registry / shiply-cli / 0.27.1

shiply-cli@0.27.1

Publish static sites to shiply.now from the command line â€” instant web hosting for agents.

Static Scan Results

scanned 3d ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 36 file(s), 350 KB of source, external domains: shiply.now

Source & flagged code

3 flagged

dist/bundle.jsView file

Lines 1-21javascript

1import { spawnSync } from 'node:child_process';

2import { createHash } from 'node:crypto';

High

Child Process

Package source references child process execution.

dist/bundle.jsView on unpkg · L1

3import { cp, mkdir, mkdtemp, readFile, readdir, rm, stat, writeFile } from 'node:fs/promises';

4import { builtinModules } from 'node:module';

5import { tmpdir } from 'node:os';

6import { dirname, isAbsolute, join, relative } from 'node:path';

7import { build } from 'esbuild';

8const BUNDLE_COMPAT_DATE = '2025-05-05';

9/** Cloudflare runtime built-ins (`cloudflare:workers`, …) and Node builtins

10 * (provided by `nodejs_compat`) resolve at the edge — they must stay external.

11 * Node builtins must be matched both `node:`-prefixed AND BARE (`require('fs')`):

12 * OpenNext / Next.js imports them bare, which `node:*` alone doesn't catch.

13 * Derived from `builtinModules` so it stays correct across Node versions. Safe

14 * for every framework — `platform: 'neutral'` never inlines builtins anyway.

15 * Everything else (framework server code an adapter imports) gets inlined. */

16const WORKER_EXTERNALS = [

17 'cloudflare:*',

18 'node:*',

19 ...builtinModules.flatMap((m) => [m, `${m}/*`]),

20];

21/** esbuild-bundle a worker entry into one self-contained ESM module, optionally

Lines 151-194javascript

151 * entry. Two modules: index.js (entry) imports ./worker.js (wrangler's bundle).

152 *

153 * The wrangler bundle is CACHED per project (node_modules/.cache/shiply),

154 * keyed on the build-output tree + wrangler config/version: the dry-run takes

Source & flagged code

3 flagged · loading source

dist/bundle.jsView file

1import { spawnSync } from 'node:child_process'; L2: import { createHash } from 'node:crypto';

High

Child Process

Package source references child process execution.

dist/bundle.jsView on unpkg · L1

174encoding: 'utf8', L175: shell: true, L176: env: { ...process.env, CLOUDFLARE_API_TOKEN: process.env.CLOUDFLARE_API_TOKEN ?? 'dry-run' },

High

Shell

Package source references shell execution.

dist/bundle.jsView on unpkg · L174

171// (OpenNext projects depend on it) is preferred via npx. shell:true → npx.cmd on Windows. L172: const res = spawnSync('npx', ['wrangler', 'deploy', '--dry-run', '--outdir', wtmp], { L173: cwd: sourceDir,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/bundle.jsView on unpkg · L171

Findings

3 High3 Medium5 Low

HighChild Processdist/bundle.js

HighShelldist/bundle.js

HighRuntime Package Installdist/bundle.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

dist/bundle.jsView file

Lines 1-21javascript

1import { spawnSync } from 'node:child_process';

2import { createHash } from 'node:crypto';

High

Child Process

Package source references child process execution.

dist/bundle.jsView on unpkg · L1

3import { cp, mkdir, mkdtemp, readFile, readdir, rm, stat, writeFile } from 'node:fs/promises';

4import { builtinModules } from 'node:module';

5import { tmpdir } from 'node:os';

6import { dirname, isAbsolute, join, relative } from 'node:path';

7import { build } from 'esbuild';

8const BUNDLE_COMPAT_DATE = '2025-05-05';

9/** Cloudflare runtime built-ins (`cloudflare:workers`, …) and Node builtins

10 * (provided by `nodejs_compat`) resolve at the edge — they must stay external.

11 * Node builtins must be matched both `node:`-prefixed AND BARE (`require('fs')`):

12 * OpenNext / Next.js imports them bare, which `node:*` alone doesn't catch.

13 * Derived from `builtinModules` so it stays correct across Node versions. Safe

14 * for every framework — `platform: 'neutral'` never inlines builtins anyway.

15 * Everything else (framework server code an adapter imports) gets inlined. */

16const WORKER_EXTERNALS = [

17 'cloudflare:*',

18 'node:*',

19 ...builtinModules.flatMap((m) => [m, `${m}/*`]),

20];

21/** esbuild-bundle a worker entry into one self-contained ESM module, optionally

Lines 151-194javascript

151 * entry. Two modules: index.js (entry) imports ./worker.js (wrangler's bundle).

152 *

153 * The wrangler bundle is CACHED per project (node_modules/.cache/shiply),

154 * keyed on the build-output tree + wrangler config/version: the dry-run takes