registry / railcode / 0.1.19

railcode@0.1.19

⚠ Under review

Developer CLI for the multi-tenant Railcode platform: log in, scaffold, and deploy static apps.

Static Scan Results

scanned 4h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 8 file(s), 245 KB of source, external domains: 127.0.0.1, api.railcode.app

Source & flagged code

4 flagged

dist/index.jsView file

Lines 1-22javascript

1#!/usr/bin/env node

2import { cpSync, createReadStream, existsSync, mkdirSync, readFileSync, readdirSync, realpathSync, rmSync, statSync, writeFileSync, } from "node:fs";

3import { spawn } from "node:child_process";

4import { createHash, randomBytes } from "node:crypto";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L2

5import { createServer, request as httpRequest, } from "node:http";

6import { createServer as createNetServer, connect as netConnect } from "node:net";

7import { homedir } from "node:os";

8import { Readable } from "node:stream";

9import { dirname, join, relative, resolve, sep } from "node:path";

10import process from "node:process";

11import { createInterface } from "node:readline/promises";

12import { fileURLToPath } from "node:url";

13import { KvQueryError, kvCount, kvQuery, } from "./dev/kv-query.js";

14import { DbError, formatTable, inferEngine, parseEngine, parseSqlParams, pickSqlSource, } from "./db.js";

15import { QueryCmdError, paramSignature, parseParamDecls, parseRunParams, pickAuthoringSql, } from "./query.js";

16import { APP_MANIFEST_NAME, ManifestParseError, documentOperations, parseManifestYaml, renderManifestDeployOutcome, renderManifestSummary, } from "./manifest.js";

17import { ConnectorError, buildConnectorRequest, connectorOpenapiOutput, connectorTable, parseConnectorOption, parseMethodOption, pickConnectorBody, proxyExitCode, renderConnectorDocs, renderProxyResponse, } from "./connectors.js";

18import { llmModelTable, llmProviderTable } from "./llm.js";

19// ---------------------------------------------------------------------------

20// Constants

21// ---------------------------------------------------------------------------

22const RAILCODE_HOME = process.env.RAILCODE_HOME || join(homedir(), ".railcode");

Lines 1211-1251javascript

1211}

1212

1213function Icon({ name, className }: { name: string; className?: string }) {

1214 return (

1215 <svg className={className ? "icon " + className :

Lines 4628-4668javascript

4628}

4629// Print the install command and stop — never mutate the app dir on `railcode dev`.

4630function ensureAppDeps(cwd) {

4631 if (!existsSync(join(cwd, "node_modules"))) {

4632 throw new CliError(`Dependencies are not installed. Run \`${detectPackageManager(cwd)} install\` here, then

•matchType = previous_version_dangerous_delta matchedPackage = railcode@0.1.14 matchedIdentity = npm:cmFpbGNvZGU:0.1.14 similarity = 0.667 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg

Source & flagged code

4 flagged · loading source

dist/index.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg

2import { cpSync, createReadStream, existsSync, mkdirSync, readFileSync, readdirSync, realpathSync, rmSync, statSync, writeFileSync, } from "node:fs"; L3: import { spawn } from "node:child_process"; L4: import { createHash, randomBytes } from "node:crypto";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L2

1231const types: (CodeTokenType | null)[] = ["string", "keyword", "number", "call", "punct", null, null]; L1232: let match: RegExpExecArray | null; L1233: CODE_TOKEN_RE.lastIndex = 0;

High

Shell

Package source references shell execution.

dist/index.jsView on unpkg · L1231

4648const command = plan.vite L4649: ? `npx vite --host 127.0.0.1 --port ${assetPort} --strictPort --clearScreen false` L4650: : plan.command; ... L4652: try { L4653: const child = spawn(command, { L4654: cwd,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L4648

Findings

1 Critical3 High3 Medium5 Low

CriticalPrevious Version Dangerous Deltadist/index.js

HighChild Processdist/index.js

HighShelldist/index.js

HighRuntime Package Installdist/index.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

Source & flagged code

4 flagged

dist/index.jsView file

Lines 1-22javascript

1#!/usr/bin/env node

2import { cpSync, createReadStream, existsSync, mkdirSync, readFileSync, readdirSync, realpathSync, rmSync, statSync, writeFileSync, } from "node:fs";

3import { spawn } from "node:child_process";

4import { createHash, randomBytes } from "node:crypto";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L2

5import { createServer, request as httpRequest, } from "node:http";

6import { createServer as createNetServer, connect as netConnect } from "node:net";

7import { homedir } from "node:os";

8import { Readable } from "node:stream";

9import { dirname, join, relative, resolve, sep } from "node:path";

10import process from "node:process";

11import { createInterface } from "node:readline/promises";

12import { fileURLToPath } from "node:url";

13import { KvQueryError, kvCount, kvQuery, } from "./dev/kv-query.js";

14import { DbError, formatTable, inferEngine, parseEngine, parseSqlParams, pickSqlSource, } from "./db.js";

15import { QueryCmdError, paramSignature, parseParamDecls, parseRunParams, pickAuthoringSql, } from "./query.js";

16import { APP_MANIFEST_NAME, ManifestParseError, documentOperations, parseManifestYaml, renderManifestDeployOutcome, renderManifestSummary, } from "./manifest.js";

18import { llmModelTable, llmProviderTable } from "./llm.js";

19// ---------------------------------------------------------------------------

20// Constants

21// ---------------------------------------------------------------------------

22const RAILCODE_HOME = process.env.RAILCODE_HOME || join(homedir(), ".railcode");

Lines 1211-1251javascript

1211}

1212

1213function Icon({ name, className }: { name: string; className?: string }) {

1214 return (

1215 <svg className={className ? "icon " + className :

Lines 4628-4668javascript

4628}

4629// Print the install command and stop — never mutate the app dir on `railcode dev`.

4630function ensureAppDeps(cwd) {

4631 if (!existsSync(join(cwd, "node_modules"))) {

4632 throw new CliError(`Dependencies are not installed. Run \`${detectPackageManager(cwd)} install\` here, then

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg