registry / create-open-keystone-app / 1.0.8

create-open-keystone-app@1.0.8

Generate starter apps for OpenKeystone

Static Scan Results

scanned 1d ago · by rust-scanner

Static analysis flagged 6 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessFilesystemNetworkShell

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 16 file(s), 21.2 KB of source, external domains: api.github.com, github.com, raw.githubusercontent.com

Source & flagged code

3 flagged

lib/update-project-dependencies.jsView file

Lines 8-55javascript

8const updateProjectDependencies = async () => {

9 const args = getArgs();

10 if (args['--dry-run']) {

11 return true;

12 }

14 let failed = false;

15 const { removeDependencies, dependencies } = await getAdapterChoice();

17 // Remove dependencies if not also in the add dependencies list

18 const yarnRemove =

19 removeDependencies && removeDependencies.filter(dep => Boolean(!dependencies.includes(dep)));

21 // Add dependencies if not already installed

22 const newProjectDir = await getProjectDirectory();

23 const packageJSON = JSON.parse(fs.readFileSync(path.join(newProjectDir, 'package.json')));

24 const yarnAdd =

25 dependencies &&

26 dependencies.filter(dep => Boolean(!Object.keys(packageJSON.dependencies).includes(dep)));

28 if (yarnRemove && yarnRemove.length) {

29 const result = await exec(`yarn remove ${removeDependencies.join(' ')}`);

30 if (result.failed) {

High

Child Process

Package source references child process execution.

lib/update-project-dependencies.jsView on unpkg · L28

31 const result = await exec(`npm uninstall ${removeDependencies.join(' ')}`);

32 if (result.failed) {

33 failed = true;

34 }

35 }

36 }

38 if (yarnAdd && yarnAdd.length) {

39 const result = await exec(`yarn add ${dependencies.join(' ')}`);

40 if (result.failed) {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

lib/update-project-dependencies.jsView on unpkg · L38

41 const result = await exec(`npm install ${dependencies.join(' ')}`);

42 if (result.failed) {

43 failed = true;

44 }

45 }

46 }

47 if (failed) {

48 console.log('Error while installing dependencies.');

49 } else {

50 tick('Installed dependencies');

51 }

52};

54module.exports = { updateProjectDependencies };

lib/util.jsView file

Lines 1-21javascript

1const execa = require('execa');

2const slugify = require('@sindresorhus/slugify');

High

Shell

Package source references shell execution.

lib/util.jsView on unpkg · L1

3const path = require('path');

Source & flagged code

3 flagged · loading source

lib/update-project-dependencies.jsView file

28if (yarnRemove && yarnRemove.length) { L29: const result = await exec(`yarn remove ${removeDependencies.join(' ')}`); L30: if (result.failed) {

High

Child Process

Package source references child process execution.

lib/update-project-dependencies.jsView on unpkg · L28

38if (yarnAdd && yarnAdd.length) { L39: const result = await exec(`yarn add ${dependencies.join(' ')}`); L40: if (result.failed) {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

lib/update-project-dependencies.jsView on unpkg · L38

lib/util.jsView file

1const execa = require('execa'); L2: const slugify = require('@sindresorhus/slugify');

High

Shell

Package source references shell execution.

lib/util.jsView on unpkg · L1

Findings

3 High1 Medium2 Low

HighChild Processlib/update-project-dependencies.js

HighShelllib/util.js

HighRuntime Package Installlib/update-project-dependencies.js

MediumNetwork

LowFilesystem

LowUrl Strings

Source & flagged code

3 flagged

lib/update-project-dependencies.jsView file

Lines 8-55javascript

8const updateProjectDependencies = async () => {

9 const args = getArgs();

10 if (args['--dry-run']) {

11 return true;

12 }

14 let failed = false;

15 const { removeDependencies, dependencies } = await getAdapterChoice();

17 // Remove dependencies if not also in the add dependencies list

18 const yarnRemove =

19 removeDependencies && removeDependencies.filter(dep => Boolean(!dependencies.includes(dep)));

21 // Add dependencies if not already installed

22 const newProjectDir = await getProjectDirectory();

23 const packageJSON = JSON.parse(fs.readFileSync(path.join(newProjectDir, 'package.json')));

24 const yarnAdd =

25 dependencies &&

26 dependencies.filter(dep => Boolean(!Object.keys(packageJSON.dependencies).includes(dep)));

28 if (yarnRemove && yarnRemove.length) {

29 const result = await exec(`yarn remove ${removeDependencies.join(' ')}`);

30 if (result.failed) {

High

Child Process

Package source references child process execution.

lib/update-project-dependencies.jsView on unpkg · L28

31 const result = await exec(`npm uninstall ${removeDependencies.join(' ')}`);

32 if (result.failed) {

33 failed = true;

34 }

35 }

36 }

38 if (yarnAdd && yarnAdd.length) {

39 const result = await exec(`yarn add ${dependencies.join(' ')}`);

40 if (result.failed) {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

lib/update-project-dependencies.jsView on unpkg · L38

41 const result = await exec(`npm install ${dependencies.join(' ')}`);

42 if (result.failed) {

43 failed = true;

44 }

45 }

46 }

47 if (failed) {

48 console.log('Error while installing dependencies.');

49 } else {

50 tick('Installed dependencies');

51 }

52};

54module.exports = { updateProjectDependencies };

lib/util.jsView file

Lines 1-21javascript

1const execa = require('execa');

2const slugify = require('@sindresorhus/slugify');

High

Shell

Package source references shell execution.

lib/util.jsView on unpkg · L1

3const path = require('path');