registry / form-builder-nextjs / 0.1.1

form-builder-nextjs@0.1.1

One-command installer: copies the Form Builder engine + fields + shadcn primitives + theme into a consumer project as a single self-contained, editable form-builder/ folder. See docs/adr/0003-packaging-split-distribution.md.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 77 file(s), 353 KB of source, external domains: base.invalid

Source & flagged code

4 flagged

src/install.mjsView file

Lines 1-22javascript

1import fs from "node:fs";

2import path from "node:path";

3import { spawnSync } from "node:child_process";

4import { planInstall } from "./plan.mjs";

High

Child Process

Package source references child process execution.

src/install.mjsView on unpkg · L2

5import { copyAndRewrite } from "./rewrite.mjs";

6import { detectBaseDir } from "./detect.mjs";

7import { injectThemeCss } from "./theme.mjs";

8import { loadSource } from "./source.mjs";

10/** Maps one resolved item name to its {sourceAbs, rel} file list — `rel` is the path under `<base>/form-builder/` the file lands at. `srcDirs` comes from source.mjs's loadSource() (vendored or local monorepo, resolved by the caller). */

11export function resolveItemFiles(itemName, model, { formBuilderSrcDir, uiSrcDir }) {

12 if (itemName === "form-engine") {

13 return [...model.engine.filesRel].map((rel) => ({ sourceAbs: path.join(formBuilderSrcDir, rel), rel }));

14 }

15 if (itemName === "form-builder") {

16 return [{ sourceAbs: path.join(formBuilderSrcDir, "fields", "index.ts"), rel: "fields/index.ts" }];

17 }

18 if (itemName === "fb-theme") return []; // cssVars only, no files — see theme.mjs

19 if (itemName.startsWith("fb-ui-")) {

20 const name = itemName.slice("fb-ui-".length);

21 return [{ sourceAbs: path.join(uiSrcDir, `${name}.tsx`), rel: `components/ui/${name}.tsx` }];

22 }

Lines 46-86javascript

46 }

47 return { deps: [...deps].sort(), devDeps: needsThemeDevDeps ? ["tw-animate-css"] : [] };

48}

50const PEER_PACKAGES_MESSAGE =

51 "form-builder: peer dependencies (install yourself if missing): react, react-dom, react-hook-form, zod, date-fns, lucide-react";

Lines 111-151javascript

111 let themeResult = null;

112 if (theme && itemNames.includes("fb-theme")) {

113 themeResult = injectThemeCss(cwd, base, themeItem, { force });

114 if (themeResult.status === "not-found") {

src/source.mjsView file

Lines 64-104javascript

64 ]),

65 );

66 return { engine, fields, primitives };

67}

69function loadVendored(vendorDir) {

70 const raw = JSON

Source & flagged code

4 flagged · loading source

src/install.mjsView file

2import path from "node:path"; L3: import { spawnSync } from "node:child_process"; L4: import { planInstall } from "./plan.mjs";

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code