registry / shiply-cli / 0.24.0

shiply-cli@0.24.0

Publish static sites to shiply.now from the command line â€” instant web hosting for agents.

Static Scan Results

scanned 11d ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 34 file(s), 315 KB of source, external domains: shiply.now

Source & flagged code

3 flagged

dist/bundle.jsView file

Lines 1-21javascript

1import { spawnSync } from 'node:child_process';

2import { cp, mkdir, mkdtemp, rm, stat, writeFile } from 'node:fs/promises';

High

Child Process

Package source references child process execution.

dist/bundle.jsView on unpkg · L1

3import { builtinModules } from 'node:module';

4import { tmpdir } from 'node:os';

5import { dirname, isAbsolute, join, relative } from 'node:path';

6import { build } from 'esbuild';

7const BUNDLE_COMPAT_DATE = '2025-05-05';

8/** Cloudflare runtime built-ins (`cloudflare:workers`, …) and Node builtins

9 * (provided by `nodejs_compat`) resolve at the edge — they must stay external.

10 * Node builtins must be matched both `node:`-prefixed AND BARE (`require('fs')`):

11 * OpenNext / Next.js imports them bare, which `node:*` alone doesn't catch.

12 * Derived from `builtinModules` so it stays correct across Node versions. Safe

13 * for every framework — `platform: 'neutral'` never inlines builtins anyway.

14 * Everything else (framework server code an adapter imports) gets inlined. */

15const WORKER_EXTERNALS = [

16 'cloudflare:*',

17 'node:*',

18 ...builtinModules.flatMap((m) => [m, `${m}/*`]),

19];

20/** esbuild-bundle a worker entry into one self-contained ESM module, optionally

21 * wrapping it (named-fetch → default, and/or asset-first) via a synthetic entry.

Lines 83-126javascript

83 await rm(join(out, entryRel.split(/[\\/]/)[0]), { recursive: true, force: true });

84 }

85 }

86 await writeManifest(out, {

87 framework: ssr.framework,

88 entry: 'index.js',

89 modules: [

Source & flagged code

3 flagged · loading source

dist/bundle.jsView file

1import { spawnSync } from 'node:child_process'; L2: import { cp, mkdir, mkdtemp, rm, stat, writeFile } from 'node:fs/promises';

High

Child Process

Package source references child process execution.

dist/bundle.jsView on unpkg · L1

106encoding: 'utf8', L107: shell: true, L108: env: { ...process.env, CLOUDFLARE_API_TOKEN: process.env.CLOUDFLARE_API_TOKEN ?? 'dry-run' },

High

Shell

Package source references shell execution.

dist/bundle.jsView on unpkg · L106

103// (OpenNext projects depend on it) is preferred via npx. shell:true → npx.cmd on Windows. L104: const res = spawnSync('npx', ['wrangler', 'deploy', '--dry-run', '--outdir', wtmp], { L105: cwd: sourceDir,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/bundle.jsView on unpkg · L103

Findings

3 High3 Medium5 Low

HighChild Processdist/bundle.js

HighShelldist/bundle.js

HighRuntime Package Installdist/bundle.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

dist/bundle.jsView file

Lines 1-21javascript

1import { spawnSync } from 'node:child_process';

2import { cp, mkdir, mkdtemp, rm, stat, writeFile } from 'node:fs/promises';

High

Child Process

Package source references child process execution.

dist/bundle.jsView on unpkg · L1

3import { builtinModules } from 'node:module';

4import { tmpdir } from 'node:os';

5import { dirname, isAbsolute, join, relative } from 'node:path';

6import { build } from 'esbuild';

7const BUNDLE_COMPAT_DATE = '2025-05-05';

8/** Cloudflare runtime built-ins (`cloudflare:workers`, …) and Node builtins

9 * (provided by `nodejs_compat`) resolve at the edge — they must stay external.

10 * Node builtins must be matched both `node:`-prefixed AND BARE (`require('fs')`):

11 * OpenNext / Next.js imports them bare, which `node:*` alone doesn't catch.

12 * Derived from `builtinModules` so it stays correct across Node versions. Safe

13 * for every framework — `platform: 'neutral'` never inlines builtins anyway.

14 * Everything else (framework server code an adapter imports) gets inlined. */

15const WORKER_EXTERNALS = [

16 'cloudflare:*',

17 'node:*',

18 ...builtinModules.flatMap((m) => [m, `${m}/*`]),

19];

20/** esbuild-bundle a worker entry into one self-contained ESM module, optionally

21 * wrapping it (named-fetch → default, and/or asset-first) via a synthetic entry.

Lines 83-126javascript

83 await rm(join(out, entryRel.split(/[\\/]/)[0]), { recursive: true, force: true });

84 }

85 }

86 await writeManifest(out, {

87 framework: ssr.framework,

88 entry: 'index.js',

89 modules: [