registry / tegami / 1.1.3

tegami@1.1.3

A tool to manage changelogs, versioning, and publishing in monorepo

Static Scan Results

scanned 1d ago · by rust-scanner

Static analysis flagged 7 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 21 file(s), 244 KB of source, external domains: api.github.com, crates.io, github.com, gitlab.com, proxy.golang.org, registry.npmjs.org, tegami.fuma-nama.dev

Source & flagged code

1 flagged

dist/plugins/gitlab.jsView file

Lines 3-43javascript

3import { a as cached, n as execFailure, o as isCI, s as joinPath } from "../error-BhMYq9iW.js";

4import { o as readChangelogEntries, t as createDraft } from "../draft-CzUiQasJ.js";

5import { git } from "./git.js";

6import { t as onVersionRequest } from "../version-request-DlLpLLK3.js";

7import { readFile, writeFile } from "node:fs/promises";

8import { basename, join, relative, resolve } from "node:path";

9import { x } from "tinyexec";

10import { resolveCommand } from "package-manager-detector";

11import { note, outro } from "@clack/prompts";

12//#region src/plugins/gitlab/api.ts

13function parseGitLabRepo(repo) {

14 const projectPath = repo.replace(/^\/+|\/+$/g, "");

15 if (!projectPath || !projectPath.includes("/")) throw new Error(`Invalid GitLab repository: ${repo}`);

16 return {

17 projectPath,

18 encodedProjectPath: encodeURIComponent(projectPath)

19 };

20}

21async function gitlabRequest(options, path, init = {}) {

22 const headers = new Headers(init.headers);

23 headers.set("Accept", "application/json");

24 if (options.token) headers.set(options.token.type === "job-token" ? "JOB-TOKEN" : "PRIVATE-TOKEN", options.token.value);

25 return fetch(joinPath(options.apiUrl ?? "https://gitlab.com/api/v4", path), {

26 ...init,

27 headers

28 });

29}

30async function releaseExistsByTag(repo, tag, options = {}) {

31 const { encodedProjectPath } = parseGitLabRepo(repo);

32 const response = await gitlabRequest(options, `/projects/${encodedProjectPath}/releases/${encodeURIComponent(tag)}`, { method: "HEAD" });

33 if (response.status === 404) return false;

34 if (!response.ok) throw new Error(`Failed to get GitLab release for ${tag}.`);

35 return true;

36}

37async function createRelease(repo, options) {

38 const { encodedProjectPath } = parseGitLabRepo(repo);

39 if (!(await gitlabRequest(options, `/projects/${encodedProjectPath}/releases`, {

40 method: "POST",

41 headers: { "Content-Type": "application/json" },

42 body: JSON.stringify({

43 tag_name: options.tag,

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/plugins/gitlab.jsView on unpkg · L23

Source & flagged code

1 flagged · loading source

dist/plugins/gitlab.jsView file

23headers.set("Accept", "application/json"); L24: if (options.token) headers.set(options.token.type === "job-token" ? "JOB-TOKEN" : "PRIVATE-TOKEN", options.token.value); L25: return fetch(joinPath(options.apiUrl ?? "https://gitlab.com/api/v4", path), { L26: ...init, ... L41: headers: { "Content-Type": "application/json" }, L42: body: JSON.stringify({ L43: tag_name: options.tag, ... L57: if (!response.ok) throw new Error("Failed to check for an existing version merge request."); L58: return (await response.json())[0]?.iid; L59: } ... L165: if (isCI()) { L166: process.stdout.write(`${body}\n`);

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/plugins/gitlab.jsView on unpkg · L23

Findings

1 High2 Medium4 Low

HighSandbox Evasion Gated Capabilitydist/plugins/gitlab.js

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

1 flagged

dist/plugins/gitlab.jsView file

Lines 3-43javascript

3import { a as cached, n as execFailure, o as isCI, s as joinPath } from "../error-BhMYq9iW.js";

4import { o as readChangelogEntries, t as createDraft } from "../draft-CzUiQasJ.js";

5import { git } from "./git.js";

6import { t as onVersionRequest } from "../version-request-DlLpLLK3.js";

7import { readFile, writeFile } from "node:fs/promises";

8import { basename, join, relative, resolve } from "node:path";

9import { x } from "tinyexec";

10import { resolveCommand } from "package-manager-detector";

11import { note, outro } from "@clack/prompts";

12//#region src/plugins/gitlab/api.ts

13function parseGitLabRepo(repo) {

14 const projectPath = repo.replace(/^\/+|\/+$/g, "");

15 if (!projectPath || !projectPath.includes("/")) throw new Error(`Invalid GitLab repository: ${repo}`);

16 return {

17 projectPath,

18 encodedProjectPath: encodeURIComponent(projectPath)

19 };

20}

21async function gitlabRequest(options, path, init = {}) {

22 const headers = new Headers(init.headers);

23 headers.set("Accept", "application/json");

24 if (options.token) headers.set(options.token.type === "job-token" ? "JOB-TOKEN" : "PRIVATE-TOKEN", options.token.value);

25 return fetch(joinPath(options.apiUrl ?? "https://gitlab.com/api/v4", path), {

26 ...init,

27 headers

28 });

29}

30async function releaseExistsByTag(repo, tag, options = {}) {

31 const { encodedProjectPath } = parseGitLabRepo(repo);

32 const response = await gitlabRequest(options, `/projects/${encodedProjectPath}/releases/${encodeURIComponent(tag)}`, { method: "HEAD" });

33 if (response.status === 404) return false;

34 if (!response.ok) throw new Error(`Failed to get GitLab release for ${tag}.`);

35 return true;

36}

37async function createRelease(repo, options) {

38 const { encodedProjectPath } = parseGitLabRepo(repo);

39 if (!(await gitlabRequest(options, `/projects/${encodedProjectPath}/releases`, {

40 method: "POST",

41 headers: { "Content-Type": "application/json" },

42 body: JSON.stringify({

43 tag_name: options.tag,

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/plugins/gitlab.jsView on unpkg · L23