registry / create-deepspace / 0.5.0

create-deepspace@0.5.0

⚠ Under review

Create a new DeepSpace app

Static Scan Results

scanned 1h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 46 file(s), 143 KB of source, external domains: deep.space, docs.deep.space, react.dev

Source & flagged code

3 flagged

dist/index.jsView file

Lines 1-26javascript

1#!/usr/bin/env node

3// src/index.ts

4import { existsSync, readdirSync, readFileSync, writeFileSync, cpSync, mkdirSync, openSync, closeSync } from "fs";

5import { join, resolve, dirname, basename, extname } from "path";

6import { fileURLToPath } from "url";

7import { execSync } from "child_process";

8import spawn from "cross-spawn";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L6

9import * as p from "@clack/prompts";

10var __dirname = dirname(fileURLToPath(import.meta.url));

11var TEMPLATES_DIR = join(__dirname, "..", "templates");

12var SKILLS_INSTALLER_PKG = "skills@latest";

13var SKILL_REPO = "deepdotspace/deepspace-skill";

14function parseArgs(argv) {

15 let appName;

16 let local;

17 let help = false;

18 let version = false;

19 let interactive = false;

20 for (let i = 2; i < argv.length; i++) {

21 const a = argv[i];

22 if (a === "--local") {

23 local = argv[++i];

24 } else if (a === "--help" || a === "-h") {

25 help = true;

26 } else if (a === "--version" || a === "-v") {

Lines 313-353javascript

313 captured += c.toString("utf8").slice(0, MAX_CAPTURE - captured.length);

314 truncated = true;

315 } else {

316 captured += c.toString("utf8");

317 }

318 };

•matchType = previous_version_dangerous_delta matchedPackage = create-deepspace@0.4.5 matchedIdentity = npm:Y3JlYXRlLWRlZXBzcGFjZQ:0.4.5 similarity = 0.957 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg

Source & flagged code

3 flagged · loading source

dist/index.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg

6import { fileURLToPath } from "url"; L7: import { execSync } from "child_process"; L8: import spawn from "cross-spawn";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L6

333} catch (err) { L334: s.stop("Skill install failed \u2014 see .deepspace/skill.err, then run `npx deepspace skills add`"); L335: try { ... L346: const workerScript = join(__dirname, "install-worker.js"); L347: const worker = spawn(process.execPath, [workerScript, appDir], { L348: cwd: appDir,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L333

Findings

1 Critical3 High3 Medium5 Low

CriticalPrevious Version Dangerous Deltadist/index.js

HighChild Processdist/index.js

HighShell

HighRuntime Package Installdist/index.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

dist/index.jsView file

Lines 1-26javascript

1#!/usr/bin/env node

3// src/index.ts

4import { existsSync, readdirSync, readFileSync, writeFileSync, cpSync, mkdirSync, openSync, closeSync } from "fs";

5import { join, resolve, dirname, basename, extname } from "path";

6import { fileURLToPath } from "url";

7import { execSync } from "child_process";

8import spawn from "cross-spawn";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L6

9import * as p from "@clack/prompts";

10var __dirname = dirname(fileURLToPath(import.meta.url));

11var TEMPLATES_DIR = join(__dirname, "..", "templates");

12var SKILLS_INSTALLER_PKG = "skills@latest";

13var SKILL_REPO = "deepdotspace/deepspace-skill";

14function parseArgs(argv) {

15 let appName;

16 let local;

17 let help = false;

18 let version = false;

19 let interactive = false;

20 for (let i = 2; i < argv.length; i++) {

21 const a = argv[i];

22 if (a === "--local") {

23 local = argv[++i];

24 } else if (a === "--help" || a === "-h") {

25 help = true;

26 } else if (a === "--version" || a === "-v") {

Lines 313-353javascript

313 captured += c.toString("utf8").slice(0, MAX_CAPTURE - captured.length);

314 truncated = true;

315 } else {

316 captured += c.toString("utf8");

317 }

318 };

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg