registry / pierre-review / 0.1.48

pierre-review@0.1.48

Dashboard for tracking your team's GitHub PR activity across repos — local (SQLite + gh) or self-hosted multi-tenant cloud (Postgres + GitHub App).

Static Scan Results

scanned 4h ago · by rust-scanner

Static analysis flagged 9 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 71 file(s), 2.38 MB of source, external domains: almende.com, api.github.com, cli.github.com, github.com, opensource.org, reactjs.org, visjs.github.io, www.apache.org, www.ibm.com, www.w3.org

Source & flagged code

3 flagged

dist/pro/bind.jsView file

Lines 15-55javascript

15import { runPluginMigrations } from './migrate.js';

16import { setProCapabilities } from './contract.js';

17// Boot binding for the optional @pierre/pro plugin. The plugin lives in a PRIVATE

18// git submodule at packages/pro (often absent — a pure-OSS checkout never has it).

19// It is deliberately NOT a declared dependency, so `pnpm install` succeeds without

20// it; we resolve it by FILESYSTEM PATH rather than a bare specifier (no package.json

21// coupling). Submodule absent → no entry file on disk → clean OSS no-op.

22export async function bindProPlugin(app) {

23 if (!config.proEnabled)

24 return; // master gate (Pro is local-only for now)

25 // here = apps/backend/{src|dist}/pro/bind.{ts|js} → repo root is four levels up.

26 const here = fileURLToPath(import.meta.url);

27 const repoRoot = resolve(dirname(here), '../../../..');

28 const entry = [

29 join(repoRoot, 'packages/pro/dist/index.js'), // built plugin (node)

30 join(repoRoot, 'packages/pro/src/index.ts'), // source (tsx dev)

31 ].find(existsSync);

32 if (!entry) {

33 app.log.debug('pro plugin submodule absent — OSS mode');

34 return;

35 }

36 const mod = await import(pathToFileURL(entry).href).catch((err) => {

37 app.log.warn({ err }, 'pro plugin present but failed to load — OSS mode');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/pro/bind.jsView on unpkg · L35

38 return null;

39 });

40 if (!mod)

41 return;

42 const plugin = (mod.default ?? mod);

43 if (plugin?.apiVersion !== 3 || typeof plugin.register !== 'function') {

44 app.log.warn({ apiVersion: plugin?.apiVersion }, 'pro contract mismatch — skipped');

45 return;

46 }

47 const ctx = {

48 log: app.log,

49 host: {

50 version: process.env.npm_package_version ?? '0.0.0',

51 deploymentMode: config.deploymentMode,

52 isCloud: config.isCloud,

53 },

54 accountIdOf,

55 db,

dist/cli.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import { execFile, execFileSync } from 'node:child_process';

3import { mkdirSync } from 'node:fs';

4import { homedir } from 'node:os';

5import { dirname, join } from 'node:path';

6// ── tiny ANSI helpers (degrade gracefully when not a TTY) ──────────────────

7const

dist/coding/merge.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = pierre-review@0.1.47 matchedIdentity = npm:cGllcnJlLXJldmlldw:0.1.47 similarity = 0.891 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/coding/merge.jsView on unpkg

Source & flagged code

3 flagged · loading source

dist/pro/bind.jsView file

35} L36: const mod = await import(pathToFileURL(entry).href).catch((err) => { L37: app.log.warn({ err }, 'pro plugin present but failed to load — OSS mode');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/pro/bind.jsView on unpkg · L35

dist/cli.jsView file

1#!/usr/bin/env node L2: import { execFile, execFileSync } from 'node:child_process'; L3: import { mkdirSync } from 'node:fs'; ... L6: // ── tiny ANSI helpers (degrade gracefully when not a TTY) ────────────────── L7: const useColor = process.stdout.isTTY && process.env.NO_COLOR === undefined; L8: const paint = (code, s) => useColor ? `[${code}m${s}[0m` : s; ... L80: Prerequisite (local mode): L81: Requires the GitHub CLI (https://cli.github.com), authenticated via L82: \`gh auth login\`. The dashboard reads your activity using your gh token. ... L90: function openBrowser(url) { L91: const platform = process.platform; L92: const cmd = platform === 'darwin' ? 'open' : platform === 'win32' ? 'cmd' : 'xdg-open';

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli.jsView on unpkg · L1

dist/coding/merge.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/coding/merge.jsView on unpkg

Findings

2 High4 Medium3 Low

HighSandbox Evasion Gated Capabilitydist/cli.js

HighPrevious Version Dangerous Deltadist/coding/merge.js

MediumDynamic Requiredist/pro/bind.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

dist/pro/bind.jsView file

Lines 15-55javascript

15import { runPluginMigrations } from './migrate.js';

16import { setProCapabilities } from './contract.js';

17// Boot binding for the optional @pierre/pro plugin. The plugin lives in a PRIVATE

18// git submodule at packages/pro (often absent — a pure-OSS checkout never has it).

19// It is deliberately NOT a declared dependency, so `pnpm install` succeeds without

20// it; we resolve it by FILESYSTEM PATH rather than a bare specifier (no package.json

21// coupling). Submodule absent → no entry file on disk → clean OSS no-op.

22export async function bindProPlugin(app) {

23 if (!config.proEnabled)

24 return; // master gate (Pro is local-only for now)

25 // here = apps/backend/{src|dist}/pro/bind.{ts|js} → repo root is four levels up.

26 const here = fileURLToPath(import.meta.url);

27 const repoRoot = resolve(dirname(here), '../../../..');

28 const entry = [

29 join(repoRoot, 'packages/pro/dist/index.js'), // built plugin (node)

30 join(repoRoot, 'packages/pro/src/index.ts'), // source (tsx dev)

31 ].find(existsSync);

32 if (!entry) {

33 app.log.debug('pro plugin submodule absent — OSS mode');

34 return;

35 }

36 const mod = await import(pathToFileURL(entry).href).catch((err) => {

37 app.log.warn({ err }, 'pro plugin present but failed to load — OSS mode');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/pro/bind.jsView on unpkg · L35

38 return null;

39 });

40 if (!mod)

41 return;

42 const plugin = (mod.default ?? mod);

43 if (plugin?.apiVersion !== 3 || typeof plugin.register !== 'function') {

44 app.log.warn({ apiVersion: plugin?.apiVersion }, 'pro contract mismatch — skipped');

45 return;

46 }

47 const ctx = {

48 log: app.log,

49 host: {

50 version: process.env.npm_package_version ?? '0.0.0',

51 deploymentMode: config.deploymentMode,

52 isCloud: config.isCloud,

53 },

54 accountIdOf,

55 db,

dist/cli.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import { execFile, execFileSync } from 'node:child_process';

3import { mkdirSync } from 'node:fs';

4import { homedir } from 'node:os';

5import { dirname, join } from 'node:path';

6// ── tiny ANSI helpers (degrade gracefully when not a TTY) ──────────────────

7const

dist/coding/merge.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/coding/merge.jsView on unpkg