registry / tina4js / 1.5.0

tina4js@1.5.0

1.5KB core gzipped, reactive framework — signals, web components, routing, PWA

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 30 file(s), 150 KB of source, external domains: github.com

Source & flagged code

3 flagged

bin/tina4.jsView file

Lines 1-36javascript

1#!/usr/bin/env node

3/**

4 * Tina4 CLI — Project scaffolding and build tooling.

5 *

6 * Usage:

7 * npx tina4js create <name> Scaffold a new project

8 * npx tina4js create <name> --pwa Include PWA support

9 * npx tina4 build Production build

10 * npx tina4 build --target php Build for tina4-php embedding

11 * npx tina4 build --target python Build for tina4-python embedding

12 * npx tina4 dev Dev server with HMR

13 */

15import fs from 'node:fs';

16import path from 'node:path';

17import { execSync } from 'node:child_process';

18import { fileURLToPath } from 'node:url';

High

Child Process

Package source references child process execution.

bin/tina4.jsView on unpkg · L16

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/tina4.jsView on unpkg · L6

20const __filename = fileURLToPath(import.meta.url);

21const __dirname = path.dirname(__filename);

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

bin/tina4.jsView on unpkg · L16

23const args = process.argv.slice(2);

24const command = args[0];

26// ── Colors (no dependencies) ────────────────────────────────────────

28const c = {

29 green: (s) => `\x1b[32m${s}\x1b[0m`,

30 cyan: (s) => `\x1b[36m${s}\x1b[0m`,

31 yellow: (s) => `\x1b[33m${s}\x1b[0m`,

32 dim: (s) => `\x1b[2m${s}\x1b[0m`,

33 bold: (s) => `\x1b[1m${s}\x1b[0m`,

34};

36// ── Commands ────────────────────────────────────────────────────────

Source & flagged code

3 flagged · loading source

bin/tina4.jsView file

16import path from 'node:path'; L17: import { execSync } from 'node:child_process'; L18: import { fileURLToPath } from 'node:url';

High

Child Process

Package source references child process execution.

bin/tina4.jsView on unpkg · L16

16Manifest entrypoint (manifest.bin) carries capability families absent from dist/build output: environment+network, sensitive-file+network, execution+network L16: import path from 'node:path'; L17: import { execSync } from 'node:child_process'; L18: import { fileURLToPath } from 'node:url'; ... L20: const __filename = fileURLToPath(import.meta.url); L21: const __dirname = path.dirname(__filename); L22: ... L87: L88: // ── package.json ────────────────────────────────────────────── L89: ... L136: // Proxy API calls to tina4-php/python backend in dev L137: // proxy: { '/api': 'http://localhost:7145' }, L138: },

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

bin/tina4.jsView on unpkg · L16

6* Usage: L7: * npx tina4js create <name> Scaffold a new project L8: * npx tina4js create <name> --pwa Include PWA support ... L16: import path from 'node:path'; L17: import { execSync } from 'node:child_process'; L18: import { fileURLToPath } from 'node:url';

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/tina4.jsView on unpkg · L6

Findings

4 High2 Medium4 Low

HighChild Processbin/tina4.js

HighShell

HighEntrypoint Build Divergencebin/tina4.js

HighRuntime Package Installbin/tina4.js

MediumNetwork

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

bin/tina4.jsView file

Lines 1-36javascript

1#!/usr/bin/env node

3/**

4 * Tina4 CLI — Project scaffolding and build tooling.

5 *

6 * Usage:

7 * npx tina4js create <name> Scaffold a new project

8 * npx tina4js create <name> --pwa Include PWA support

9 * npx tina4 build Production build

10 * npx tina4 build --target php Build for tina4-php embedding

11 * npx tina4 build --target python Build for tina4-python embedding

12 * npx tina4 dev Dev server with HMR

13 */

15import fs from 'node:fs';

16import path from 'node:path';

17import { execSync } from 'node:child_process';

18import { fileURLToPath } from 'node:url';

High

Child Process

Package source references child process execution.

bin/tina4.jsView on unpkg · L16

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/tina4.jsView on unpkg · L6

20const __filename = fileURLToPath(import.meta.url);

21const __dirname = path.dirname(__filename);

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

bin/tina4.jsView on unpkg · L16

23const args = process.argv.slice(2);

24const command = args[0];

26// ── Colors (no dependencies) ────────────────────────────────────────

28const c = {

29 green: (s) => `\x1b[32m${s}\x1b[0m`,

30 cyan: (s) => `\x1b[36m${s}\x1b[0m`,

31 yellow: (s) => `\x1b[33m${s}\x1b[0m`,

32 dim: (s) => `\x1b[2m${s}\x1b[0m`,

33 bold: (s) => `\x1b[1m${s}\x1b[0m`,

34};

36// ── Commands ────────────────────────────────────────────────────────