registry / stacktora / 0.1.2

stacktora@0.1.2

Keep your project's dev-environment files in sync with its stack recipe (stacktora.json).

Static Scan Results

scanned 14d ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 7 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

DynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 281 KB of source, external domains: 0.0.0.0, 192.168.1.20, api.github.com, asdf-vm.com, containers.dev, direnv.net, docs.docker.com, editorconfig.org, github.com, gitpod.io, maven.apache.org, pre-commit.com, reactnative.dev, taskfile.dev, www.npmjs.com

Source & flagged code

1 flagged

bin/stacktora.jsView file

Lines 1-23javascript

1#!/usr/bin/env node

2/* Stacktora CLI — keep a project's dev-environment files in sync with its stack recipe (stacktora.json). */

3'use strict';

4const fs = require('fs'), path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/stacktora.jsView on unpkg · L3

6let engine;

7try { engine = require(path.join(__dirname, '..', 'engine.js')); }

8catch (e) { console.error('Stacktora engine failed to load: ' + e.message); process.exit(1); }

10const MANIFEST = 'stacktora.json';

11const SKIP = new Set(['.env']); // never overwrite real local secrets

13const tty = process.stdout.isTTY;

14const c = (n, s) => tty ? '[' + n + 'm' + s + '[0m' : s;

15const g = s => c('32', s), y = s => c('33', s), dim = s => c('90', s), b = s => c('1', s);

17/* silent telemetry — fire-and-forget, never blocks, never crashes the CLI */

18function ping(cmd) {

19 try {

20 const https = require('https');

21 const body = JSON.stringify({ cmd, v: engine.version || '0.1.0' });

22 const req = https.request({ hostname: 'stacktora.com', path: '/api/cli-ping.php', method: 'POST',

23 headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(body) } });

Source & flagged code

1 flagged · loading source

bin/stacktora.jsView file

3'use strict'; L4: const fs = require('fs'), path = require('path'); L5:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/stacktora.jsView on unpkg · L3

Findings

3 Medium4 Low

MediumDynamic Requirebin/stacktora.js

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

1 flagged

bin/stacktora.jsView file

Lines 1-23javascript

1#!/usr/bin/env node

2/* Stacktora CLI — keep a project's dev-environment files in sync with its stack recipe (stacktora.json). */

3'use strict';

4const fs = require('fs'), path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/stacktora.jsView on unpkg · L3

6let engine;

7try { engine = require(path.join(__dirname, '..', 'engine.js')); }

8catch (e) { console.error('Stacktora engine failed to load: ' + e.message); process.exit(1); }

10const MANIFEST = 'stacktora.json';

11const SKIP = new Set(['.env']); // never overwrite real local secrets

13const tty = process.stdout.isTTY;

14const c = (n, s) => tty ? '[' + n + 'm' + s + '[0m' : s;

15const g = s => c('32', s), y = s => c('33', s), dim = s => c('90', s), b = s => c('1', s);

17/* silent telemetry — fire-and-forget, never blocks, never crashes the CLI */

18function ping(cmd) {

19 try {

20 const https = require('https');

21 const body = JSON.stringify({ cmd, v: engine.version || '0.1.0' });

22 const req = https.request({ hostname: 'stacktora.com', path: '/api/cli-ping.php', method: 'POST',

23 headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(body) } });