registry / create-zenithcms-app / 1.0.0-beta.26

create-zenithcms-app@1.0.0-beta.26

Static Scan Results

scanned 11h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 1 file(s), 23.7 KB of source, external domains: dashboard.stripe.com, pub-xxx.r2.dev, resend.com, xxx.r2.cloudflarestorage.com, your-idp.okta.com

Source & flagged code

4 flagged

dist/index.jsView file

Lines 1-26javascript

1#!/usr/bin/env node

2import { Command } from "commander";

3import chalk from "chalk";

4import path from "path";

5import fs from "fs";

6import crypto from "crypto";

7import { execSync } from "child_process";

8import readline from "readline";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L6

9import ora from "ora";

10const program = new Command();

11const question = (query) => {

12 const rl = readline.createInterface({ input: process.stdin, output: process.stdout });

13 return new Promise((resolve) => rl.question(query, (ans) => { rl.close(); resolve(ans.trim()); }));

14};

15program

16 .name("create-zenithcms-app")

17 .description("Bootstrap a new Zenith CMS project")

18 .argument("[directory]", "Target directory")

19 .option("-y, --yes", "Skip all prompts")

20 .option("--install", "Auto-install deps")

21 .action(async (directoryArg, options) => {

22 let targetDir = directoryArg;

23 if (!targetDir) {

24 targetDir = options.yes ? "my-zenith-cms" : await question("? Project name (my-zenith-cms): ");

25 if (!targetDir)

26 targetDir = "my-zenith-cms";

Lines 468-508javascript

468

469\`\`\`bash

470npm install @zenith-open/zenithcms-plugin-storage-s3

471\`\`\`

472\`\`\`typescript

473import { s3StoragePlugin } from '@zenith-open/zenithcms-plugin-storage-s3'

474plugins: [

475 s3StoragePlugin({

476 bucket: process.env.S3_BUCKET,

477 region: process.env.S3_REGION,

478 accessKeyId: process.env.AWS_ACCESS_KEY_ID,

479 secretAccessKey: process.env.AWS_SECRET_ACCESS_KEY,

480 endpoint: process.env.S3_ENDPOINT, // For R2/DO Spaces

Lines 645-681javascript

645

646Drag-and-drop content approval pipelines. Define state transitions (Draft → Review → Published) without code.

647

648\`\`\`bash

649npm install @zenith-open/zenithcms-plugin-workflows-ui

650\`\`\`

651\`\`\`typescript

652import { workflowsUIPlugin } from '@zenith-open/zenithcms-plugin-workflows-ui'

653plugins: [ workflowsUIPlugin({ collections: ['posts', 'pages', 'products'], statuses: ['draft', 'in-review', 'approved', 'published'] }) ]

654\`\`\`

655`

Source & flagged code

4 flagged · loading source

dist/index.jsView file

488patternName = aws_access_key severity = critical line = 488 matchedText = AWS_ACCE...MPLE

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/index.jsView on unpkg · L488

488patternName = aws_access_key severity = critical line = 488 matchedText = AWS_ACCE...MPLE

Critical

Secret Pattern

AWS access key ID in dist/index.js

dist/index.jsView on unpkg · L488

6import crypto from "crypto"; L7: import { execSync } from "child_process"; L8: import readline from "readline";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L6

665try { L666: execSync("npm install --no-audit --no-fund", { stdio: "inherit", cwd: projectPath }); L667: console.log(chalk.green('âœ” Dependencies installed successfully!\n'));

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L665

Findings

2 Critical3 High2 Medium5 Low

CriticalCritical Secretdist/index.js

CriticalSecret Patterndist/index.js

HighChild Processdist/index.js

HighShell

HighRuntime Package Installdist/index.js

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

4 flagged

dist/index.jsView file

Lines 1-26javascript

1#!/usr/bin/env node

2import { Command } from "commander";

3import chalk from "chalk";

4import path from "path";

5import fs from "fs";

6import crypto from "crypto";

7import { execSync } from "child_process";

8import readline from "readline";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L6

9import ora from "ora";

10const program = new Command();

11const question = (query) => {

12 const rl = readline.createInterface({ input: process.stdin, output: process.stdout });

13 return new Promise((resolve) => rl.question(query, (ans) => { rl.close(); resolve(ans.trim()); }));

14};

15program

16 .name("create-zenithcms-app")

17 .description("Bootstrap a new Zenith CMS project")

18 .argument("[directory]", "Target directory")

19 .option("-y, --yes", "Skip all prompts")

20 .option("--install", "Auto-install deps")

21 .action(async (directoryArg, options) => {

22 let targetDir = directoryArg;

23 if (!targetDir) {

24 targetDir = options.yes ? "my-zenith-cms" : await question("? Project name (my-zenith-cms): ");

25 if (!targetDir)

26 targetDir = "my-zenith-cms";

Lines 468-508javascript

468

469\`\`\`bash

470npm install @zenith-open/zenithcms-plugin-storage-s3

471\`\`\`

472\`\`\`typescript

473import { s3StoragePlugin } from '@zenith-open/zenithcms-plugin-storage-s3'

474plugins: [

475 s3StoragePlugin({

476 bucket: process.env.S3_BUCKET,

477 region: process.env.S3_REGION,

478 accessKeyId: process.env.AWS_ACCESS_KEY_ID,

479 secretAccessKey: process.env.AWS_SECRET_ACCESS_KEY,

480 endpoint: process.env.S3_ENDPOINT, // For R2/DO Spaces

Lines 645-681javascript

645

646Drag-and-drop content approval pipelines. Define state transitions (Draft → Review → Published) without code.

647

648\`\`\`bash

649npm install @zenith-open/zenithcms-plugin-workflows-ui

650\`\`\`

651\`\`\`typescript

652import { workflowsUIPlugin } from '@zenith-open/zenithcms-plugin-workflows-ui'

653plugins: [ workflowsUIPlugin({ collections: ['posts', 'pages', 'products'], statuses: ['draft', 'in-review', 'approved', 'published'] }) ]

654\`\`\`

655`