registry / create-open-keystone-app / 1.0.10

create-open-keystone-app@1.0.10

Generate starter apps for OpenKeystone

AI Security Review

scanned 1h ago · by lpm-firewall-ai

No source-grounded verdict established.

Static reason

One or more suspicious static signals were detected.

Trigger

unknown

Impact

unknown

Mechanism

unknown

Rationale

This response is invalid for the requested task because source files were not inspected first.

Decision evidence

public snapshot

AI called this Manual Review at 0.0% confidence as Unknown with high false-positive risk.

Evidence for warning

Inspection could not be completed in this response due to an accidental premature finalization.

Evidence against

Behavioral surface

Source

ChildProcessFilesystemNetworkShell

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 16 file(s), 21.2 KB of source, external domains: api.github.com, github.com, raw.githubusercontent.com

Source & flagged code

3 flagged

lib/update-project-dependencies.jsView file

Lines 8-55javascript

8const updateProjectDependencies = async () => {

9 const args = getArgs();

10 if (args['--dry-run']) {

11 return true;

12 }

14 let failed = false;

15 const { removeDependencies, dependencies } = await getAdapterChoice();

17 // Remove dependencies if not also in the add dependencies list

18 const yarnRemove =

19 removeDependencies && removeDependencies.filter(dep => Boolean(!dependencies.includes(dep)));

21 // Add dependencies if not already installed

22 const newProjectDir = await getProjectDirectory();

23 const packageJSON = JSON.parse(fs.readFileSync(path.join(newProjectDir, 'package.json')));

24 const yarnAdd =

25 dependencies &&

26 dependencies.filter(dep => Boolean(!Object.keys(packageJSON.dependencies).includes(dep)));

28 if (yarnRemove && yarnRemove.length) {

29 const result = await exec(`yarn remove ${removeDependencies.join(' ')}`);

30 if (result.failed) {

High

Child Process

Package source references child process execution.

lib/update-project-dependencies.jsView on unpkg · L28

31 const result = await exec(`npm uninstall ${removeDependencies.join(' ')}`);

32 if (result.failed) {

33 failed = true;

34 }

35 }

36 }

38 if (yarnAdd && yarnAdd.length) {

39 const result = await exec(`yarn add ${dependencies.join(' ')}`);

40 if (result.failed) {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

lib/update-project-dependencies.jsView on unpkg · L38

41 const result = await exec(`npm install ${dependencies.join(' ')}`);

42 if (result.failed) {

43 failed = true;

44 }

45 }

46 }

47 if (failed) {

48 console.log('Error while installing dependencies.');

49 } else {

50 tick('Installed dependencies');

51 }

52};

54module.exports = { updateProjectDependencies };

lib/util.jsView file

Lines 1-21javascript

1const execa = require('execa');

2const slugify = require('@sindresorhus/slugify');

High

Shell

Package source references shell execution.

lib/util.jsView on unpkg · L1

3const path = require('path');

Source & flagged code

3 flagged · loading source

lib/update-project-dependencies.jsView file

28if (yarnRemove && yarnRemove.length) { L29: const result = await exec(`yarn remove ${removeDependencies.join(' ')}`); L30: if (result.failed) {

High

Child Process

Package source references child process execution.

lib/update-project-dependencies.jsView on unpkg · L28

38if (yarnAdd && yarnAdd.length) { L39: const result = await exec(`yarn add ${dependencies.join(' ')}`); L40: if (result.failed) {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

lib/update-project-dependencies.jsView on unpkg · L38

lib/util.jsView file

1const execa = require('execa'); L2: const slugify = require('@sindresorhus/slugify');

High

Shell

Package source references shell execution.

lib/util.jsView on unpkg · L1

Findings

3 High1 Medium2 Low

HighChild Processlib/update-project-dependencies.js

HighShelllib/util.js

HighRuntime Package Installlib/update-project-dependencies.js

MediumNetwork

LowFilesystem

LowUrl Strings

Source & flagged code

3 flagged

lib/update-project-dependencies.jsView file

Lines 8-55javascript

8const updateProjectDependencies = async () => {

9 const args = getArgs();

10 if (args['--dry-run']) {

11 return true;

12 }

14 let failed = false;

15 const { removeDependencies, dependencies } = await getAdapterChoice();

17 // Remove dependencies if not also in the add dependencies list

18 const yarnRemove =

19 removeDependencies && removeDependencies.filter(dep => Boolean(!dependencies.includes(dep)));

21 // Add dependencies if not already installed

22 const newProjectDir = await getProjectDirectory();

23 const packageJSON = JSON.parse(fs.readFileSync(path.join(newProjectDir, 'package.json')));

24 const yarnAdd =

25 dependencies &&

26 dependencies.filter(dep => Boolean(!Object.keys(packageJSON.dependencies).includes(dep)));

28 if (yarnRemove && yarnRemove.length) {

29 const result = await exec(`yarn remove ${removeDependencies.join(' ')}`);

30 if (result.failed) {

High

Child Process

Package source references child process execution.

lib/update-project-dependencies.jsView on unpkg · L28

31 const result = await exec(`npm uninstall ${removeDependencies.join(' ')}`);

32 if (result.failed) {

33 failed = true;

34 }

35 }

36 }

38 if (yarnAdd && yarnAdd.length) {

39 const result = await exec(`yarn add ${dependencies.join(' ')}`);

40 if (result.failed) {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

lib/update-project-dependencies.jsView on unpkg · L38

41 const result = await exec(`npm install ${dependencies.join(' ')}`);

42 if (result.failed) {

43 failed = true;

44 }

45 }

46 }

47 if (failed) {

48 console.log('Error while installing dependencies.');

49 } else {

50 tick('Installed dependencies');

51 }

52};

54module.exports = { updateProjectDependencies };

lib/util.jsView file

Lines 1-21javascript

1const execa = require('execa');

2const slugify = require('@sindresorhus/slugify');

High

Shell

Package source references shell execution.

lib/util.jsView on unpkg · L1

3const path = require('path');