registry / create-mobrowser-app / 2.11.0

create-mobrowser-app@2.11.0

MōBrowser project scaffolding tool

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 8 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 140 file(s), 226 KB of source, external domains: google.com, mobrowser-scaffold-telemetry-6dptvnhrka-ew.a.run.app, nodejs.org, www.w3.org

Source & flagged code

2 flagged

index.jsView file

Lines 801-841javascript

801 }

802}

803

804/**

805 * Writes placeholders for application signing into mobrowser.conf.json

806 * (see .github/workflows/release.yml). The CLI expands them from the environment at build time.

807 * @param {string} projectDir - Absolute path to the generated project root.

808 */

809function addGithubActionsEnvPlaceholders(projectDir) {

810 const confPath = path.join(projectDir, 'mobrowser.conf.json');

811 const conf = JSON.parse(fs.readFileSync(confPath, 'utf8'));

812 const bundle = conf.app && conf.app.bundle;

813 if (!bundle) {

814 return;

815 }

816 const mac = bundle.macOS;

817 if (mac) {

818 mac.codesignIdentity = '${MAC_CODESIGN_IDENTITY}';

819 mac.teamID = '${MAC_TEAM_ID}';

820 mac.appleID = '${MAC_APPLE_ID}';

821 mac.password = '${MAC_APPLE_PASSWORD}';

Medium

Secret Pattern

Package contains a possible secret pattern.

index.jsView on unpkg · L821

822 }

823 fs.writeFileSync(confPath, JSON.stringify(conf, null, 2) + '\n');

824}

825

826/**

827 * Updates placeholder values in a file with actual project values.

828 * Replaces ${APP_NAME}, ${BUNDLE_APP_NAME}, and ${VERSION} placeholders.

829 * @param {string} filePath - The path to the file to update.

830 * @param {string} appName - The application name.

831 * @param {string} version - The SDK version number.

832 */

833function updatePlaceholderValues(filePath, appName, version) {

834 const updatedContent = fs.readFileSync(filePath, 'utf8')

835 .replaceAll('${APP_NAME}', appName)

836 .replaceAll('${PACKAGE_ID}', appName.replaceAll(/\s+/g, ''))

837 .replaceAll('${BUNDLE_APP_NAME}', appName.replaceAll(/\s+/g, '-'))

838 .replaceAll('${VERSION}', `${version}`);

839 fs.writeFileSync(filePath, updatedContent);

840}

841

templates/vue/vue-native/assets/app.icnsView file

•path = templates/vue/vue-native/assets/app.icns kind = high_entropy_blob sizeBytes = 744100 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

templates/vue/vue-native/assets/app.icnsView on unpkg

Source & flagged code

2 flagged · loading source

index.jsView file

821patternName = generic_password severity = medium line = 821 matchedText = mac.pass...D}';

Medium

Secret Pattern

Package contains a possible secret pattern.

index.jsView on unpkg · L821

templates/vue/vue-native/assets/app.icnsView file

•path = templates/vue/vue-native/assets/app.icns kind = high_entropy_blob sizeBytes = 744100 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

templates/vue/vue-native/assets/app.icnsView on unpkg

Findings

1 High4 Medium3 Low

HighShips High Entropy Blobtemplates/vue/vue-native/assets/app.icns

MediumSecret Patternindex.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

index.jsView file

Lines 801-841javascript

801 }

802}

803

804/**

805 * Writes placeholders for application signing into mobrowser.conf.json

806 * (see .github/workflows/release.yml). The CLI expands them from the environment at build time.

807 * @param {string} projectDir - Absolute path to the generated project root.

808 */

809function addGithubActionsEnvPlaceholders(projectDir) {

810 const confPath = path.join(projectDir, 'mobrowser.conf.json');

811 const conf = JSON.parse(fs.readFileSync(confPath, 'utf8'));

812 const bundle = conf.app && conf.app.bundle;

813 if (!bundle) {

814 return;

815 }

816 const mac = bundle.macOS;

817 if (mac) {

818 mac.codesignIdentity = '${MAC_CODESIGN_IDENTITY}';

819 mac.teamID = '${MAC_TEAM_ID}';

820 mac.appleID = '${MAC_APPLE_ID}';

821 mac.password = '${MAC_APPLE_PASSWORD}';

Medium

Secret Pattern

Package contains a possible secret pattern.

index.jsView on unpkg · L821

822 }

823 fs.writeFileSync(confPath, JSON.stringify(conf, null, 2) + '\n');

824}

825

826/**

827 * Updates placeholder values in a file with actual project values.

828 * Replaces ${APP_NAME}, ${BUNDLE_APP_NAME}, and ${VERSION} placeholders.

829 * @param {string} filePath - The path to the file to update.

830 * @param {string} appName - The application name.

831 * @param {string} version - The SDK version number.

832 */

833function updatePlaceholderValues(filePath, appName, version) {

834 const updatedContent = fs.readFileSync(filePath, 'utf8')

835 .replaceAll('${APP_NAME}', appName)

836 .replaceAll('${PACKAGE_ID}', appName.replaceAll(/\s+/g, ''))

837 .replaceAll('${BUNDLE_APP_NAME}', appName.replaceAll(/\s+/g, '-'))

838 .replaceAll('${VERSION}', `${version}`);

839 fs.writeFileSync(filePath, updatedContent);

840}

841

templates/vue/vue-native/assets/app.icnsView file

•path = templates/vue/vue-native/assets/app.icns kind = high_entropy_blob sizeBytes = 744100 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

templates/vue/vue-native/assets/app.icnsView on unpkg