registry / storyblok / 4.19.1

storyblok@4.19.1

⚠ Under review

Storyblok CLI

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 360 KB of source, external domains: app.storyblok.com, github.com, www.storyblok.com

Source & flagged code

6 flagged

dist/index.mjsView file

Lines 1-36javascript

1#!/usr/bin/env node

2import 'dotenv/config';

3import { fileURLToPath, pathToFileURL } from 'node:url';

4import { resolve, dirname, join, parse, extname, relative, isAbsolute, basename } from 'pathe';

5import { existsSync, mkdirSync, appendFileSync, writeFileSync, readdirSync, unlinkSync, readFileSync } from 'node:fs';

6import { homedir } from 'node:os';

7import { loadConfig as loadConfig$1, SUPPORTED_EXTENSIONS } from 'c12';

8import chalk from 'chalk';

9import { readPackageUp } from 'read-package-up';

10import { Command, Option } from 'commander';

11import { MultiBar, Presets } from 'cli-progress';

12import { Spinner } from '@topcli/spinner';

13import fs, { mkdir, writeFile, readdir, readFile as readFile$1, appendFile, access, constants, unlink } from 'node:fs/promises';

14import filenamify from 'filenamify';

15import { createManagementApiClient, normalizeAssetUrl } from '@storyblok/management-api-client';

16import { select, password, input, confirm } from '@inquirer/prompts';

17import { exec, spawn } from 'node:child_process';

18import { promisify } from 'node:util';

High

Child Process

Package source references child process execution.

dist/index.mjsView on unpkg · L16

19import { minimatch } from 'minimatch';

20import { Readable, pipeline, Transform, Writable } from 'node:stream';

21import { Sema } from 'async-sema';

22import { hash } from 'ohash';

23import { compile } from 'json-schema-to-typescript';

24import open from 'open';

25import { Octokit } from 'octokit';

26import { pipeline as pipeline$1 } from 'node:stream/promises';

27import { Buffer } from 'node:buffer';

28import Storyblok from 'storyblok-js-client';

30const commands = {

31 LOGIN: "login",

32 LOGOUT: "logout",

33 SIGNUP: "signup",

34 USER: "user",

35 COMPONENTS: "components",

36 LANGUAGES: "languages",

Lines 669-709javascript

669 throw error;

670 }

671 throw new FetchError(error instanceof Error ? error.message : String(error), {

672 status: 0,

673 statusText: "Network Error",

674 data: null

675 }, requestContext);

676

Lines 1406-1446javascript

1406 try {

1407 const files = await readdir(directoryPath);

1408 return files;

1409 } catch (maybeError) {

1410 handleFileSystemError("read", toError(maybeError));

1411 return [];

1412 }

Lines 2231-2271javascript

2231

2232const program$d = getProgram();

2233program$d.command(commands.LOGOUT).description("Logout from the Storyblok CLI").action(async () => {

2234 konsola.title(`${commands.LOGOUT}`, colorPalette.LOGOUT);

2235 const

Lines 6776-6816javascript

6776 }

6777};

6778

6779const ui$1 = getUI({ enabled: true });

6780const generateProject = async (blueprint, projectName, targetPath = process.cwd()) => {

6781 try {

•matchType = previous_version_dangerous_delta matchedPackage = storyblok@4.18.2 matchedIdentity = npm:c3RvcnlibG9r:4.18.2 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.mjsView on unpkg

Source & flagged code

6 flagged · loading source

dist/index.mjsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.mjsView on unpkg

16import { select, password, input, confirm } from '@inquirer/prompts'; L17: import { exec, spawn } from 'node:child_process'; L18: import { promisify } from 'node:util';

High

Child Process

Package source references child process execution.

dist/index.mjsView on unpkg · L16

2251L2252: const execAsync = promisify(exec); L2253: function buildSignupUrl() {

High

Shell

Package source references shell execution.

dist/index.mjsView on unpkg · L2251

6796} L6797: const degitProcess = spawn("npx", ["degit", templateRepo, projectPath], { L6798: stdio: "inherit",

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.mjsView on unpkg · L6796

1426function importModule(filePath) { L1427: return import(pathToFileURL(filePath).href); L1428: }

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.mjsView on unpkg · L1426

689patternName = generic_password severity = medium line = 689 matchedText = login_em...rd",

Medium

Secret Pattern

Hardcoded password in dist/index.mjs

dist/index.mjsView on unpkg · L689

Findings

1 Critical3 High5 Medium4 Low

CriticalPrevious Version Dangerous Deltadist/index.mjs

HighChild Processdist/index.mjs

HighShelldist/index.mjs

HighRuntime Package Installdist/index.mjs

MediumDynamic Requiredist/index.mjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumSecret Patterndist/index.mjs

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

6 flagged

dist/index.mjsView file

Lines 1-36javascript

1#!/usr/bin/env node

2import 'dotenv/config';

3import { fileURLToPath, pathToFileURL } from 'node:url';

4import { resolve, dirname, join, parse, extname, relative, isAbsolute, basename } from 'pathe';

5import { existsSync, mkdirSync, appendFileSync, writeFileSync, readdirSync, unlinkSync, readFileSync } from 'node:fs';

6import { homedir } from 'node:os';

7import { loadConfig as loadConfig$1, SUPPORTED_EXTENSIONS } from 'c12';

8import chalk from 'chalk';

9import { readPackageUp } from 'read-package-up';

10import { Command, Option } from 'commander';

11import { MultiBar, Presets } from 'cli-progress';

12import { Spinner } from '@topcli/spinner';

13import fs, { mkdir, writeFile, readdir, readFile as readFile$1, appendFile, access, constants, unlink } from 'node:fs/promises';

14import filenamify from 'filenamify';

15import { createManagementApiClient, normalizeAssetUrl } from '@storyblok/management-api-client';

16import { select, password, input, confirm } from '@inquirer/prompts';

17import { exec, spawn } from 'node:child_process';

18import { promisify } from 'node:util';

High

Child Process

Package source references child process execution.

dist/index.mjsView on unpkg · L16

19import { minimatch } from 'minimatch';

20import { Readable, pipeline, Transform, Writable } from 'node:stream';

21import { Sema } from 'async-sema';

22import { hash } from 'ohash';

23import { compile } from 'json-schema-to-typescript';

24import open from 'open';

25import { Octokit } from 'octokit';

26import { pipeline as pipeline$1 } from 'node:stream/promises';

27import { Buffer } from 'node:buffer';

28import Storyblok from 'storyblok-js-client';

30const commands = {

31 LOGIN: "login",

32 LOGOUT: "logout",

33 SIGNUP: "signup",

34 USER: "user",

35 COMPONENTS: "components",

36 LANGUAGES: "languages",

Lines 669-709javascript

669 throw error;

670 }

671 throw new FetchError(error instanceof Error ? error.message : String(error), {

672 status: 0,

673 statusText: "Network Error",

674 data: null

675 }, requestContext);

676

Lines 1406-1446javascript

1406 try {

1407 const files = await readdir(directoryPath);

1408 return files;

1409 } catch (maybeError) {

1410 handleFileSystemError("read", toError(maybeError));

1411 return [];

1412 }

Lines 2231-2271javascript

2231

2232const program$d = getProgram();

2233program$d.command(commands.LOGOUT).description("Logout from the Storyblok CLI").action(async () => {

2234 konsola.title(`${commands.LOGOUT}`, colorPalette.LOGOUT);

2235 const

Lines 6776-6816javascript

6776 }

6777};

6778

6779const ui$1 = getUI({ enabled: true });

6780const generateProject = async (blueprint, projectName, targetPath = process.cwd()) => {

6781 try {

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.mjsView on unpkg