registry / murasaki / 0.54.0

murasaki@0.54.0

Next.js DX for desktop apps. React 19 + Vite + Rust-native.

Static Scan Results

scanned 3d ago · by rust-scanner

Static analysis completed at 93.0% confidence. No malicious behavior was detected; 9 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNativeBindingsNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 67 file(s), 631 KB of source, external domains: 127.0.0.1, github.com, go.microsoft.com, learn.microsoft.com, murasaki.ichi10.com, murasaki.local, nodejs.org, nsis.sourceforge.net, sh.rustup.rs, timestamp.acs.microsoft.com, timestamp.digicert.com, wixtoolset.org, www.apple.com

Source & flagged code

3 flagged

bin/murasaki.mjsView file

Lines 7-39javascript

7const __dirname = dirname(fileURLToPath(import.meta.url))

8const cmd = process.argv[2]

10const distEntry = resolve(__dirname, '..', 'dist', 'cli', `${cmd || 'help'}.js`)

11if (!cmd || cmd === 'help' || cmd === '--help' || cmd === '-h') {

12 const banner = readVersionBanner()

13 process.stdout.write(banner)

14 process.exit(cmd ? 0 : 0)

15}

17if (cmd === '--version' || cmd === '-v') {

18 const pkg = JSON.parse(readFileSync(resolve(__dirname, '..', 'package.json'), 'utf8'))

19 process.stdout.write(pkg.version + '\n')

20 process.exit(0)

21}

23if (!existsSync(distEntry)) {

24 process.stderr.write(`\n unknown command: ${cmd}\n run 'murasaki help' for the list\n\n`)

25 process.exit(1)

26}

28const mod = await import(pathToFileURL(distEntry).href)

29if (typeof mod.default !== 'function') {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/murasaki.mjsView on unpkg · L27

30 process.stderr.write(`\n internal: ${cmd}.js has no default export\n\n`)

31 process.exit(1)

32}

33await mod.default(process.argv.slice(3))

35function readVersionBanner() {

36 const pkg = JSON.parse(readFileSync(resolve(__dirname, '..', 'package.json'), 'utf8'))

37 return `\n 🦋 murasaki v${pkg.version} desktop apps with Next.js DX\n\n Usage: murasaki <command> [options]\n\n Commands:\n dev Start the Vite dev server + native WebView\n build Vite production build\n bundle Native folder / .app for the current platform\n installer Distributable installer (.dmg / NSIS .exe / .msi / .zip)\n demo Run a checksum-verified macOS developer preview\n init Install Rust toolchain for native binding hackers\n icon Generate .icns / .ico / .png set from a PNG\n release Auto-update mani ...

38}

Long lines were clipped for display.

dist/cli/installer.jsView file

Lines 1-24javascript

1import { resolve, join, dirname, basename } from 'node:path';

2import { existsSync } from 'node:fs';

3import { mkdtemp, rm, cp, copyFile, mkdir, symlink, writeFile, readFile, readdir, stat } from 'node:fs/promises';

4import { tmpdir } from 'node:os'

dist/cli/bundle.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = murasaki@0.51.0 matchedIdentity = npm:bXVyYXNha2k:0.51.0 similarity = 0.556 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli/bundle.jsView on unpkg

Source & flagged code

3 flagged · loading source

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code