

11 '.env', '.npmrc', '.gitattributes',

12]);

13function isTextFile(filePath) {

14 const ext = filePath.split('.').pop();

15 if (!ext)

16 return false;

17 // Handle files like .gitignore (no extension before the dot)

18 const basename = filePath.split('/').pop() ?? filePath;

19 if (basename === '.gitignore' || basename === '.env' || basename === '.npmrc')

20 return true;

21 return TEXT_EXTENSIONS.has('.' + ext);

Lines 36-99javascript

36 if (entry.name === 'node_modules')

37 continue;

38 if (entry.isDirectory()) {

39 copyDir(srcPath, destPath, vars);

40 }

41 else {

42 if (isTextFile(entry.name)) {

43 const content

template/scripts/db-migrate.shView file

•path = template/scripts/db-migrate.sh kind = build_helper sizeBytes = 418 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

template/scripts/db-migrate.shView on unpkg