registry / create-zenithcms-app / 1.0.0-beta.36

create-zenithcms-app@1.0.0-beta.36

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 16 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 1 file(s), 72.8 KB of source, external domains: console.cloud.google.com, dashboard.stripe.com, github.com, pub-xxx.r2.dev, resend.com, xxx.r2.cloudflarestorage.com, xxxxxxxxxxxxxxxxx.r2.cloudflarestorage.com, your-cms-url.com, your-idp.okta.com

Source & flagged code

7 flagged

dist/index.jsView file

Lines 1-26javascript

1#!/usr/bin/env node

2import { Command } from "commander";

3import chalk from "chalk";

4import path from "path";

5import fs from "fs";

6import crypto from "crypto";

7import { execSync } from "child_process";

8import readline from "readline";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L6

9import ora from "ora";

10const program = new Command();

11const question = (query) => {

12 const rl = readline.createInterface({ input: process.stdin, output: process.stdout });

13 return new Promise((resolve) => rl.question(query, (ans) => { rl.close(); resolve(ans.trim()); }));

14};

15program

16 .name("create-zenithcms-app")

17 .description("Bootstrap a new Zenith CMS project")

18 .argument("[directory]", "Target directory")

19 .option("-y, --yes", "Skip all prompts")

20 .option("--install", "Auto-install deps")

21 .action(async (directoryArg, options) => {

22 let targetDir = directoryArg;

23 if (!targetDir) {

24 targetDir = options.yes ? "my-zenith-cms" : await question("? Project name (my-zenith-cms): ");

25 if (!targetDir)

26 targetDir = "my-zenith-cms";

Lines 1578-1619javascript

1578import { s3StoragePlugin } from '@zenith-open/zenithcms-plugin-storage-s3'

1579

1580plugins: [

1581 s3StoragePlugin({

1582 bucket: process.env.S3_BUCKET!,

1583 region: process.env.S3_REGION!, // e.g., 'us-east-1'

1584 accessKeyId: process.env.AWS_ACCESS_KEY_ID!,

1585 secretAccessKey: process.env.AWS_SECRET_ACCESS_KEY!,

Lines 1797-1838javascript

1797

1798**Register**

1799\`\`\`typescript

1800import { stripePlugin } from '@zenith-open/zenithcms-plugin-payments-stripe'

1801

1802plugins: [

1803 stripePlugin({

1804 stripeSecretKey: process.env.STRIPE_SECRET_KEY!,

1805 stripeWebhookSecret: process.env.STRIPE_WEBHOOK_SECRET!,

1806 // Map Stripe products to CMS access roles

1807 productRoleMap: {

1808 'prod_xxxxxxxxxxxxx': 'editor',

1809 'prod_yyy': 'admin',

Lines 2040-2076javascript

2040Do NOT store uploaded images on the local disk in production! Local disk storage is ephemeral on services like Heroku, and won't work across multiple instances.

2041Instead, install a storage plugin (like \`@zenith-open/zenithcms-plugin-storage-s3\`) to upload all media directly to AWS S3, Google Cloud Storage, or Cloudinary.

2042`;

2043 fs.writeFileSync(path.join(docsDir, "AI_DEVELOPMENT.md"), AIDEVELOPMENTmdContent);

2044 fs.writeFileSync(path.join(docsDir, "API.md"), APImdContent);

Source & flagged code

7 flagged · loading source

dist/index.jsView file

1598patternName = aws_access_key severity = critical line = 1598 matchedText = AWS_ACCE...MPLE

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/index.jsView on unpkg · L1598

1598patternName = aws_access_key severity = critical line = 1598 matchedText = AWS_ACCE...MPLE

Critical

Secret Pattern

AWS access key ID in dist/index.js

dist/index.jsView on unpkg · L1598

1599patternName = aws_secret_key severity = critical line = 1599 matchedText = AWS_SECR...EKEY

Critical

Secret Pattern

AWS secret access key in dist/index.js

dist/index.jsView on unpkg · L1599

1817patternName = stripe_live_secret severity = critical line = 1817 matchedText = STRIPE_S...xxxx

Critical

Secret Pattern

Stripe live secret key in dist/index.js

dist/index.jsView on unpkg · L1817

6import crypto from "crypto"; L7: import { execSync } from "child_process"; L8: import readline from "readline";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L6

2060try { L2061: execSync("npm install --no-audit --no-fund", { stdio: "inherit", cwd: projectPath }); L2062: console.log(chalk.green('âœ” Dependencies installed successfully!\n'));

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L2060

1818patternName = stripe_webhook_secret severity = high line = 1818 matchedText = STRIPE_W...xxxx

High

Secret Pattern

Stripe webhook signing secret in dist/index.js

dist/index.jsView on unpkg · L1818

Findings

4 Critical4 High3 Medium5 Low

CriticalCritical Secretdist/index.js

CriticalSecret Patterndist/index.js

HighChild Processdist/index.js

HighShell

HighRuntime Package Installdist/index.js

HighSecret Patterndist/index.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

7 flagged

dist/index.jsView file

Lines 1-26javascript

1#!/usr/bin/env node

2import { Command } from "commander";

3import chalk from "chalk";

4import path from "path";

5import fs from "fs";

6import crypto from "crypto";

7import { execSync } from "child_process";

8import readline from "readline";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L6

9import ora from "ora";

10const program = new Command();

11const question = (query) => {

12 const rl = readline.createInterface({ input: process.stdin, output: process.stdout });

13 return new Promise((resolve) => rl.question(query, (ans) => { rl.close(); resolve(ans.trim()); }));

14};

15program

16 .name("create-zenithcms-app")

17 .description("Bootstrap a new Zenith CMS project")

18 .argument("[directory]", "Target directory")

19 .option("-y, --yes", "Skip all prompts")

20 .option("--install", "Auto-install deps")

21 .action(async (directoryArg, options) => {

22 let targetDir = directoryArg;

23 if (!targetDir) {

24 targetDir = options.yes ? "my-zenith-cms" : await question("? Project name (my-zenith-cms): ");

25 if (!targetDir)

26 targetDir = "my-zenith-cms";

Lines 1578-1619javascript

1578import { s3StoragePlugin } from '@zenith-open/zenithcms-plugin-storage-s3'

1579

1580plugins: [

1581 s3StoragePlugin({

1582 bucket: process.env.S3_BUCKET!,

1583 region: process.env.S3_REGION!, // e.g., 'us-east-1'

1584 accessKeyId: process.env.AWS_ACCESS_KEY_ID!,

1585 secretAccessKey: process.env.AWS_SECRET_ACCESS_KEY!,

Lines 1797-1838javascript

1797

1798**Register**

1799\`\`\`typescript

1800import { stripePlugin } from '@zenith-open/zenithcms-plugin-payments-stripe'

1801

1802plugins: [

1803 stripePlugin({

1804 stripeSecretKey: process.env.STRIPE_SECRET_KEY!,

1805 stripeWebhookSecret: process.env.STRIPE_WEBHOOK_SECRET!,

1806 // Map Stripe products to CMS access roles

1807 productRoleMap: {

1808 'prod_xxxxxxxxxxxxx': 'editor',

1809 'prod_yyy': 'admin',

Lines 2040-2076javascript

2040Do NOT store uploaded images on the local disk in production! Local disk storage is ephemeral on services like Heroku, and won't work across multiple instances.

2041Instead, install a storage plugin (like \`@zenith-open/zenithcms-plugin-storage-s3\`) to upload all media directly to AWS S3, Google Cloud Storage, or Cloudinary.

2042`;

2043 fs.writeFileSync(path.join(docsDir, "AI_DEVELOPMENT.md"), AIDEVELOPMENTmdContent);

2044 fs.writeFileSync(path.join(docsDir, "API.md"), APImdContent);