dasyl@2.1.1
⚠ Under reviewDasyl is a fast, opinionated CLI for creating, configuring, and releasing modern development projects in seconds.
Static Scan Results
scanned 2mo ago · by rust-scannerStatic analysis completed at 72.0% confidence. No malicious behavior was detected; 11 low-signal pattern(s) were surfaced and cleared.
Static reason
One or more suspicious static signals were detected.
Decision evidence
public snapshotBehavioral surface
ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
4 flaggedbin/index.jsView file
19import { handleCreate } from '../lib/commands/create.js';
L20: import { spawn } from 'child_process';
L21:
High
6import { checkForUpdates, handleAutoUpdateSetting } from '../lib/update-checker.js';
L7: import shell from 'shelljs';
L8: import boxen from 'boxen';
High
lib/node-generator.jsView file
155packageJson.scripts['db:sync'] = useTypeScript
L156: ? "ts-node -e 'import(\"./src/config/database\").then(m => m.sequelize.sync({ alter: true }))'"
L157: : (isESM
Medium
Dynamic Require
Package source references dynamic require/import behavior.
lib/node-generator.jsView on unpkg · L155Findings
3 High4 Medium4 Low
HighChild Processbin/index.js
HighShellbin/index.js
HighRuntime Package Installlib/nest-generator.js
MediumDynamic Requirelib/node-generator.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to dasyl@2.1.1.
See all versions of dasyl for other recorded verdicts.
- Review the evidence and your use of dasyl@2.1.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.