registry / create-zenithcms-app / 1.0.0-beta.16

create-zenithcms-app@1.0.0-beta.16

Static Scan Results

scanned 2d ago · by rust-scanner

Static analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStrings

Manifest

NoLicense

scanned 1 file(s), 9.90 KB of source

Source & flagged code

2 flagged

dist/index.jsView file

Lines 1-26javascript

1#!/usr/bin/env node

2import { Command } from "commander";

3import chalk from "chalk";

4import path from "path";

5import fs from "fs";

6import crypto from "crypto";

7import { execSync } from "child_process";

8import readline from "readline";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L6

9import ora from "ora";

10const program = new Command();

11const question = (query) => {

12 const rl = readline.createInterface({ input: process.stdin, output: process.stdout });

13 return new Promise((resolve) => rl.question(query, (ans) => { rl.close(); resolve(ans.trim()); }));

14};

15program

16 .name("create-zenithcms-app")

17 .description("Bootstrap a new Zenith CMS project")

18 .argument("[directory]", "Target directory")

19 .option("-y, --yes", "Skip all prompts")

20 .option("--install", "Auto-install deps")

21 .action(async (directoryArg, options) => {

22 let targetDir = directoryArg;

23 if (!targetDir) {

24 targetDir = options.yes ? "my-zenith-cms" : await question("? Project name (my-zenith-cms): ");

25 if (!targetDir)

26 targetDir = "my-zenith-cms";

Lines 200-235javascript

200 collections: [

201 ${collectionsArray}

202 ]

203})

204

205export default config

206`;

207 fs.writeFileSync(path.join(projectPath, "src/zenith.config.ts"), configTs);

208 const tsconfig = {

209 compilerOptions: { target: "ES2022", module: "CommonJS", moduleResolution: "Node", esModuleInterop: true, strict: true, skipLibCheck: true, outDir: "./dist", rootDir: "./src" },

210 include: ["src/**/*"]

211 };

Source & flagged code

2 flagged · loading source

dist/index.jsView file

6import crypto from "crypto"; L7: import { execSync } from "child_process"; L8: import readline from "readline";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L6

220try { L221: execSync("npm install --no-audit --no-fund --loglevel=error --silent", { stdio: "ignore", cwd: projectPath }); L222: installSpinner.succeed('Dependencies installed successfully!');

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L220

Findings

3 High2 Medium4 Low

HighChild Processdist/index.js

HighShell

HighRuntime Package Installdist/index.js

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowNo License

Source & flagged code

2 flagged

dist/index.jsView file

Lines 1-26javascript

1#!/usr/bin/env node

2import { Command } from "commander";

3import chalk from "chalk";

4import path from "path";

5import fs from "fs";

6import crypto from "crypto";

7import { execSync } from "child_process";

8import readline from "readline";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L6

9import ora from "ora";

10const program = new Command();

11const question = (query) => {

12 const rl = readline.createInterface({ input: process.stdin, output: process.stdout });

13 return new Promise((resolve) => rl.question(query, (ans) => { rl.close(); resolve(ans.trim()); }));

14};

15program

16 .name("create-zenithcms-app")

17 .description("Bootstrap a new Zenith CMS project")

18 .argument("[directory]", "Target directory")

19 .option("-y, --yes", "Skip all prompts")

20 .option("--install", "Auto-install deps")

21 .action(async (directoryArg, options) => {

22 let targetDir = directoryArg;

23 if (!targetDir) {

24 targetDir = options.yes ? "my-zenith-cms" : await question("? Project name (my-zenith-cms): ");

25 if (!targetDir)

26 targetDir = "my-zenith-cms";

Lines 200-235javascript

200 collections: [

201 ${collectionsArray}

202 ]

203})

204

205export default config

206`;

207 fs.writeFileSync(path.join(projectPath, "src/zenith.config.ts"), configTs);

208 const tsconfig = {

209 compilerOptions: { target: "ES2022", module: "CommonJS", moduleResolution: "Node", esModuleInterop: true, strict: true, skipLibCheck: true, outDir: "./dist", rootDir: "./src" },

210 include: ["src/**/*"]

211 };