registry / storyblok / 4.18.2

storyblok@4.18.2

Storyblok CLI

Static Scan Results

scanned 9d ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 330 KB of source, external domains: app.storyblok.com, github.com, www.storyblok.com

Source & flagged code

5 flagged

dist/index.mjsView file

Lines 1-36javascript

1#!/usr/bin/env node

2import 'dotenv/config';

3import { fileURLToPath, pathToFileURL } from 'node:url';

4import { resolve, dirname, join, parse, extname, relative, isAbsolute, basename } from 'pathe';

5import { existsSync, mkdirSync, appendFileSync, writeFileSync, readdirSync, unlinkSync, readFileSync } from 'node:fs';

6import { homedir } from 'node:os';

7import { loadConfig as loadConfig$1, SUPPORTED_EXTENSIONS } from 'c12';

8import chalk from 'chalk';

9import { readPackageUp } from 'read-package-up';

10import { Command } from 'commander';

11import { MultiBar, Presets } from 'cli-progress';

12import { Spinner } from '@topcli/spinner';

13import fs, { mkdir, writeFile, readdir, readFile as readFile$1, appendFile, access, constants, unlink } from 'node:fs/promises';

14import filenamify from 'filenamify';

15import { createManagementApiClient, normalizeAssetUrl } from '@storyblok/management-api-client';

16import { select, password, input, confirm } from '@inquirer/prompts';

17import { exec, spawn } from 'node:child_process';

18import { promisify } from 'node:util';

High

Child Process

Package source references child process execution.

dist/index.mjsView on unpkg · L16

19import { minimatch } from 'minimatch';

20import { Readable, pipeline, Transform, Writable } from 'node:stream';

21import { Sema } from 'async-sema';

22import { hash } from 'ohash';

23import { compile } from 'json-schema-to-typescript';

24import open from 'open';

25import { Octokit } from 'octokit';

26import { pipeline as pipeline$1 } from 'node:stream/promises';

27import { Buffer } from 'node:buffer';

28import Storyblok from 'storyblok-js-client';

30const commands = {

31 LOGIN: "login",

32 LOGOUT: "logout",

33 SIGNUP: "signup",

34 USER: "user",

35 COMPONENTS: "components",

36 LANGUAGES: "languages",

Lines 669-709javascript

669 throw error;

670 }

671 throw new FetchError(error instanceof Error ? error.message : String(error), {

672 status: 0,

673 statusText: "Network Error",

674 data: null

675 }, requestContext);

676

Lines 1397-1437javascript

1397 try {

1398 const files = await readdir(directoryPath);

1399 return files;

1400 } catch (maybeError) {

1401 handleFileSystemError("read", toError(maybeError));

1402 return [];

1403 }

Lines 2214-2254javascript

2214

2215const program$d = getProgram();

2216program$d.command(commands.LOGOUT).description("Logout from the Storyblok CLI").action(async () => {

2217 konsola.title(`${commands.LOGOUT}`, colorPalette.LOGOUT);

2218 const

Lines 6672-6712javascript

6672 }

6673};

6674

6675const ui$1 = getUI({ enabled: true });

6676const generateProject = async (blueprint, projectName, targetPath = process.cwd()) => {

6677 try {

Source & flagged code

5 flagged · loading source

dist/index.mjsView file

16import { select, password, input, confirm } from '@inquirer/prompts'; L17: import { exec, spawn } from 'node:child_process'; L18: import { promisify } from 'node:util';

High

Child Process

Package source references child process execution.

dist/index.mjsView on unpkg · L16

2234L2235: const execAsync = promisify(exec); L2236: function buildSignupUrl() {

High

Shell

Package source references shell execution.

dist/index.mjsView on unpkg · L2234

6692} L6693: const degitProcess = spawn("npx", ["degit", templateRepo, projectPath], { L6694: stdio: "inherit",

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.mjsView on unpkg · L6692

1417function importModule(filePath) { L1418: return import(pathToFileURL(filePath).href); L1419: }

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.mjsView on unpkg · L1417

689patternName = generic_password severity = medium line = 689 matchedText = login_em...rd",

Medium

Secret Pattern

Hardcoded password in dist/index.mjs

dist/index.mjsView on unpkg · L689

Findings

3 High5 Medium4 Low

HighChild Processdist/index.mjs

HighShelldist/index.mjs

HighRuntime Package Installdist/index.mjs

MediumDynamic Requiredist/index.mjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumSecret Patterndist/index.mjs

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

5 flagged

dist/index.mjsView file

Lines 1-36javascript

1#!/usr/bin/env node

2import 'dotenv/config';

3import { fileURLToPath, pathToFileURL } from 'node:url';

4import { resolve, dirname, join, parse, extname, relative, isAbsolute, basename } from 'pathe';

5import { existsSync, mkdirSync, appendFileSync, writeFileSync, readdirSync, unlinkSync, readFileSync } from 'node:fs';

6import { homedir } from 'node:os';

7import { loadConfig as loadConfig$1, SUPPORTED_EXTENSIONS } from 'c12';

8import chalk from 'chalk';

9import { readPackageUp } from 'read-package-up';

10import { Command } from 'commander';

11import { MultiBar, Presets } from 'cli-progress';

12import { Spinner } from '@topcli/spinner';

13import fs, { mkdir, writeFile, readdir, readFile as readFile$1, appendFile, access, constants, unlink } from 'node:fs/promises';

14import filenamify from 'filenamify';

15import { createManagementApiClient, normalizeAssetUrl } from '@storyblok/management-api-client';

16import { select, password, input, confirm } from '@inquirer/prompts';

17import { exec, spawn } from 'node:child_process';

18import { promisify } from 'node:util';

High

Child Process

Package source references child process execution.

dist/index.mjsView on unpkg · L16

19import { minimatch } from 'minimatch';

20import { Readable, pipeline, Transform, Writable } from 'node:stream';

21import { Sema } from 'async-sema';

22import { hash } from 'ohash';

23import { compile } from 'json-schema-to-typescript';

24import open from 'open';

25import { Octokit } from 'octokit';

26import { pipeline as pipeline$1 } from 'node:stream/promises';

27import { Buffer } from 'node:buffer';

28import Storyblok from 'storyblok-js-client';

30const commands = {

31 LOGIN: "login",

32 LOGOUT: "logout",

33 SIGNUP: "signup",

34 USER: "user",

35 COMPONENTS: "components",

36 LANGUAGES: "languages",

Lines 669-709javascript

669 throw error;

670 }

671 throw new FetchError(error instanceof Error ? error.message : String(error), {

672 status: 0,

673 statusText: "Network Error",

674 data: null

675 }, requestContext);

676

Lines 1397-1437javascript

1397 try {

1398 const files = await readdir(directoryPath);

1399 return files;

1400 } catch (maybeError) {

1401 handleFileSystemError("read", toError(maybeError));

1402 return [];

1403 }

Lines 2214-2254javascript

2214

2215const program$d = getProgram();

2216program$d.command(commands.LOGOUT).description("Logout from the Storyblok CLI").action(async () => {

2217 konsola.title(`${commands.LOGOUT}`, colorPalette.LOGOUT);

2218 const

Lines 6672-6712javascript

6672 }

6673};

6674

6675const ui$1 = getUI({ enabled: true });

6676const generateProject = async (blueprint, projectName, targetPath = process.cwd()) => {

6677 try {