registry / create-zenithcms-app / 1.0.0-beta.15

create-zenithcms-app@1.0.0-beta.15

Static Scan Results

scanned 2d ago · by rust-scanner

Static analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStrings

Manifest

NoLicense

scanned 1 file(s), 10.8 KB of source

Source & flagged code

2 flagged

dist/index.jsView file

Lines 1-26javascript

1#!/usr/bin/env node

2import { Command } from "commander";

3import chalk from "chalk";

4import path from "path";

5import fs from "fs";

6import crypto from "crypto";

7import { execSync } from "child_process";

8import readline from "readline";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L6

9import ora from "ora";

10const program = new Command();

11const question = (query) => {

12 const rl = readline.createInterface({ input: process.stdin, output: process.stdout });

13 return new Promise((resolve) => rl.question(query, (ans) => { rl.close(); resolve(ans.trim()); }));

14};

15program

16 .name("create-zenithcms-app")

17 .description("Bootstrap a new Zenith CMS project")

18 .argument("[directory]", "Target directory")

19 .option("-y, --yes", "Skip all prompts")

20 .option("--install", "Auto-install deps")

21 .action(async (directoryArg, options) => {

22 let targetDir = directoryArg;

23 if (!targetDir) {

24 targetDir = options.yes ? "my-zenith-cms" : await question("? Project name (my-zenith-cms): ");

25 if (!targetDir)

26 targetDir = "my-zenith-cms";

Lines 224-259javascript

224 collections: [

225 ${collectionsArray}

226 ]

227})

228

229export default config

230`;

231 fs.writeFileSync(path.join(projectPath, "src/zenith.config.ts"), configTs);

232 const tsconfig = {

233 compilerOptions: { target: "ES2022", module: "CommonJS", moduleResolution: "Node", esModuleInterop: true, strict: true, skipLibCheck: true, outDir: "./dist", rootDir: "./src" },

234 include: ["src/**/*"]

235 };

Source & flagged code

2 flagged · loading source

dist/index.jsView file

6import crypto from "crypto"; L7: import { execSync } from "child_process"; L8: import readline from "readline";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L6

244try { L245: execSync("npm install --no-audit --no-fund --loglevel=error --silent", { stdio: "ignore", cwd: projectPath }); L246: installSpinner.succeed('Dependencies installed successfully!');

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L244

Findings

3 High2 Medium4 Low

HighChild Processdist/index.js

HighShell

HighRuntime Package Installdist/index.js

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowNo License

Source & flagged code

2 flagged

dist/index.jsView file

Lines 1-26javascript

1#!/usr/bin/env node

2import { Command } from "commander";

3import chalk from "chalk";

4import path from "path";

5import fs from "fs";

6import crypto from "crypto";

7import { execSync } from "child_process";

8import readline from "readline";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L6

9import ora from "ora";

10const program = new Command();

11const question = (query) => {

12 const rl = readline.createInterface({ input: process.stdin, output: process.stdout });

13 return new Promise((resolve) => rl.question(query, (ans) => { rl.close(); resolve(ans.trim()); }));

14};

15program

16 .name("create-zenithcms-app")

17 .description("Bootstrap a new Zenith CMS project")

18 .argument("[directory]", "Target directory")

19 .option("-y, --yes", "Skip all prompts")

20 .option("--install", "Auto-install deps")

21 .action(async (directoryArg, options) => {

22 let targetDir = directoryArg;

23 if (!targetDir) {

24 targetDir = options.yes ? "my-zenith-cms" : await question("? Project name (my-zenith-cms): ");

25 if (!targetDir)

26 targetDir = "my-zenith-cms";

Lines 224-259javascript

224 collections: [

225 ${collectionsArray}

226 ]

227})

228

229export default config

230`;

231 fs.writeFileSync(path.join(projectPath, "src/zenith.config.ts"), configTs);

232 const tsconfig = {

233 compilerOptions: { target: "ES2022", module: "CommonJS", moduleResolution: "Node", esModuleInterop: true, strict: true, skipLibCheck: true, outDir: "./dist", rootDir: "./src" },

234 include: ["src/**/*"]

235 };