registry / create-spectrum-project / 0.8.0

create-spectrum-project@0.8.0

Scaffold a new Spectrum (spectrum-ts) project in seconds.

Static Scan Results

scanned 4h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

WildcardDependency

scanned 2 file(s), 124 KB of source, external domains: app.photon.codes, photon.codes, registry.npmjs.org, t.me, unpkg.com

Source & flagged code

4 flagged

dist/bin.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import{createRequire as M7}from"node:module";var H7=Object.create;var{getPrototypeOf:U7,defineProperty:I0,getOwnPropertyNames:Y7}=Object;var C7=Object.prototype.hasOwnProperty;function W7($){return this[$]}var D7,K7,u1=($,Z,J)=>{var z=$!=null&&typeof $==="object";if(z){var B=Z?D7??=new WeakMap:K7??=new WeakMap,X=B.get($);if(X)return X}J=$!=null?H7(U7($)):{};let Q=Z||!$||!$.__esModule?I0(J,"default",{value:$,enumerable:!0}):J;for(let H of Y7($))if(!C7.call(Q,H))I0(Q,H,{get:W7.bind($,H),enumerable:!0});if(z)B.set($,Q);return Q};var C=($,Z)=>()=>(Z||$((Z={exports:{}}).exports,Z),Z.exports);var o= ...

3In order to be iterable, non-array objects must have a [Symbol.iterator]() method.`)}var X=!0,Q=!1,H;return{s:function(){J=J.call($)},n:function(){var Y=J.next();return X=Y.done,Y},e:function(Y){Q=!0,H=Y},f:function(){try{if(!X&&J.return!=null)J.return()}finally{if(Q)throw H}}}}function P7($,Z){if(!$)return;if(typeof $==="string")return y0($,Z);var J=Object.prototype.toString.call($).slice(8,-1);if(J==="Object"&&$.constructor)J=$.constructor.name;if(J==="Map"||J==="Set")return Array.from($);if(J==="Arguments"||/^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(J))return y0($,Z)}function y0($,Z){i ...

4`)).join(`

5`)}});var s0=C((i8,t0)=>{t0.exports=($,Z,J)=>{J=J||Z;let z=Math.min(Z-J,$-Math.floor(J/2));if(z<0)z

6`),this.close()}validate(){var $=this;return z9(function*(){let Z=yield $.validator($.value);if(typeof Z==="string")$.errorMsg=Z,Z=!1;$.error=!Z})()}submit(){var $=this;return z9(function*(){if($.value=$.value||$.initial,$.cursorOffset=0,$.cursor=$.rendered.length,yield $.validate(),$.error){$.red=!0,$.fire(),$.render();return}$.done=!0,$.aborted=!1,$.fire(),$.render(),$.out.write(`

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/bin.jsView on unpkg · L1

7`),$.close()})()}next(){if(!this.placeholder)return this.bell();this.value=this.initial,this.cursor=this.rendered.length,this.fire(),this.render()}moveCursor($){if(this.placeholder)return;this.cursor=this.cursor+$,this.cursorOffset+=$}_($,Z){let J=this.value.slice(0,this.cursor),z=this.value.slice(this.cursor);this.value=`${J}${$}${z}`,this.red=!1,this.cursor=this.placeholder?0:J.length+1,this.render()}delete(){if(this.isCursorAtStart())return this.bell();let $=this.value.slice(0,this.cursor-1),Z=this.value.slice(this.cursor);if(this.value=`${$}${Z}`,this.red=!1,this.isCursorAtStart())this.cur ...

8`).reduce(($,Z,J)=>$+`

9${J?" ":s7.pointerSmall} ${q1.red().italic(Z)}`,"");this.out.write(a7.line+B1.to(0)+this.outputText+B1.save+this.outputError+B1.restore+B1.move(this.cursorOffset,0

10`),this.close()}submit(){if(!this.selection.disabled)this.done=!0,this.aborted=!1,this.fire(),this.render(),this.out.write(`

11`),this.close();else this.bell()}first(){this.moveCursor(0),this.render()}last(){this.moveCursor(this.choices.length-1),this.render()}up(){if(this.cursor===0)this.moveCursor(this.choices.length-1);else this.moveCursor(this.cursor-1);this.render()}down(){if(this.cursor===this.choices.length-1)this.moveCursor(0);else this.moveCursor(this.cursor+1);this.render()}next(){this.moveCursor((this.cursor+1)%this.choices.length),this.render()}_($,Z){if($===" ")return this.submit()}get selection(){return this.choices[this.cursor]}render(){if(this.closed)return;if(this.firstRender)this.out.write(ZZ.hide);e ...

12`;for(let z=Z;z<J;z++){let B,X,Q="",H=this.choices[z];if(z===Z&&Z>0)X=L1.arrowUp;else if(z===J-1&&J<this.choices.length)X=L1.arrowDown;else X

13`+r7(H.description,{margin:3,width:this.out.columns})}this.outputText+=`${X} ${B}${f.gray(Q)}

14`}}this.out.write(this.outputText)}}W9.exports=C9});var N9=C((o8,A9)=>{var I1=V(),JZ=_(),G9=I(),K9=G9.style,zZ=G9.clear,F9=A(),M9=

15`),this.close()}submit(){this.done=!0,this.aborted=!1,this.fire(),this.render(),this.out.write(`

16`),this.close()}deactivate(){if(this.value===!1)return this.bell();this.value=!1,this.render()}activate(){if(this.value===!0)return this.bell();this.value=!0,this

17`),this.close()}validate(){var $=this;return a9(function*(){let Z=yield $.validator($.value);if(typeof Z==="string")$.errorMsg=Z,Z=!1;$.error=!Z})()}submit(){var $=this;return a9(function*(){if(yield $.validate(),$.error){$.color="red",$.fire(),$.render();return}$.done=!0,$.aborted=!1,$.fire(),$.render(),$.out.write(`

18`),$.close()})()}up(){this.typed="",this.parts[this.cursor].up(),this.render()}down(){this.typed="",this.parts[this.cursor].down(),this.render()}left(){let $=this.parts[this.cursor].prev();if($==null)return this.bell();this.moveCursor(this.parts.indexOf($)),this.render()}right(){let $=this.parts[this.cursor].next();if($==null)return this.bell();this.moveCursor(this.parts.indexOf($)),this.render()}next(){let $=this.parts[this.cursor].next();this.moveCursor($?this.parts.indexOf($):this.parts.findIndex((Z)=>Z instanceof r9)),this.render()}_($){if(/\d/.test($))this.typed+=$,this.parts[this.cursor] ...

19`).reduce(($,Z,J)=>$+`

20${J?" ":GZ.pointerSmall} ${o1.red().italic(Z)}`,"");this.out.write(FZ.line+o9.to(0)+this.outputText)}}J2.exports=Z2});var W2=C((YJ,C2)

21`),this.close()}validate(){var $=this;return X2(function*(){let Z=yield $.validator($.value);if(typeof Z==="string")$.errorMsg=Z,Z=!1;$.error=!Z})()}submit(){var $=this;return X2(function*(){if(yield $.validate(),$.error){$.color="red",$.fire(),$.render();return}let Z=$.value;$.value=Z!==""?Z:$.initial,$.done=!0,$.aborted=!1,$.error=!1,$.fire(),$.render(),$.out.write(`

Long lines were clipped for display.

Lines 65-117javascript

65`),this.close()}async validate(){let $=await this.validator(this.value);if(typeof $==="string")this.errorMsg=$,$=!1;this.error=!$}async submit(){if(await this.validate(),this.error){this.color="red",this.fire(),this.render();return}this.done=!0,this.aborted=!1,this.fire(),this.render(),this.out.write(`

66`),this.close()}up(){this.typed="",this.parts[this.cursor].up(),this.render()}down(){this.typed="",this.parts[this.cursor].down(),this.render()}left(){let $=this.parts[this.cursor].prev();if($==null)return this.bell();this.moveCursor(this.parts.indexOf($)),this.render()}right(){let $=this.parts[this.cursor].next();if($==null)return this.bell();this.moveCursor(this.parts.indexOf($)),this.render()}next(){let $=this.parts[this.cursor].next();this.moveCursor($?this.parts.indexOf($):this.parts.findIndex((Z)=>Z instanceof z$)),this.render()}_($){if(/\d/.test($))this.typed+=$,this.parts[this.cursor]. ...

67`).reduce(($,Z,J)=>$+`

68${J?" ":u5.pointerSmall} ${

Source & flagged code

4 flagged · loading source

dist/bin.jsView file

High

Child Process

Package source references child process execution.

dist/bin.jsView on unpkg · L97

97`),this.close()}submit(){this.value=this.value||!1,this.done=!0,this.aborted=!1,this.fire(),this.render(),this.out.write(` L98: `),this.close()}_($,Z){if($.toLowerCase()==="y")return this.value=!0,this.submit();if($.toLowerCase()==="n")return this.value=!1,this.submit();return this.bell()}render(){if(this.c... L99: `),warn:($)=>process.stderr.write(`warn: ${$} L100: `)};function O7($,Z){return new Promise((J,z)=>{let B=A7("gh",$,{stdio:Z?["ignore","pipe","pipe"]:"inherit"}),X="";if(Z)B.stdout?.setEncoding("utf8"),B.stdout?.on("data",(Q)=>{X+=Q... L101: `),M=[];if(z)M.push(" projectId: process.env.PROJECT_ID!,"),M.push(" projectSecret: process.env.PROJECT_SECRET!,");M.push(" providers: ["),M.push(...Q),M.push(" ],");let N=z?["...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/bin.jsView on unpkg · L97

85`),this.close()}_($,Z){let J=this.input.slice(0,this.cursor),z=this.input.slice(this.cursor);this.input=`${J}${$}${z}`,this.cursor=J.length+1,this.complete(this.render),this.render... L86: `+C6($.description,{margin:3,width:this.out.columns})}return X+" "+Q+D1.gray(B||"")}render(){if(this.closed)return;if(this.firstRender)this.out.write(V$.hide);else this.out.write(A... L87: `);this.outputText+=` ... L97: `),this.close()}submit(){this.value=this.value||!1,this.done=!0,this.aborted=!1,this.fire(),this.render(),this.out.write(` L98: `),this.close()}_($,Z){if($.toLowerCase()==="y")return this.value=!0,this.submit();if($.toLowerCase()==="n")return this.value=!1,this.submit();return this.bell()}render(){if(this.c... L99: `),warn:($)=>process.stderr.write(`warn: ${$} L100: `)};function O7($,Z){return new Promise((J,z)=>{let B=A7("gh",$,{stdio:Z?["ignore","pipe","pipe"]:"inherit"}),X="";if(Z)B.stdout?.setEncoding("utf8"),B.stdout?.on("data",(Q)=>{X+=Q... L101: `),M=[];if(z)M.push(" projectId: process.env.PROJECT_ID!,"),M.push(" projectSecret: process.env.PROJECT_SECRET!,");M.push(" providers: ["),M.push(...Q),M.push(" ],");let N=z?["...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/bin.jsView on unpkg · L85

1#!/usr/bin/env node L2: import{createRequire as M7}from"node:module";var H7=Object.create;var{getPrototypeOf:U7,defineProperty:I0,getOwnPropertyNames:Y7}=Object;var C7=Object.prototype.hasOwnProperty;func... L3: In order to be iterable, non-array objects must have a [Symbol.iterator]() method.`)}var X=!0,Q=!1,H;return{s:function(){J=J.call($)},n:function(){var Y=J.next();return X=Y.done,Y}... L4: `)).join(` L5: `)}});var s0=C((i8,t0)=>{t0.exports=($,Z,J)=>{J=J||Z;let z=Math.min(Z-J,$-Math.floor(J/2));if(z<0)z=0;let B=Math.min(z+J,Z);return{startIndex:z,endIndex:B}}});var I=C((p8,o0)=>{o0.... L6: `),this.close()}validate(){var $=this;return z9(function*(){let Z=yield $.validator($.value);if(typeof Z==="string")$.errorMsg=Z,Z=!1;$.error=!Z})()}submit(){var $=this;return z9(f... ... L49: `),this.close()}submit(){this.value=this.value||!1,this.done=!0,this.aborted=!1,this.fire(),this.render(),this.out.write(` L50: `),this.close()}_($,Z){if($.toLowerCase()==="y")return this.value=!0,this.submit();if($.toLowerCase()==="n")return this.value=!1,this.submit();return this.bell()}render(){if(this.c... L51: In order to be iterable, non-array objects must have a [Symbol.iterator]() method.`

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/bin.jsView on unpkg · L1

Findings

5 High4 Medium4 Low

HighChild Processdist/bin.js

HighShell

HighSame File Env Network Executiondist/bin.js

HighCommand Output Exfiltrationdist/bin.js

HighSandbox Evasion Gated Capabilitydist/bin.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumWildcard Dependency

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

dist/bin.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

4`)).join(`

5`)}});var s0=C((i8,t0)=>{t0.exports=($,Z,J)=>{J=J||Z;let z=Math.min(Z-J,$-Math.floor(J/2));if(z<0)z

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/bin.jsView on unpkg · L1

8`).reduce(($,Z,J)=>$+`

9${J?" ":s7.pointerSmall} ${q1.red().italic(Z)}`,"");this.out.write(a7.line+B1.to(0)+this.outputText+B1.save+this.outputError+B1.restore+B1.move(this.cursorOffset,0

10`),this.close()}submit(){if(!this.selection.disabled)this.done=!0,this.aborted=!1,this.fire(),this.render(),this.out.write(`

12`;for(let z=Z;z<J;z++){let B,X,Q="",H=this.choices[z];if(z===Z&&Z>0)X=L1.arrowUp;else if(z===J-1&&J<this.choices.length)X=L1.arrowDown;else X

13`+r7(H.description,{margin:3,width:this.out.columns})}this.outputText+=`${X} ${B}${f.gray(Q)}

14`}}this.out.write(this.outputText)}}W9.exports=C9});var N9=C((o8,A9)=>{var I1=V(),JZ=_(),G9=I(),K9=G9.style,zZ=G9.clear,F9=A(),M9=

15`),this.close()}submit(){this.done=!0,this.aborted=!1,this.fire(),this.render(),this.out.write(`

16`),this.close()}deactivate(){if(this.value===!1)return this.bell();this.value=!1,this.render()}activate(){if(this.value===!0)return this.bell();this.value=!0,this

19`).reduce(($,Z,J)=>$+`

20${J?" ":GZ.pointerSmall} ${o1.red().italic(Z)}`,"");this.out.write(FZ.line+o9.to(0)+this.outputText)}}J2.exports=Z2});var W2=C((YJ,C2)

Long lines were clipped for display.

Lines 65-117javascript

67`).reduce(($,Z,J)=>$+`

68${J?" ":u5.pointerSmall} ${