registry / kyro-cli / 0.0.5

kyro-cli@0.0.5

`kyro` is a lightweight, super-fast React Native environment and project health checker CLI. It helps React Native developers quickly diagnose issues with their local environment or project structures.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 42 file(s), 282 KB of source, external domains: developer.android.com, developer.apple.com, github.com, guides.cocoapods.org, nodejs.org, raw.githubusercontent.com, reactnative.dev, schemas.android.com

Source & flagged code

3 flagged

dist/index.jsView file

Lines 4086-4126javascript

4086 printFindings2("Errors", result.errors, chalk15.red);

4087 printFindings2("Warnings", result.warnings, chalk15.yellow);

4088 printFindings2("Info", result.infos, chalk15.cyan);

4089 process.exit(result.passed ? 0 : 1);

4090 } catch (err) {

4091 if (options.json) {

4092 console.log(JSON.stringify({ success: false, error: err?.message }, null, 2));

4093 } else {

4094 console.log(chalk15.red(`\u2716 ${err?.message || "Unknown error"}`));

4095 }

4096 process.exit(1);

4097 }

4098});

4099

4100// src/commands/build.ts

4101import { Command as Command15 } from "commander";

4102import chalk18 from "chalk";

4103import ora4 from "ora";

4104import path24 from "path";

4105import fs20 from "fs";

4106import os9 from "os";

4107import { spawn } from "child_process";

4108

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L4106

4109// src/utils/portConflictResolver.ts

4110import os8 from "os";

4111import chalk16 from "chalk";

4112import ora2 from "ora";

4113async function findProcessOnPort(port) {

4114 const platform = os8.platform();

4115 if (platform === "win32") {

4116 try {

4117 const netstatResult = await runCommand("netstat -ano");

4118 if (netstatResult.error) return null;

4119 const lines = netstatResult.stdout.split("\n");

4120 for (const line of lines) {

4121 if (line.includes(`:${port}`) && line.includes("LISTENING")) {

4122 const parts = line.trim().split(/\s+/);

4123 const pid = parseInt(parts[parts.length - 1], 10);

4124 if (!isNaN(pid)) {

4125 let name = "Unknown";

4126 const taskResult = await runCommand(`tasklist /FI "PID eq ${pid}" /NH`);

Lines 4609-4651javascript

4609 installSpinner.succeed("Installation successful!");

4610 }

4611 if (!installFailed) {

4612 if (packageName) {

4613 console.log(chalk18.blue(`

4614\u{1F680} Opening application: ${packageName}...`));

4615 const launchResult =

Source & flagged code

3 flagged · loading source

dist/index.jsView file

4106import os9 from "os"; L4107: import { spawn } from "child_process"; L4108:

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L4106

4631console.log(chalk18.cyan(`Running: ${cmd}`)); L4632: const metroProcess = spawn(os9.platform() === "win32" ? "cmd.exe" : "sh", [ L4633: os9.platform() === "win32" ? "/c" : "-c",

High

Shell

Package source references shell execution.

dist/index.jsView on unpkg · L4631

4629const isExpo2 = detectProjectType(projectRoot).startsWith("expo"); L4630: const cmd = isExpo2 ? "npx expo start --android" : `${pm} run start || npx react-native start`; L4631: console.log(chalk18.cyan(`Running: ${cmd}`)); L4632: const metroProcess = spawn(os9.platform() === "win32" ? "cmd.exe" : "sh", [ L4633: os9.platform() === "win32" ? "/c" : "-c",

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L4629

Findings

3 High2 Medium5 Low

HighChild Processdist/index.js

HighShelldist/index.js

HighRuntime Package Installdist/index.js

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

3 flagged

dist/index.jsView file

Lines 4086-4126javascript

4086 printFindings2("Errors", result.errors, chalk15.red);

4087 printFindings2("Warnings", result.warnings, chalk15.yellow);

4088 printFindings2("Info", result.infos, chalk15.cyan);

4089 process.exit(result.passed ? 0 : 1);

4090 } catch (err) {

4091 if (options.json) {

4092 console.log(JSON.stringify({ success: false, error: err?.message }, null, 2));

4093 } else {

4094 console.log(chalk15.red(`\u2716 ${err?.message || "Unknown error"}`));

4095 }

4096 process.exit(1);

4097 }

4098});

4099

4100// src/commands/build.ts

4101import { Command as Command15 } from "commander";

4102import chalk18 from "chalk";

4103import ora4 from "ora";

4104import path24 from "path";

4105import fs20 from "fs";

4106import os9 from "os";

4107import { spawn } from "child_process";

4108

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L4106

4109// src/utils/portConflictResolver.ts

4110import os8 from "os";

4111import chalk16 from "chalk";

4112import ora2 from "ora";

4113async function findProcessOnPort(port) {

4114 const platform = os8.platform();

4115 if (platform === "win32") {

4116 try {

4117 const netstatResult = await runCommand("netstat -ano");

4118 if (netstatResult.error) return null;

4119 const lines = netstatResult.stdout.split("\n");

4120 for (const line of lines) {

4121 if (line.includes(`:${port}`) && line.includes("LISTENING")) {

4122 const parts = line.trim().split(/\s+/);

4123 const pid = parseInt(parts[parts.length - 1], 10);

4124 if (!isNaN(pid)) {

4125 let name = "Unknown";

4126 const taskResult = await runCommand(`tasklist /FI "PID eq ${pid}" /NH`);

Lines 4609-4651javascript

4609 installSpinner.succeed("Installation successful!");

4610 }

4611 if (!installFailed) {

4612 if (packageName) {

4613 console.log(chalk18.blue(`

4614\u{1F680} Opening application: ${packageName}...`));

4615 const launchResult =