registry / create-zhin-app / 1.0.55

create-zhin-app@1.0.55

Create a new zhin bot project

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 9 file(s), 69.4 KB of source, external domains: 127.0.0.1, console.zhin.dev, github.com, nssm.cc, pnpm.io, schemas.microsoft.com, www.apple.com, zhin.js.org

Source & flagged code

3 flagged

lib/install.jsView file

Lines 1-32javascript

1import { execSync } from 'node:child_process';

2import chalk from 'chalk';

High

Child Process

Package source references child process execution.

lib/install.jsView on unpkg · L1

3import path from 'path';

4export async function ensurePnpmInstalled() {

5 try {

6 execSync('pnpm --version', { stdio: 'ignore' });

7 console.log(chalk.green('✓ 检测到 pnpm 已安装'));

8 }

9 catch (error) {

10 console.log(chalk.yellow('⚠ 未检测到 pnpm，正在自动安装...'));

11 try {

12 console.log(chalk.blue('正在执行: npm install -g pnpm'));

13 execSync('npm install -g pnpm', { stdio: 'inherit' });

14 console.log(chalk.green('✓ pnpm 安装成功！'));

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

lib/install.jsView on unpkg · L12

15 }

16 catch (installError) {

17 const errorMessage = installError instanceof Error ? installError.message : String(installError);

18 console.error(chalk.red('✗ pnpm 安装失败，请手动安装:'));

19 if (process.env.DEBUG) {

20 console.error(chalk.gray(`错误详情: ${errorMessage}`));

21 }

22 console.log(chalk.cyan(' npm install -g pnpm'));

23 console.log(chalk.gray('或访问: https://pnpm.io/installation'));

24 process.exit(1);

25 }

26 }

27}

28export async function installDependencies(projectPath) {

29 try {

30 console.log(chalk.gray('执行: pnpm install'));

31 execSync('pnpm install', {

32 cwd: projectPath,

lib/workspace.jsView file

Lines 1-26javascript

1import fs from 'fs-extra';

2import path from 'path';

3import { fileURLToPath } from 'url';

4import { DATABASE_PACKAGES, generateAdapterEnvVars, generateAIEnvVars, getAdapterDependencies, getAIDependencies, getCreateBotBaseDependencies, DEFAULT_CREATE_BOT_HTTP_PORT, CREATE_BOT_NPMRC, getCreateBotPnpmConfig, } from '@zhin.js/scaffold-wizard';

5import { createConfigFile, generateDatabaseEnvVars } from './config.js'

Source & flagged code

3 flagged · loading source

lib/install.jsView file

1import { execSync } from 'node:child_process'; L2: import chalk from 'chalk';

High

Child Process

Package source references child process execution.

lib/install.jsView on unpkg · L1

12console.log(chalk.blue('正在执行: npm install -g pnpm')); L13: execSync('npm install -g pnpm', { stdio: 'inherit' }); L14: console.log(chalk.green('✓ pnpm 安装成功！'));

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

lib/install.jsView on unpkg · L12

lib/workspace.jsView file

6import { SOUL_MD_TEMPLATE, TOOLS_MD_TEMPLATE, AGENTS_MD_TEMPLATE, ASSISTANT_PROFILE_YML_EXAMPLE } from './templates/bootstrap.js'; L7: const __dirname = path.dirname(fileURLToPath(import.meta.url)); L8: export const BASE_SKILL_NAMES = ['skill-creator', 'summarize', 'github']; ... L61: const aiDeps = getAIDependencies(options.ai); L62: // 创建根 package.json（与 test-bot 结构一致） L63: await fs.writeJson(path.join(projectPath, 'package.json'), { ... L188: <key>StandardOutPath</key> L189: <string>${path.resolve(projectPath, 'logs/launchd-stdout.log')}</string> L190: ... L198: `); L199: // 创建 Windows NSSM 安装脚本（PowerShell） L200: await fs.writeFile(path.join(projectPath, 'install-service.ps1'), `# Windows 服务安装脚本（使用 NSSM）

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

lib/workspace.jsView on unpkg · L6

Findings

3 High3 Medium4 Low

HighChild Processlib/install.js

HighShell

HighRuntime Package Installlib/install.js

MediumEnvironment Vars

MediumInstall Persistencelib/workspace.js

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

lib/install.jsView file

Lines 1-32javascript

1import { execSync } from 'node:child_process';

2import chalk from 'chalk';

High

Child Process

Package source references child process execution.

lib/install.jsView on unpkg · L1

3import path from 'path';

4export async function ensurePnpmInstalled() {

5 try {

6 execSync('pnpm --version', { stdio: 'ignore' });

7 console.log(chalk.green('✓ 检测到 pnpm 已安装'));

8 }

9 catch (error) {

10 console.log(chalk.yellow('⚠ 未检测到 pnpm，正在自动安装...'));

11 try {

12 console.log(chalk.blue('正在执行: npm install -g pnpm'));

13 execSync('npm install -g pnpm', { stdio: 'inherit' });

14 console.log(chalk.green('✓ pnpm 安装成功！'));

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

lib/install.jsView on unpkg · L12

15 }

16 catch (installError) {

17 const errorMessage = installError instanceof Error ? installError.message : String(installError);

18 console.error(chalk.red('✗ pnpm 安装失败，请手动安装:'));

19 if (process.env.DEBUG) {

20 console.error(chalk.gray(`错误详情: ${errorMessage}`));

21 }

22 console.log(chalk.cyan(' npm install -g pnpm'));

23 console.log(chalk.gray('或访问: https://pnpm.io/installation'));

24 process.exit(1);

25 }

26 }

27}

28export async function installDependencies(projectPath) {

29 try {

30 console.log(chalk.gray('执行: pnpm install'));

31 execSync('pnpm install', {

32 cwd: projectPath,

lib/workspace.jsView file

Lines 1-26javascript

1import fs from 'fs-extra';

2import path from 'path';

3import { fileURLToPath } from 'url';

5import { createConfigFile, generateDatabaseEnvVars } from './config.js'