registry / gate-evm-hardhat-foundry / 2.0.13

gate-evm-hardhat-foundry@2.0.13

快速创建 Hardhat集成foundry 项目的 CLI 脚手架工具

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 34 file(s), 128 KB of source, external domains: 127.0.0.1, 480.rpc.thirdweb.com, base.drpc.org, blast.drpc.org, book.getfoundry.sh, bsc.drpc.org, endpoints.omniatech.io, ethereum-rpc.publicnode.com, ethereum-sepolia-rpc.publicnode.com, fantom-json-rpc.stakely.io, gatelayer-mainnet.gatenode.cc, hardhat.org, linea.drpc.org, mainnet.era.zksync.io, optimism-rpc.publicnode.com, polygon.drpc.org, public-arb-mainnet.fastnode.io

Source & flagged code

3 flagged

templates/full/scripts/workflow/cli.tsView file

Lines 1-21typescript

1import { spawnSync } from "child_process";

High

Child Process

Package source references child process execution.

templates/full/scripts/workflow/cli.tsView on unpkg · L1

3type ArgValue = string | boolean;

5const WORKFLOW_ARG_KEYS = new Set([

6 "mode",

7 "target",

8 "step",

9 "from",

10 "executionId",

11]);

13const parseArgs = (argv: string[]): Record<string, ArgValue> => {

14 const args: Record<string, ArgValue> = {};

15 for (let index = 0; index < argv.length; index += 1) {

16 const item = argv[index];

17 if (!item.startsWith("--")) continue;

19 const equalIndex = item.indexOf("=");

20 if (equalIndex > 2) {

21 args[item.slice(2, equalIndex)] = item.slice(equalIndex + 1);

dist/src/utils/git.jsView file

Lines 1-21javascript

1import { execa } from 'execa';

2import ora from 'ora';

High

Shell

Package source references shell execution.

dist/src/utils/git.jsView on unpkg · L1

3import chalk from 'chalk';

4import fs from 'fs-extra';

5import

dist/src/utils/package.jsView file

Lines 36-76javascript

36/**

37 * 安装依赖

38 *

39 * 注意：使用 npm 时会先用 --ignore-scripts 安装，然后手动运行 patch-package

40 * 这是为了绕过 postinstall-postinstall 在 Yarn 4 环境下的兼容性问题

41 */

42export async function installDependencies(cwd, packageManager) {

43 const spinner =

Source & flagged code

3 flagged · loading source

templates/full/scripts/workflow/cli.tsView file

1import { spawnSync } from "child_process"; L2:

High

Child Process

Package source references child process execution.

templates/full/scripts/workflow/cli.tsView on unpkg · L1

dist/src/utils/git.jsView file

1import { execa } from 'execa'; L2: import ora from 'ora';

High

Shell

Package source references shell execution.

dist/src/utils/git.jsView on unpkg · L1

dist/src/utils/package.jsView file

56console.log(chalk.cyan('\n🔧 正在应用补丁...\n')); L57: await execa('npx', ['patch-package'], { L58: cwd,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/src/utils/package.jsView on unpkg · L56

Findings

3 High2 Medium4 Low

HighChild Processtemplates/full/scripts/workflow/cli.ts

HighShelldist/src/utils/git.js

HighRuntime Package Installdist/src/utils/package.js

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

templates/full/scripts/workflow/cli.tsView file

Lines 1-21typescript

1import { spawnSync } from "child_process";

High

Child Process

Package source references child process execution.

templates/full/scripts/workflow/cli.tsView on unpkg · L1

3type ArgValue = string | boolean;

5const WORKFLOW_ARG_KEYS = new Set([

6 "mode",

7 "target",

8 "step",

9 "from",

10 "executionId",

11]);

13const parseArgs = (argv: string[]): Record<string, ArgValue> => {

14 const args: Record<string, ArgValue> = {};

15 for (let index = 0; index < argv.length; index += 1) {

16 const item = argv[index];

17 if (!item.startsWith("--")) continue;

19 const equalIndex = item.indexOf("=");

20 if (equalIndex > 2) {

21 args[item.slice(2, equalIndex)] = item.slice(equalIndex + 1);

dist/src/utils/git.jsView file

Lines 1-21javascript

1import { execa } from 'execa';

2import ora from 'ora';

High

Shell

Package source references shell execution.

dist/src/utils/git.jsView on unpkg · L1

3import chalk from 'chalk';

4import fs from 'fs-extra';

5import

dist/src/utils/package.jsView file

Lines 36-76javascript

36/**

37 * 安装依赖

38 *

39 * 注意：使用 npm 时会先用 --ignore-scripts 安装，然后手动运行 patch-package

40 * 这是为了绕过 postinstall-postinstall 在 Yarn 4 环境下的兼容性问题

41 */

42export async function installDependencies(cwd, packageManager) {

43 const spinner =