registry / rastack / 0.0.54

rastack@0.0.54

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 242 file(s), 1.55 MB of source, external domains: 127.0.0.1, cli.github.com, react.dev, www.w3.org

Source & flagged code

7 flagged

dist/deploy/io.jsView file

Lines 37-77javascript

37 return result;

38 };

39})();

40Object.defineProperty(exports, "__esModule", { value: true });

41exports.configPath = configPath;

42exports.resolveDeployAsset = resolveDeployAsset;

43exports.loadConfig = loadConfig;

44exports.saveConfig = saveConfig;

45exports.gitRemoteUrl = gitRemoteUrl;

46exports.canPrompt = canPrompt;

47exports.awsCapture = awsCapture;

48exports.awsRun = awsRun;

49exports.awsAvailable = awsAvailable;

50exports.stackOutput = stackOutput;

51exports.uploadPlaceholder = uploadPlaceholder;

52exports.ghAvailable = ghAvailable;

53exports.ghAuthenticated = ghAuthenticated;

54exports.ghAuthLogin = ghAuthLogin;

55exports.setRepoVariable = setRepoVariable;

56exports.ask = ask;

57exports.withPrompt = withPrompt;

58const child_process_1 = require("child_process");

59const fs = __importStar(require("fs"));

High

Child Process

Package source references child process execution.

dist/deploy/io.jsView on unpkg · L57

60const os = __importStar(require("os"));

61const path = __importStar(require("path"));

62const readline = __importStar(require("readline"));

63const workflows_1 = require("./workflows");

64const config_1 = require("./config");

65const zip_1 = require("./zip");

66/** Absolute path to the deploy config for a project root. */

67function configPath(cwd = process.cwd()) {

68 return path.join(cwd, workflows_1.CONFIG_PATH);

69}

70/**

71 * Resolve a CloudFormation asset (`app.yaml`, `bootstrap.yaml`, or the

72 * `placeholder/bootstrap` Lambda bundle) to an absolute on-disk path.

73 *

74 * The templates are the **framework's** IaC, not the consumer's — the demo repo

75 * and every future app repo deliberately do not carry a copy (see

76 * deploy/cloudformation/README.md). So `init`/`bootstrap`, which run in those

77 * repos, cannot assume `deploy/cloudformation/<asset>` exists relative to the

src/rastack-update.tsView file

Lines 38-78typescript

38 * `.cmd` spawn is rejected with `EINVAL` since the Node CVE-2024-27980 fix;

39 * false on POSIX so the direct spawn stays injection-free.

40 */

41const NPM_SHELL = npmSpawnShell();

dist/admin.jsView file

Lines 1-37javascript

1window.process=window.process||{env:{}};

2"use strict";(()=>{var P0=Object.create;var Bu=Object.defineProperty;var W0=Object.getOwnPropertyDescriptor;var I0=Object.getOwnPropertyNames;var ev=Object.getPrototypeOf,tv=Object.prototype.hasOwnProperty;var

dist/rastack-compile.jsView file

Lines 1-32javascript

1#!/usr/bin/env node

2"use strict";

3/**

4 * `rastack compile | check | list | urls` — the TypeScript-first replacement for the

5 * old Django `manage.py rastack` command.

6 *

7 * rastack compile [resourcesDir] [outDir] defs → schema.rastack.json + openapi.json

8 * rastack check [resourcesDir] validate the resource graph (exit != 0 on error)

9 * rastack list [resourcesDir] print every resource + its fields/relations

10 * rastack urls [resourcesDir] print the generated /api/{app}/v1/{model}/ routes

11 */

src/rastack-dev.tsView file

Lines 1-39typescript

1#!/usr/bin/env node

3/**

4 * `rastack dev` — local development, always over the WASM engine.

5 *

6 * rastack dev [resourcesDir] [--port <n>] [--warehouse <dir>] [--out <dir>] [--no-open]

7 *

8 * Compiles the resources, then boots a dependency-free static server (à la

9 * `rastack design`) that hands the browser everything it needs to run the app +

10 * admin locally over WebAssembly — no native server, no cargo:

11 * • the bundled React admin (`/dev/admin.js`),

12 * • the prebuilt WASM engine (`/wasm/…`) shipped in the package,

dist/wasm/rastack_wasm_bg.wasmView file

•path = dist/wasm/rastack_wasm_bg.wasm kind = wasm_module sizeBytes = 9644641 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/wasm/rastack_wasm_bg.wasmView on unpkg

Source & flagged code

7 flagged · loading source

dist/deploy/io.jsView file

57exports.withPrompt = withPrompt; L58: const child_process_1 = require("child_process"); L59: const fs = __importStar(require("fs"));

High

Child Process

Package source references child process execution.

dist/deploy/io.jsView on unpkg · L57

src/rastack-update.tsView file

58* `npm.cmd` shim through a shell; we pass one command string to `execSync` L59: * rather than an args array with `shell: true` (Node 22+ DEP0190 — args would be L60: * concatenated unescaped). The only non-literal token, the version, is already

High

Shell

Package source references shell execution.

src/rastack-update.tsView on unpkg · L58

dist/admin.jsView file

8Error generating stack: `+a.message+` L9: `+a.stack}}var Ls=Object.prototype.hasOwnProperty,Oc=we.unstable_scheduleCallback,ts=we.unstable_cancelCallback,_v=we.unstable_shouldYield,zv=we.unstable_requestPaint,ut=we.unstabl... L10: `).replace(bS,"")}function my(e,t){return t=Tp(t),Tp(e)===t}function ee(e,t,n,a,l,i){switch(n){case"children":typeof a=="string"?t==="body"||t==="textarea"&&a===""||al(e,a):(typeof... ... L17: `,r+1),u=o===-1?"":i.slice(o+1);String(a.stack).endsWith(u)||(a.stack+=` L18: `+i)}}catch{}}throw a}}_request(t,n){typeof t=="string"?(n=n||{},n.url=t):n=t||{},n=kt(this.defaults,n);let{transitional:a,paramsSerializer:l,headers:i}=n;a!==void 0&&Wi.assertOpti... L19: ${l.join(`

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/admin.jsView on unpkg · L8

17`,r+1),u=o===-1?"":i.slice(o+1);String(a.stack).endsWith(u)||(a.stack+=` L18: `+i)}}catch{}}throw a}}_request(t,n){typeof t=="string"?(n=n||{},n.url=t):n=t||{},n=kt(this.defaults,n);let{transitional:a,paramsSerializer:l,headers:i}=n;a!==void 0&&Wi.assertOpti... L19: ${l.join(`

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/admin.jsView on unpkg · L17

dist/rastack-compile.jsView file

12Object.defineProperty(exports, "__esModule", { value: true }); L13: const compile_1 = require("./compile"); L14: const DEFAULT_RESOURCES = "resources";

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/rastack-compile.jsView on unpkg · L12

src/rastack-dev.tsView file

19Cross-file remote execution chain: src/rastack-dev.ts spawns dist/admin.js; helper contains network access plus dynamic code execution. L19: L20: import { execFileSync, spawnSync } from "child_process"; L21: import * as fs from "fs"; L22: import * as http from "http"; L23: import * as path from "path"; ... L31: L32: const HERE = __dirname; // dist/ when installed L33: ... L91: if (target !== safeRoot && !target.startsWith(safeRoot + path.sep)) { L92: res.writeHead(403).end("Forbidden"); L93: return; ... L117: const cmd =

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

src/rastack-dev.tsView on unpkg · L19

dist/wasm/rastack_wasm_bg.wasmView file

•path = dist/wasm/rastack_wasm_bg.wasm kind = wasm_module sizeBytes = 9644641 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/wasm/rastack_wasm_bg.wasmView on unpkg

Findings

4 High5 Medium5 Low

HighChild Processdist/deploy/io.js

HighShellsrc/rastack-update.ts

HighSame File Env Network Executiondist/admin.js

HighCross File Remote Execution Contextsrc/rastack-dev.ts

MediumDynamic Requiredist/rastack-compile.js

MediumNetwork

MediumEnvironment Vars

MediumShips Wasm Moduledist/wasm/rastack_wasm_bg.wasm

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvaldist/admin.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

7 flagged

dist/deploy/io.jsView file

Lines 37-77javascript

37 return result;

38 };

39})();

40Object.defineProperty(exports, "__esModule", { value: true });

41exports.configPath = configPath;

42exports.resolveDeployAsset = resolveDeployAsset;

43exports.loadConfig = loadConfig;

44exports.saveConfig = saveConfig;

45exports.gitRemoteUrl = gitRemoteUrl;

46exports.canPrompt = canPrompt;

47exports.awsCapture = awsCapture;

48exports.awsRun = awsRun;

49exports.awsAvailable = awsAvailable;

50exports.stackOutput = stackOutput;

51exports.uploadPlaceholder = uploadPlaceholder;

52exports.ghAvailable = ghAvailable;

53exports.ghAuthenticated = ghAuthenticated;

54exports.ghAuthLogin = ghAuthLogin;

55exports.setRepoVariable = setRepoVariable;

56exports.ask = ask;

57exports.withPrompt = withPrompt;

58const child_process_1 = require("child_process");

59const fs = __importStar(require("fs"));

High

Child Process

Package source references child process execution.

dist/deploy/io.jsView on unpkg · L57

60const os = __importStar(require("os"));

61const path = __importStar(require("path"));

62const readline = __importStar(require("readline"));

63const workflows_1 = require("./workflows");

64const config_1 = require("./config");

65const zip_1 = require("./zip");

66/** Absolute path to the deploy config for a project root. */

67function configPath(cwd = process.cwd()) {

68 return path.join(cwd, workflows_1.CONFIG_PATH);

69}

70/**

71 * Resolve a CloudFormation asset (`app.yaml`, `bootstrap.yaml`, or the

72 * `placeholder/bootstrap` Lambda bundle) to an absolute on-disk path.

73 *

74 * The templates are the **framework's** IaC, not the consumer's — the demo repo

75 * and every future app repo deliberately do not carry a copy (see

76 * deploy/cloudformation/README.md). So `init`/`bootstrap`, which run in those

77 * repos, cannot assume `deploy/cloudformation/<asset>` exists relative to the

src/rastack-update.tsView file

Lines 38-78typescript

38 * `.cmd` spawn is rejected with `EINVAL` since the Node CVE-2024-27980 fix;

39 * false on POSIX so the direct spawn stays injection-free.

40 */

41const NPM_SHELL = npmSpawnShell();

dist/admin.jsView file

Lines 1-37javascript

1window.process=window.process||{env:{}};

dist/rastack-compile.jsView file

Lines 1-32javascript

1#!/usr/bin/env node

2"use strict";

3/**

4 * `rastack compile | check | list | urls` — the TypeScript-first replacement for the

5 * old Django `manage.py rastack` command.

6 *

7 * rastack compile [resourcesDir] [outDir] defs → schema.rastack.json + openapi.json

8 * rastack check [resourcesDir] validate the resource graph (exit != 0 on error)

9 * rastack list [resourcesDir] print every resource + its fields/relations

10 * rastack urls [resourcesDir] print the generated /api/{app}/v1/{model}/ routes

11 */

src/rastack-dev.tsView file

Lines 1-39typescript

1#!/usr/bin/env node

3/**

4 * `rastack dev` — local development, always over the WASM engine.

5 *

6 * rastack dev [resourcesDir] [--port <n>] [--warehouse <dir>] [--out <dir>] [--no-open]

7 *

8 * Compiles the resources, then boots a dependency-free static server (à la

9 * `rastack design`) that hands the browser everything it needs to run the app +

10 * admin locally over WebAssembly — no native server, no cargo:

11 * • the bundled React admin (`/dev/admin.js`),

12 * • the prebuilt WASM engine (`/wasm/…`) shipped in the package,

dist/wasm/rastack_wasm_bg.wasmView file

•path = dist/wasm/rastack_wasm_bg.wasm kind = wasm_module sizeBytes = 9644641 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/wasm/rastack_wasm_bg.wasmView on unpkg