registry / gencow / 0.1.176

gencow@0.1.176

Gencow — AI Backend Engine

Static Scan Results

scanned 16h ago · by rust-scanner

Static analysis flagged 16 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

NoLicense

scanned 127 file(s), 3.00 MB of source, external domains: 127.0.0.1, api.tosspayments.com, docs.gencow.com, gencow.app, js.tosspayments.com, json-schema.org, my-app.vercel.app, myapp.com, myapp.vercel.app, platform.openai.com, react.dev, www.w3.org

Oversized source lightweight scan

runtime/server.mjs4.90 MB file, sampled 256 KB

FilesystemNetworkChildProcessEnvironmentVarsCryptoDynamicRequireHighEntropyStrings

Source & flagged code

7 flagged

bin/gencow.mjsView file

Lines 1-38javascript

1#!/usr/bin/env bun

2/**

3 * @gencow/cli — Gencow CLI

4 *

5 * Commands:

6 * gencow dev — push schema → start server with hot-reload

7 * gencow db:push — push schema.ts changes to DB (instant, no migration files)

8 * gencow db:generate — generate SQL migration files from schema.ts

9 * gencow db:migrate — apply pending migrations

10 * gencow db:reset — backup + reset DB (safe reset)

11 * gencow db:restore — restore DB from backup

12 * gencow db:studio — open Drizzle Studio (visual DB browser)

13 * gencow dashboard — open /_admin in browser

14 * gencow backup — manage database backups (list/create/restore/restore-file/delete/download)

15 * gencow templates — publish/list/download/clone marketplace templates

16 * gencow help — show this help

17 */

19import { execSync, spawn } from "child_process";

20import { existsSync, readFileSync, writeFileSync, unlinkSync, cpSync, symlinkSync, copyFileSync } from "fs";

High

Child Process

Package source references child process execution.

bin/gencow.mjsView on unpkg · L18

21import { resolve, dirname } from "path";

22import { fileURLToPath } from "url";

23import { createAddCommand } from "../lib/add-command.mjs";

24import { createAuthCommands } from "../lib/auth-command.mjs";

25import { createAppCommand } from "../lib/app-command.mjs";

26import { createBackupCommand } from "../lib/backup-command.mjs";

27import { createApiCodegenRuntime, resolveCoreImport } from "../lib/cli-dev-runtime.mjs";

28import {

29 buildDrizzleKitCommand,

30 buildEnv,

31 cleanupOldBackups,

32 findServerRoot,

33 isLocalDbTarget,

34 isMonorepo,

35 loadConfig,

36 runInServer,

37 spawnInServer,

38 updateEnvLocalUrl,

Lines 487-527javascript

487 // ── app (subcommands: create, list, delete) ────────

488 app: runAppCommand,

489

490 // ── remote:deploy — REMOVED (legacy, use `gencow deploy` instead) ──

491

492 // ── jobs (Cron/Scheduled Jobs Observability) ──────

493 jobs: runJobsCommand,

494

495 // ── logs ───────────────────────────────────────────

496 logs: runLogsCommand,

•matchType = previous_version_dangerous_delta matchedPackage = gencow@0.1.168 matchedIdentity = npm:Z2VuY293:0.1.168 similarity = 0.633 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/gencow.mjsView on unpkg

runtime/tooling.mjsView file

296} L297: function generateImport({ L298: tables,

Medium

Dynamic Require

Package source references dynamic require/import behavior.

runtime/tooling.mjsView on unpkg · L296

lib/readme-codegen.mjsView file

Lines 257-297javascript

257 md += `- Do not call fetch("/api/query") or fetch("/api/mutation") directly.\n`;

258 md += `- Do not create apiPost() wrappers for procedures.\n`;

259 md += `- gencow/api.ts is generated. Do not create or edit it manually.\n`;

260 md +=

lib/platform-client.mjsView file

Lines 1-26javascript

1import { mkdirSync, readFileSync, unlinkSync, writeFileSync } from "fs";

2import { homedir } from "os";

3import { resolve } from "path";

4import { CYAN, RESET, error, info } from "./output.mjs";

runtime/server.mjsView file

•path = runtime/server.mjs kind = oversized_source_file sizeBytes = 5138584 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

runtime/server.mjsView on unpkg

Source & flagged code

7 flagged · loading source

bin/gencow.mjsView file

18L19: import { execSync, spawn } from "child_process"; L20: import { existsSync, readFileSync, writeFileSync, unlinkSync, cpSync, symlinkSync, copyFileSync } from "fs";

High

Child Process

Package source references child process execution.

bin/gencow.mjsView on unpkg · L18

507stdio: "inherit", L508: shell: true, L509: });

High

Shell

Package source references shell execution.

bin/gencow.mjsView on unpkg · L507

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/gencow.mjsView on unpkg

runtime/tooling.mjsView file

Findings

6 High4 Medium6 Low

HighChild Processbin/gencow.mjs

HighShellbin/gencow.mjs

HighSame File Env Network Executionlib/readme-codegen.mjs

HighSandbox Evasion Gated Capabilitylib/platform-client.mjs

HighOversized Source Fileruntime/server.mjs

HighPrevious Version Dangerous Deltabin/gencow.mjs

MediumDynamic Requireruntime/tooling.mjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings