registry / ghosty-cli / 0.18.0

ghosty-cli@0.18.0

Ghosty — deploy applications safely, from a short interview to a live URL.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicenseWildcardDependency

scanned 17 file(s), 292 KB of source, external domains: 127.0.0.1, fonts.googleapis.com, getghosty.dev, git-scm.com, iamcredentials.googleapis.com, metadata.google.internal, nodejs.org, registry.npmjs.org

Source & flagged code

3 flagged

templates/backend-node/src/lib/files.tsView file

Lines 1-30typescript

1// ─────────────────────────────────────────────────────────────────────────

2// Managed by Ghosty — platform plumbing. Don't edit this file; import its

3// functions from your routes/services instead.

4// ─────────────────────────────────────────────────────────────────────────

6import crypto from 'node:crypto';

7import fs from 'node:fs';

8import path from 'node:path';

10/**

11 * File storage for this app — a private place for uploads, images, documents

12 * and generated files. Optional, like the database: enable it by setting

13 * `"fileStorage": true` in app.config.json and running `ghosty provision`.

14 *

15 * The same five functions work everywhere:

16 * - Locally (`ghosty dev`) files live in a `.data/files` folder next to the

17 * backend, so development needs no setup and no credentials.

18 * - In the published app, Ghosty provides managed file storage and this

19 * module talks to it directly — no extra packages, no credentials in the

20 * code; the app's own platform identity does the work.

21 *

22 * Everything stored here is PRIVATE to the app. To let someone download a

23 * file without signing in, hand them a share link (`shareLink`) — it expires

24 * on its own.

25 */

27const LOCAL_ROOT = path.resolve(__dirname, '..', '..', '.data', 'files');

29function bucketName(): string | undefined {

30 const name = process.env.FILE_STORAGE_BUCKET;

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

templates/backend-node/src/lib/files.tsView on unpkg · L10

templates/access-python-members/src/access_gate.pyView file

•path = templates/access-python-members/src/access_gate.py kind = build_helper sizeBytes = 9036 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/access-python-members/src/access_gate.pyView on unpkg

dist/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = ghosty-cli@0.10.0 matchedIdentity = npm:Z2hvc3R5LWNsaQ:0.10.0 similarity = 0.786 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg

Source & flagged code

3 flagged · loading source

templates/backend-node/src/lib/files.ts

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code