registry / mvframe / 1.1.28

mvframe@1.1.28

**English** | [简体中文](README.cn.md)

Static Scan Results

scanned 17d ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 11 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 59 file(s), 1.96 MB of source, external domains: 127.0.0.1, element-plus.org, github.com, oapi.dingtalk.com, www.w3.org

Oversized source lightweight scan

dist/@visactor.js2.36 MB file, sampled 256 KB

ChildProcessEnvironmentVarsUrlStringswww.w3.org

Source & flagged code

4 flagged

scripts/copy-flag-assets.jsView file

Lines 1-26javascript

1#!/usr/bin/env node

2/**

3 * Copy flag-icons SVG assets beside the built host bundle.

4 * `src/style/chip/flag-icons.scss` points CSS URLs at `/assets/flags/...`.

5 */

7const fs = require("fs");

8const path = require("path");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

scripts/copy-flag-assets.jsView on unpkg · L6

9const { createRequire } = require("module");

10const { execFileSync } = require("child_process");

12const root = path.resolve(__dirname, "..");

13const pnpPath = path.join(root, ".pnp.cjs");

15if (fs.existsSync(pnpPath)) {

16 require(pnpPath).setup();

17}

19const projectRequire = createRequire(path.join(root, "package.json"));

20const flagPackagePath = projectRequire.resolve("flag-icons/package.json");

21const flagRoot = path.dirname(flagPackagePath);

22const src = path.join(flagRoot, "flags");

23const dest = path.join(root, "dist", "assets", "flags");

25function copyFromZip(zipBackedPath, target) {

26 const marker = ".zip/";

scripts/scaffold-app.jsView file

Lines 1-32javascript

1#!/usr/bin/env node

2/**

3 * 在目标工程生成 MVFrame 推荐目录与雏形文件（views / component / api / pinia / router / config / assets）。

4 *

5 * 用法：

6 * node path/to/mvframe/scripts/scaffold-app.js [项目根] [--force|-f]

7 * yarn exec mvframe-init-app

8 *

9 * 环境变量：MVFRAME_SCAFFOLD_TARGET=/path/to/project

10 *

11 * 选项：

scripts/install-cursor-rules.jsView file

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: #!/usr/bin/env node const fs = require("fs"); const path = require("path"); function installcursorrules(projectroot) { const targetroot = path.resolve(projectroot); const rulessrc = path.join(__dirname, "..", ".cursor", "rules"); if (!fs.existssync(rule

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

scripts/install-cursor-rules.jsView on unpkg

dist/@visactor.jsView file

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/@visactor.jsView on unpkg

Source & flagged code

4 flagged · loading source

scripts/copy-flag-assets.jsView file

6L7: const fs = require("fs"); L8: const path = require("path");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

scripts/copy-flag-assets.jsView on unpkg · L6

scripts/scaffold-app.jsView file

12Manifest entrypoint (manifest.bin) carries capability families absent from dist/build output: environment+network, sensitive-file+network, execution+network L12: * --force, -f 覆盖已存在的脚手架文件 L13: * --no-package-json, -n 不读不写 package.json（仅生成源码与 Vite 配置） L14: */ ... L17: const path = require("path"); L18: const { execFileSync } = require("child_process"); L19: const { upsertCodexAgents } = require("./install-codex-agents.js"); ... L27: const target = path.resolve( L28: process.env.MVFRAME_SCAFFOLD_TARGET || argPath || process.cwd(), L29: ); ... L92: const TEST_DINGTALK_WEBHOOK = L93: "https://oapi.dingtalk.com/robot/send?access_token=[redacted]"; L94: const TEST_DINGTALK_SECRET =

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

scripts/scaffold-app.jsView on unpkg · L12

Findings

3 High4 Medium4 Low

HighEntrypoint Build Divergencescripts/scaffold-app.js

HighExternal Ai Agent Control Surface Mutationscripts/install-cursor-rules.js

HighSemantic Analysis Limiteddist/@visactor.js

MediumDynamic Requirescripts/copy-flag-assets.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings