registry / create-objectstack / 11.10.0

create-objectstack@11.10.0

Create a new ObjectStack project — npx create-objectstack

Static Scan Results

scanned 1d ago · by rust-scanner

Static analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 5 file(s), 14.5 KB of source, external domains: codeload.github.com

Source & flagged code

2 flagged

dist/index.jsView file

Lines 1-26javascript

1// src/index.ts

2import { Command } from "commander";

3import chalk from "chalk";

4import fs from "fs";

5import path from "path";

6import os from "os";

7import { execSync } from "child_process";

8import { fileURLToPath } from "url";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L6

9import { pipeline } from "stream/promises";

10import { createGunzip } from "zlib";

11import { createWriteStream, createReadStream } from "fs";

12import { mkdtemp, rm } from "fs/promises";

13import * as tar from "tar";

14var __filename = fileURLToPath(import.meta.url);

15var __dirname = path.dirname(__filename);

16var BUNDLED_TEMPLATES_DIR = path.resolve(__dirname, "templates");

17var REMOTE_REPO = "objectstack-ai/templates";

18var REMOTE_BRANCH = "main";

19var REMOTE_TARBALL_URL = `https://codeload.github.com/${REMOTE_REPO}/tar.gz/refs/heads/${REMOTE_BRANCH}`;

20var TEMPLATES = {

21 blank: {

22 description: "Minimal starter \u2014 one object, REST API, ready to extend",

23 source: { kind: "bundled", dir: "blank" }

24 },

25 todo: {

26 description: "Universal task & project management starter",

Lines 308-348javascript

308 for (const f of createdFiles.slice(0, 20)) {

309 console.log(chalk.green(` + ${f}`));

310 }

311 if (createdFiles.length > 20) {

312 console.log(chalk.dim

Source & flagged code

2 flagged · loading source

dist/index.jsView file

6import os from "os"; L7: import { execSync } from "child_process"; L8: import { fileURLToPath } from "url";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L6

328try { L329: execSync("npx -y skills add objectstack-ai/framework --all", { L330: stdio: "inherit",

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L328

Findings

3 High2 Medium4 Low

HighChild Processdist/index.js

HighShell

HighRuntime Package Installdist/index.js

MediumNetwork

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

dist/index.jsView file

Lines 1-26javascript

1// src/index.ts

2import { Command } from "commander";

3import chalk from "chalk";

4import fs from "fs";

5import path from "path";

6import os from "os";

7import { execSync } from "child_process";

8import { fileURLToPath } from "url";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L6

9import { pipeline } from "stream/promises";

10import { createGunzip } from "zlib";

11import { createWriteStream, createReadStream } from "fs";

12import { mkdtemp, rm } from "fs/promises";

13import * as tar from "tar";

14var __filename = fileURLToPath(import.meta.url);

15var __dirname = path.dirname(__filename);

16var BUNDLED_TEMPLATES_DIR = path.resolve(__dirname, "templates");

17var REMOTE_REPO = "objectstack-ai/templates";

18var REMOTE_BRANCH = "main";

19var REMOTE_TARBALL_URL = `https://codeload.github.com/${REMOTE_REPO}/tar.gz/refs/heads/${REMOTE_BRANCH}`;

20var TEMPLATES = {

21 blank: {

22 description: "Minimal starter \u2014 one object, REST API, ready to extend",

23 source: { kind: "bundled", dir: "blank" }

24 },

25 todo: {

26 description: "Universal task & project management starter",

Lines 308-348javascript

308 for (const f of createdFiles.slice(0, 20)) {

309 console.log(chalk.green(` + ${f}`));

310 }

311 if (createdFiles.length > 20) {

312 console.log(chalk.dim