registry / devhelp-tool / 0.2.0

devhelp-tool@0.2.0

Professional local-first developer workbench CLI

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessFilesystem

Supply chainNo supply-chain packaging signals triggered.

Manifest

NoLicense

scanned 1 file(s), 2.81 KB of source

Source & flagged code

5 flagged

bin/cli.jsView file

Lines 1-65javascript

1#!/usr/bin/env node

3const { spawn, exec, execSync } = require('child_process');

4const path = require('path');

High

Child Process

Package source references child process execution.

bin/cli.jsView on unpkg · L2

5const fs = require('fs');

7const args = process.argv.slice(2);

8const command = args[0];

9const packageDir = path.join(__dirname, '..');

10const PORT = 3000;

12// --- FUNCIÓN PARA ENCONTRAR EL PID POR PUERTO ---

13const getPidByPort = (port) => {

14 try {

15 if (process.platform === 'win32') {

16 const output = execSync(`netstat -ano | findstr :${port}`).toString();

17 const lines = output.split('\n').filter(line => line.includes('LISTENING'));

18 if (lines.length > 0) {

19 return lines[0].trim().split(/\s+/).pop();

20 }

21 } else {

22 // Mac y Linux

25 } catch (e) {

26 return null;

27 }

28};

30// --- COMANDO: START ---

31if (command === 'start') {

32 const existingPid = getPidByPort(PORT);

34 if (existingPid) {

35 console.log('\x1b[33m%s\x1b[0m', `⚠️ Port ${PORT} is already in use by PID ${existingPid}.`);

36 console.log('Maybe DevHelp is already running?');

37 process.exit(0);

38 }

40 console.log('\x1b[36m%s\x1b[0m', '🚀 STARTING DEVHELP SERVICE...');

42 const logFile = path.join(packageDir, 'devhelp.log');

43 const out = fs.openSync(logFile, 'a');

44 const err = fs.openSync(logFile, 'a');

46 const server = spawn('npx', ['next', 'start', '-p', PORT.toString()], {

47 cwd: packageDir,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/cli.jsView on unpkg · L45

48 detached: true,

49 stdio: ['ignore', out, err],

50 shell: true

51 });

53 server.unref();

55 console.log('\x1b[32m%s\x1b[0m', `✅ Workbench live at http://localhost:${PORT}`);

57 const url = `http://localhost:${PORT}`;

58 const openCmd = process.platform === 'darwin' ? `open ${url}` : process.platform === 'win32' ? `start ${url}` : `xdg-open ${url}`;

59 setTimeout(() => exec(openCmd), 2500);

60 process.exit(0);

61}

63// --- COMANDO: STOP ---

64else if (command === 'stop') {

65 const pid = getPidByPort(PORT);

.next/server/edge/chunks/node_modules_next_dist_compiled_@vercel_og_resvg_23ace1ce.wasmView file

•path = .next/server/edge/chunks/node_modules_next_dist_compiled_@vercel_og_resvg_23ace1ce.wasm kind = wasm_module sizeBytes = 1378357 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

.next/server/edge/chunks/node_modules_next_dist_compiled_@vercel_og_resvg_23ace1ce.wasmView on unpkg

.next/server/app/icon.png.bodyView file

•path = .next/server/app/icon.png.body kind = high_entropy_blob sizeBytes = 886628 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

.next/server/app/icon.png.bodyView on unpkg

•path = .next/server/app/icon.png.body kind = payload_in_excluded_dir sizeBytes = 886628 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.next/server/app/icon.png.bodyView on unpkg

Source & flagged code

5 flagged · loading source

bin/cli.jsView file

2L3: const { spawn, exec, execSync } = require('child_process'); L4: const path = require('path');

High

Child Process

Package source references child process execution.

bin/cli.jsView on unpkg · L2

45L46: const server = spawn('npx', ['next', 'start', '-p', PORT.toString()], { L47: cwd: packageDir,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/cli.jsView on unpkg · L45

.next/server/edge/chunks/node_modules_next_dist_compiled_@vercel_og_resvg_23ace1ce.wasmView file

•path = .next/server/edge/chunks/node_modules_next_dist_compiled_@vercel_og_resvg_23ace1ce.wasm kind = wasm_module sizeBytes = 1378357 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

.next/server/edge/chunks/node_modules_next_dist_compiled_@vercel_og_resvg_23ace1ce.wasmView on unpkg

.next/server/app/icon.png.bodyView file

•path = .next/server/app/icon.png.body kind = high_entropy_blob sizeBytes = 886628 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

.next/server/app/icon.png.bodyView on unpkg

•path = .next/server/app/icon.png.body kind = payload_in_excluded_dir sizeBytes = 886628 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.next/server/app/icon.png.bodyView on unpkg

Findings

4 High2 Medium3 Low

HighChild Processbin/cli.js

HighRuntime Package Installbin/cli.js

HighShips High Entropy Blob.next/server/app/icon.png.body

HighPayload In Excluded Dir.next/server/app/icon.png.body

MediumShips Wasm Module.next/server/edge/chunks/node_modules_next_dist_compiled_@vercel_og_resvg_23ace1ce.wasm

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowNo License

Source & flagged code

5 flagged

bin/cli.jsView file

Lines 1-65javascript

1#!/usr/bin/env node

3const { spawn, exec, execSync } = require('child_process');

4const path = require('path');

High

Child Process

Package source references child process execution.

bin/cli.jsView on unpkg · L2

5const fs = require('fs');

7const args = process.argv.slice(2);

8const command = args[0];

9const packageDir = path.join(__dirname, '..');

10const PORT = 3000;

12// --- FUNCIÓN PARA ENCONTRAR EL PID POR PUERTO ---

13const getPidByPort = (port) => {

14 try {

15 if (process.platform === 'win32') {

16 const output = execSync(`netstat -ano | findstr :${port}`).toString();

17 const lines = output.split('\n').filter(line => line.includes('LISTENING'));

18 if (lines.length > 0) {

19 return lines[0].trim().split(/\s+/).pop();

20 }

21 } else {

22 // Mac y Linux

25 } catch (e) {

26 return null;

27 }

28};

30// --- COMANDO: START ---

31if (command === 'start') {

32 const existingPid = getPidByPort(PORT);

34 if (existingPid) {

35 console.log('\x1b[33m%s\x1b[0m', `⚠️ Port ${PORT} is already in use by PID ${existingPid}.`);

36 console.log('Maybe DevHelp is already running?');

37 process.exit(0);

38 }

40 console.log('\x1b[36m%s\x1b[0m', '🚀 STARTING DEVHELP SERVICE...');

42 const logFile = path.join(packageDir, 'devhelp.log');

43 const out = fs.openSync(logFile, 'a');

44 const err = fs.openSync(logFile, 'a');

46 const server = spawn('npx', ['next', 'start', '-p', PORT.toString()], {

47 cwd: packageDir,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/cli.jsView on unpkg · L45

48 detached: true,

49 stdio: ['ignore', out, err],

50 shell: true

51 });

53 server.unref();

55 console.log('\x1b[32m%s\x1b[0m', `✅ Workbench live at http://localhost:${PORT}`);

57 const url = `http://localhost:${PORT}`;

58 const openCmd = process.platform === 'darwin' ? `open ${url}` : process.platform === 'win32' ? `start ${url}` : `xdg-open ${url}`;

59 setTimeout(() => exec(openCmd), 2500);

60 process.exit(0);

61}

63// --- COMANDO: STOP ---

64else if (command === 'stop') {

65 const pid = getPidByPort(PORT);

.next/server/edge/chunks/node_modules_next_dist_compiled_@vercel_og_resvg_23ace1ce.wasmView file

•path = .next/server/edge/chunks/node_modules_next_dist_compiled_@vercel_og_resvg_23ace1ce.wasm kind = wasm_module sizeBytes = 1378357 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

.next/server/edge/chunks/node_modules_next_dist_compiled_@vercel_og_resvg_23ace1ce.wasmView on unpkg

.next/server/app/icon.png.bodyView file

•path = .next/server/app/icon.png.body kind = high_entropy_blob sizeBytes = 886628 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

.next/server/app/icon.png.bodyView on unpkg

•path = .next/server/app/icon.png.body kind = payload_in_excluded_dir sizeBytes = 886628 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.next/server/app/icon.png.bodyView on unpkg