registry / create-vibecoding-kit / 0.3.1

create-vibecoding-kit@0.3.1

Générateur d'environnement de dev IA pour débutants (Cursor, Claude Code, Codex) — une commande, zéro dépendance.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 82 file(s), 158 KB of source, external domains: 127.0.0.1, better-auth.com, convex.link, docs.expo.dev, github.com, mcp.better-auth.com, mcp.expo.dev, mcp.posthog.com, mcp.resend.com, mcp.sentry.dev, mcp.stripe.com, raw.githubusercontent.com, reactnative.dev, stitch.googleapis.com, stitch.withgoogle.com, tanstack.com, www.electronjs.org, x.sh

Source & flagged code

4 flagged

scripts/lib/external.mjsView file

Lines 1-21javascript

1// scripts/lib/external.mjs

2import { execFileSync } from 'node:child_process';

3import fs from 'node:fs';

4import path from 'node:path';

5import { copyIfAbsent } from './fsops.mjs';

7// Windows : `npx` est un script .cmd — depuis Node 20.12 (correctif CVE-2024-27980), execFileSync

8// exige le nom exact `npx.cmd` ET `shell: true` pour le lancer (sinon ENOENT/EINVAL).

9// `git` est un vrai .exe : inchangé sur toutes les plateformes.

10export function buildRunCommand(cmd, platform = process.platform) {

11 if (platform === 'win32' && cmd === 'npx') return { cmd: 'npx.cmd', options: { shell: true } };

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

scripts/lib/external.mjsView on unpkg · L1

12 return { cmd, options: {} };

13}

15const defaultRun = (cmd, args, opts = {}) => {

16 const rc = buildRunCommand(cmd);

17 return execFileSync(rc.cmd, args, { stdio: 'inherit', ...rc.options, ...opts });

18};

20export function cloneRepo(repo, dest, run = defaultRun) {

21 run('git', ['clone', '--depth', '1', repo, dest]);

•matchType = previous_version_dangerous_delta matchedPackage = create-vibecoding-kit@0.3.0 matchedIdentity = npm:Y3JlYXRlLXZpYmVjb2Rpbmcta2l0:0.3.0 similarity = 0.963 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

scripts/lib/external.mjsView on unpkg

scripts/download-ai-context.shView file

•path = scripts/download-ai-context.sh kind = build_helper sizeBytes = 2581 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/download-ai-context.shView on unpkg

scripts/lib/pre-commit-secrets.test.mjsView file

Lines 2-42javascript

2import assert from 'node:assert/strict';

3import fs from 'node:fs';

5// La regex vit dans le template bash : on l'extrait telle quelle et on la rejoue en JS

6// (le motif n'utilise que le sous-ensemble ERE compatible RegExp : alternation, classes, {n,}).

7const src = fs.readFileSync(new URL('../../templates/hooks/pre-commit'

Source & flagged code

4 flagged · loading source

scripts/lib/external.mjsView file

1// scripts/lib/external.mjs L2: import { execFileSync } from 'node:child_process'; L3: import fs from 'node:fs'; ... L9: // `git` est un vrai .exe : inchangé sur toutes les plateformes. L10: export function buildRunCommand(cmd, platform = process.platform) { L11: if (platform === 'win32' && cmd === 'npx') return { cmd: 'npx.cmd', options: { shell: true } }; ... L35: export function installCaveman(run = defaultRun) { L36: run('bash', ['-lc', 'curl -fsSL https://raw.githubusercontent.[redacted].sh | bash']); L37: }

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

scripts/lib/external.mjsView on unpkg · L1

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

scripts/lib/external.mjsView on unpkg

scripts/download-ai-context.shView file

•path = scripts/download-ai-context.sh kind = build_helper sizeBytes = 2581 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/download-ai-context.shView on unpkg

scripts/lib/pre-commit-secrets.test.mjsView file

22patternName = private_key_rsa severity = critical line = 22 matchedText = '-----BE...--',

Critical

Secret Pattern

RSA private key in scripts/lib/pre-commit-secrets.test.mjs

scripts/lib/pre-commit-secrets.test.mjsView on unpkg · L22

Findings

1 Critical2 High3 Medium4 Low

CriticalSecret Patternscripts/lib/pre-commit-secrets.test.mjs

HighSandbox Evasion Gated Capabilityscripts/lib/external.mjs

HighPrevious Version Dangerous Deltascripts/lib/external.mjs

MediumEnvironment Vars

MediumShips Build Helperscripts/download-ai-context.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

scripts/lib/external.mjsView file

Lines 1-21javascript

1// scripts/lib/external.mjs

2import { execFileSync } from 'node:child_process';

3import fs from 'node:fs';

4import path from 'node:path';

5import { copyIfAbsent } from './fsops.mjs';

7// Windows : `npx` est un script .cmd — depuis Node 20.12 (correctif CVE-2024-27980), execFileSync

8// exige le nom exact `npx.cmd` ET `shell: true` pour le lancer (sinon ENOENT/EINVAL).

9// `git` est un vrai .exe : inchangé sur toutes les plateformes.

10export function buildRunCommand(cmd, platform = process.platform) {

11 if (platform === 'win32' && cmd === 'npx') return { cmd: 'npx.cmd', options: { shell: true } };

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

scripts/lib/external.mjsView on unpkg · L1

12 return { cmd, options: {} };

13}

15const defaultRun = (cmd, args, opts = {}) => {

16 const rc = buildRunCommand(cmd);

17 return execFileSync(rc.cmd, args, { stdio: 'inherit', ...rc.options, ...opts });

18};

20export function cloneRepo(repo, dest, run = defaultRun) {

21 run('git', ['clone', '--depth', '1', repo, dest]);

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

scripts/lib/external.mjsView on unpkg

scripts/download-ai-context.shView file

•path = scripts/download-ai-context.sh kind = build_helper sizeBytes = 2581 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/download-ai-context.shView on unpkg

scripts/lib/pre-commit-secrets.test.mjsView file

Lines 2-42javascript

2import assert from 'node:assert/strict';

3import fs from 'node:fs';

5// La regex vit dans le template bash : on l'extrait telle quelle et on la rejoue en JS

6// (le motif n'utilise que le sous-ensemble ERE compatible RegExp : alternation, classes, {n,}).

7const src = fs.readFileSync(new URL('../../templates/hooks/pre-commit'