registry / create-checkstack-plugin / 0.1.14

create-checkstack-plugin@0.1.14

Scaffold a standalone Checkstack plugin workspace (common + backend + frontend) with concrete published versions, ready to `bun install && bun run dev`.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 12 file(s), 90.4 KB of source, external domains: registry.npmjs.org

Source & flagged code

3 flagged

src/external-plugin-install.e2e.it.test.tsView file

Lines 4-78typescript

4 *

5 * Distinct from `external-plugin-lifecycle.it.test.ts` (which boots the dev

6 * SERVER): this boots the real backend + built SPA on a port (same launcher the

7 * e2e suite uses), then drives a browser through the actual install wizard

8 * (tarball upload + typed confirmation) and asserts:

9 *

10 * 1. the packaged plugin installs and its backend loads (`POST /api/widget/*`),

11 * 2. the plugin's FRONTEND works (its route/nav entry + page render), incl.

12 * the host's shared Monaco editor mounting inside the plugin page,

13 * 3. the co-loaded CORE plugins still work (frontend nav + backend API) - i.e.

14 * installing the external plugin didn't break the platform.

15 *

16 * The instance's plugin install (`bun install` under the runtime dir) is pointed

17 * at the same throwaway Verdaccio that holds the freshly-published workspace, so

18 * the plugin's `@checkstack/*` deps resolve to versions the instance is running.

19 *

20 * Heavy (publish + full install + backend boot + browser); gated behind

21 * `CHECKSTACK_E2E_INSTALL=1`, needs Postgres + the repo `.env`, and the frontend

22 * must be built (`bun run --filter @checkstack/frontend build`).

23 */

24import { afterAll, beforeAll, describe, it } from "bun:test";

25import { spawn, spawnSync, type ChildProcess } from "node:child_process";

26import fs from "node:fs";

High

Child Process

Package source references child process execution.

src/external-plugin-install.e2e.it.test.tsView on unpkg · L24

27import os from "node:os";

28import path from "node:path";

29import { fileURLToPath } from "node:url";

30// Playwright's `expect` carries the web-first locator assertions (`toBeVisible`,

31// `toHaveURL`, …) and also handles value assertions (`toBe`, `toEqual`); using

32// it throughout keeps one assertion surface under bun:test's runner.

33import { chromium, expect, type Browser } from "@playwright/test";

34import { scaffoldStandaloneWorkspace, localSiblingNames } from "./scaffold-standalone";

35import { createNpmViewResolver } from "./npm-view-resolver";

36import {

37 DEFAULT_REGISTRY_URL,

38 buildVerdaccioConfig,

39 buildNpmrc,

40 discoverWorkspacePackages,

41 publishWorkspacePackages,

42 findMonorepoRoot,

43 startVerdaccio,

44 type RegistryHandle,

45} from "./local-registry";

47const HERE = path.dirname(fileURLToPath(import.meta.url));

48const BASE_NAME = "widget";

49const PASCAL_NAME = "Widget";

50const PLUGIN_ID = "widget";

51const PACKAGE_SCOPE = "checkstackit";

52const INSTANCE_PORT = 3199;

53const INSTANCE_URL = `http://localhost:${INSTANCE_PORT}`;

54const E2E_DB_NAME = "checkstack_e2e_extplugin";

55const ADMIN = {

56 name: "E2E Admin",

57 email: "e2e-admin@example.com",

58 password: "E2eAdminPassw0rd!",

Medium

Secret Pattern

Hardcoded password in src/external-plugin-install.e2e.it.test.ts

src/external-plugin-install.e2e.it.test.tsView on unpkg · L58

59};

61function run({

62 command,

63 args,

64 cwd,

65 env,

66 timeoutMs = 600_000,

67}: {

68 command: string;

69 args: string[];

70 cwd: string;

71 env?: NodeJS.ProcessEnv;

72 timeoutMs?: number;

73}): { status: number; stdout: string; stderr: string } {

74 const r = spawnSync(command, args, {

75 cwd,

76 env: { ...process.env, ...env },

77 encoding: "utf8",

78 timeout: timeoutMs,

src/local-registry.tsView file

Lines 241-281typescript

241

242/** A live Verdaccio process handle plus its base URL. */

243export interface RegistryHandle {

244 url: string;

245 child: ChildProcess;

246 stop: () => Promise<void>;

Source & flagged code

3 flagged · loading source

src/external-plugin-install.e2e.it.test.tsView file

24import { afterAll, beforeAll, describe, it } from "bun:test"; L25: import { spawn, spawnSync, type ChildProcess } from "node:child_process"; L26: import fs from "node:fs";

High

Child Process

Package source references child process execution.

src/external-plugin-install.e2e.it.test.tsView on unpkg · L24

58patternName = generic_password severity = medium line = 58 matchedText = password...d!",

Medium

Secret Pattern

Hardcoded password in src/external-plugin-install.e2e.it.test.ts

src/external-plugin-install.e2e.it.test.tsView on unpkg · L58

src/local-registry.tsView file

261}): Promise<RegistryHandle> { L262: const child = spawn("npx", ["--yes", "verdaccio", "--config", configPath], { L263: stdio: ["ignore", "pipe", "pipe"],

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/local-registry.tsView on unpkg · L261

Findings

3 High4 Medium4 Low

HighChild Processsrc/external-plugin-install.e2e.it.test.ts

HighShell

HighRuntime Package Installsrc/local-registry.ts

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumSecret Patternsrc/external-plugin-install.e2e.it.test.ts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

src/external-plugin-install.e2e.it.test.tsView file

Lines 4-78typescript

4 *

5 * Distinct from `external-plugin-lifecycle.it.test.ts` (which boots the dev

6 * SERVER): this boots the real backend + built SPA on a port (same launcher the

7 * e2e suite uses), then drives a browser through the actual install wizard

8 * (tarball upload + typed confirmation) and asserts:

9 *

10 * 1. the packaged plugin installs and its backend loads (`POST /api/widget/*`),

11 * 2. the plugin's FRONTEND works (its route/nav entry + page render), incl.

12 * the host's shared Monaco editor mounting inside the plugin page,

13 * 3. the co-loaded CORE plugins still work (frontend nav + backend API) - i.e.

14 * installing the external plugin didn't break the platform.

15 *

16 * The instance's plugin install (`bun install` under the runtime dir) is pointed

17 * at the same throwaway Verdaccio that holds the freshly-published workspace, so

18 * the plugin's `@checkstack/*` deps resolve to versions the instance is running.

19 *

20 * Heavy (publish + full install + backend boot + browser); gated behind

21 * `CHECKSTACK_E2E_INSTALL=1`, needs Postgres + the repo `.env`, and the frontend

22 * must be built (`bun run --filter @checkstack/frontend build`).

23 */

24import { afterAll, beforeAll, describe, it } from "bun:test";

25import { spawn, spawnSync, type ChildProcess } from "node:child_process";

26import fs from "node:fs";

High

Child Process

Package source references child process execution.

src/external-plugin-install.e2e.it.test.tsView on unpkg · L24

27import os from "node:os";

28import path from "node:path";

29import { fileURLToPath } from "node:url";

30// Playwright's `expect` carries the web-first locator assertions (`toBeVisible`,

31// `toHaveURL`, …) and also handles value assertions (`toBe`, `toEqual`); using

32// it throughout keeps one assertion surface under bun:test's runner.

33import { chromium, expect, type Browser } from "@playwright/test";

34import { scaffoldStandaloneWorkspace, localSiblingNames } from "./scaffold-standalone";

35import { createNpmViewResolver } from "./npm-view-resolver";

36import {

37 DEFAULT_REGISTRY_URL,

38 buildVerdaccioConfig,

39 buildNpmrc,

40 discoverWorkspacePackages,

41 publishWorkspacePackages,

42 findMonorepoRoot,

43 startVerdaccio,

44 type RegistryHandle,

45} from "./local-registry";

47const HERE = path.dirname(fileURLToPath(import.meta.url));

48const BASE_NAME = "widget";

49const PASCAL_NAME = "Widget";

50const PLUGIN_ID = "widget";

51const PACKAGE_SCOPE = "checkstackit";

52const INSTANCE_PORT = 3199;

53const INSTANCE_URL = `http://localhost:${INSTANCE_PORT}`;

54const E2E_DB_NAME = "checkstack_e2e_extplugin";

55const ADMIN = {

56 name: "E2E Admin",

57 email: "e2e-admin@example.com",

58 password: "E2eAdminPassw0rd!",

Medium

Secret Pattern

Hardcoded password in src/external-plugin-install.e2e.it.test.ts

src/external-plugin-install.e2e.it.test.tsView on unpkg · L58

59};

61function run({

62 command,

63 args,

64 cwd,

65 env,

66 timeoutMs = 600_000,

67}: {

68 command: string;

69 args: string[];

70 cwd: string;

71 env?: NodeJS.ProcessEnv;

72 timeoutMs?: number;

73}): { status: number; stdout: string; stderr: string } {

74 const r = spawnSync(command, args, {

75 cwd,

76 env: { ...process.env, ...env },

77 encoding: "utf8",

78 timeout: timeoutMs,

src/local-registry.tsView file

Lines 241-281typescript

241

242/** A live Verdaccio process handle plus its base URL. */

243export interface RegistryHandle {

244 url: string;

245 child: ChildProcess;

246 stop: () => Promise<void>;