registry / pierre-review / 0.1.42

pierre-review@0.1.42

Dashboard for tracking your team's GitHub PR activity across repos — local (SQLite + gh) or self-hosted multi-tenant cloud (Postgres + GitHub App).

Static Scan Results

scanned 2d ago · by rust-scanner

Static analysis flagged 8 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 64 file(s), 2.29 MB of source, external domains: almende.com, api.github.com, cli.github.com, github.com, momentjs.com, opensource.org, reactjs.org, visjs.github.io, www.apache.org, www.ibm.com, www.w3.org

Source & flagged code

2 flagged

dist/pro/bind.jsView file

Lines 10-50javascript

10import { runPluginMigrations } from './migrate.js';

11import { setProCapabilities } from './contract.js';

12// Boot binding for the optional @pierre/pro plugin. The plugin lives in a PRIVATE

13// git submodule at packages/pro (often absent — a pure-OSS checkout never has it).

14// It is deliberately NOT a declared dependency, so `pnpm install` succeeds without

15// it; we resolve it by FILESYSTEM PATH rather than a bare specifier (no package.json

16// coupling). Submodule absent → no entry file on disk → clean OSS no-op.

17export async function bindProPlugin(app) {

18 if (!config.proEnabled)

19 return; // master gate (Pro is local-only for now)

20 // here = apps/backend/{src|dist}/pro/bind.{ts|js} → repo root is four levels up.

21 const here = fileURLToPath(import.meta.url);

22 const repoRoot = resolve(dirname(here), '../../../..');

23 const entry = [

24 join(repoRoot, 'packages/pro/dist/index.js'), // built plugin (node)

25 join(repoRoot, 'packages/pro/src/index.ts'), // source (tsx dev)

26 ].find(existsSync);

27 if (!entry) {

28 app.log.debug('pro plugin submodule absent — OSS mode');

29 return;

30 }

31 const mod = await import(pathToFileURL(entry).href).catch((err) => {

32 app.log.warn({ err }, 'pro plugin present but failed to load — OSS mode');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/pro/bind.jsView on unpkg · L30

33 return null;

34 });

35 if (!mod)

36 return;

37 const plugin = (mod.default ?? mod);

38 if (plugin?.apiVersion !== 1 || typeof plugin.register !== 'function') {

39 app.log.warn({ apiVersion: plugin?.apiVersion }, 'pro contract mismatch — skipped');

40 return;

41 }

42 const ctx = {

43 log: app.log,

44 host: {

45 version: process.env.npm_package_version ?? '0.0.0',

46 deploymentMode: config.deploymentMode,

47 isCloud: config.isCloud,

48 },

49 accountIdOf,

50 db,

dist/cli.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import { execFile, execFileSync } from 'node:child_process';

3import { mkdirSync } from 'node:fs';

4import { homedir } from 'node:os';

5import { dirname, join } from 'node:path';

6// ── tiny ANSI helpers (degrade gracefully when not a TTY) ──────────────────

7const

Source & flagged code

2 flagged · loading source

dist/pro/bind.jsView file

30} L31: const mod = await import(pathToFileURL(entry).href).catch((err) => { L32: app.log.warn({ err }, 'pro plugin present but failed to load — OSS mode');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/pro/bind.jsView on unpkg · L30

dist/cli.jsView file

1#!/usr/bin/env node L2: import { execFile, execFileSync } from 'node:child_process'; L3: import { mkdirSync } from 'node:fs'; ... L6: // ── tiny ANSI helpers (degrade gracefully when not a TTY) ────────────────── L7: const useColor = process.stdout.isTTY && process.env.NO_COLOR === undefined; L8: const paint = (code, s) => useColor ? `[${code}m${s}[0m` : s; ... L80: Prerequisite (local mode): L81: Requires the GitHub CLI (https://cli.github.com), authenticated via L82: \`gh auth login\`. The dashboard reads your activity using your gh token. ... L90: function openBrowser(url) { L91: const platform = process.platform; L92: const cmd = platform === 'darwin' ? 'open' : platform === 'win32' ? 'cmd' : 'xdg-open';

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli.jsView on unpkg · L1

Findings

1 High4 Medium3 Low

HighSandbox Evasion Gated Capabilitydist/cli.js

MediumDynamic Requiredist/pro/bind.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

dist/pro/bind.jsView file

Lines 10-50javascript

10import { runPluginMigrations } from './migrate.js';

11import { setProCapabilities } from './contract.js';

12// Boot binding for the optional @pierre/pro plugin. The plugin lives in a PRIVATE

13// git submodule at packages/pro (often absent — a pure-OSS checkout never has it).

14// It is deliberately NOT a declared dependency, so `pnpm install` succeeds without

15// it; we resolve it by FILESYSTEM PATH rather than a bare specifier (no package.json

16// coupling). Submodule absent → no entry file on disk → clean OSS no-op.

17export async function bindProPlugin(app) {

18 if (!config.proEnabled)

19 return; // master gate (Pro is local-only for now)

20 // here = apps/backend/{src|dist}/pro/bind.{ts|js} → repo root is four levels up.

21 const here = fileURLToPath(import.meta.url);

22 const repoRoot = resolve(dirname(here), '../../../..');

23 const entry = [

24 join(repoRoot, 'packages/pro/dist/index.js'), // built plugin (node)

25 join(repoRoot, 'packages/pro/src/index.ts'), // source (tsx dev)

26 ].find(existsSync);

27 if (!entry) {

28 app.log.debug('pro plugin submodule absent — OSS mode');

29 return;

30 }

31 const mod = await import(pathToFileURL(entry).href).catch((err) => {

32 app.log.warn({ err }, 'pro plugin present but failed to load — OSS mode');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/pro/bind.jsView on unpkg · L30

33 return null;

34 });

35 if (!mod)

36 return;

37 const plugin = (mod.default ?? mod);

38 if (plugin?.apiVersion !== 1 || typeof plugin.register !== 'function') {

39 app.log.warn({ apiVersion: plugin?.apiVersion }, 'pro contract mismatch — skipped');

40 return;

41 }

42 const ctx = {

43 log: app.log,

44 host: {

45 version: process.env.npm_package_version ?? '0.0.0',

46 deploymentMode: config.deploymentMode,

47 isCloud: config.isCloud,

48 },

49 accountIdOf,

50 db,

dist/cli.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import { execFile, execFileSync } from 'node:child_process';

3import { mkdirSync } from 'node:fs';

4import { homedir } from 'node:os';

5import { dirname, join } from 'node:path';

6// ── tiny ANSI helpers (degrade gracefully when not a TTY) ──────────────────

7const