registry / trackfox / 1.1.0

trackfox@1.1.0

TrackFox Analytics CLI - instrument websites and view analytics from your terminal

Static Scan Results

scanned 14h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 42 file(s), 106 KB of source, external domains: trackfox.app, www.w3.org

Source & flagged code

2 flagged

src/installers/electron.jsView file

Lines 1-55javascript

1import fs from 'fs';

2import path from 'path';

3import { execSync } from 'child_process';

4import chalk from 'chalk';

High

Child Process

Package source references child process execution.

src/installers/electron.jsView on unpkg · L2

6/**

7 * Auto-install the trackfox-electron SDK into an Electron project's main process file.

8 * Falls back to manual instructions if the main file cannot be found.

9 */

10export async function installElectron(websiteId, detection, apiUrl = 'https://trackfox.app', domain) {

11 const { projectDir, files = {}, version } = detection;

12 const mainFile = files.mainFile || null;

14 // ── Early return: already installed ──────────────────────────────────────

15 if (mainFile && fs.existsSync(mainFile)) {

16 const existing = fs.readFileSync(mainFile, 'utf-8');

17 if (existing.includes('trackfox-electron')) {

18 return { success: true, alreadyInstalled: true, modifiedFiles: [] };

19 }

20 }

22 // ── npm install trackfox-electron ─────────────────────────────────────────

23 const alreadyInDeps = (() => {

24 try {

25 const pkgPath = path.join(projectDir, 'package.json');

26 const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf-8'));

27 const deps = { ...pkg.dependencies, ...pkg.devDependencies };

28 return 'trackfox-electron' in deps;

29 } catch {

30 return false;

31 }

32 })();

34 if (!alreadyInDeps) {

35 try {

36 execSync('npm install trackfox-electron', { cwd: projectDir, stdio: 'ignore' });

37 } catch (err) {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/installers/electron.jsView on unpkg · L35

38 return { success: false, error: `npm install trackfox-electron failed: ${err.message}` };

39 }

40 }

42 // ── No main file found → fall back to manual instructions ─────────────────

43 if (!mainFile) {

44 printManualInstructions(websiteId, domain, apiUrl, version);

45 return { success: true, modifiedFiles: [], isElectron: true };

46 }

48 // ── Read, backup, inject ──────────────────────────────────────────────────

49 let content;

50 try {

51 content = fs.readFileSync(mainFile, 'utf-8');

52 } catch (err) {

53 return { success: false, error: `Could not read ${mainFile}: ${err.message}` };

54 }

Source & flagged code

2 flagged · loading source

src/installers/electron.jsView file

2import path from 'path'; L3: import { execSync } from 'child_process'; L4: import chalk from 'chalk';

High

Child Process

Package source references child process execution.

src/installers/electron.jsView on unpkg · L2

35try { L36: execSync('npm install trackfox-electron', { cwd: projectDir, stdio: 'ignore' }); L37: } catch (err) {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/installers/electron.jsView on unpkg · L35

Findings

3 High3 Medium4 Low

HighChild Processsrc/installers/electron.js

HighShell

HighRuntime Package Installsrc/installers/electron.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

src/installers/electron.jsView file

Lines 1-55javascript

1import fs from 'fs';

2import path from 'path';

3import { execSync } from 'child_process';

4import chalk from 'chalk';

High

Child Process

Package source references child process execution.

src/installers/electron.jsView on unpkg · L2

6/**

7 * Auto-install the trackfox-electron SDK into an Electron project's main process file.

8 * Falls back to manual instructions if the main file cannot be found.

9 */

10export async function installElectron(websiteId, detection, apiUrl = 'https://trackfox.app', domain) {

11 const { projectDir, files = {}, version } = detection;

12 const mainFile = files.mainFile || null;

14 // ── Early return: already installed ──────────────────────────────────────

15 if (mainFile && fs.existsSync(mainFile)) {

16 const existing = fs.readFileSync(mainFile, 'utf-8');

17 if (existing.includes('trackfox-electron')) {

18 return { success: true, alreadyInstalled: true, modifiedFiles: [] };

19 }

20 }

22 // ── npm install trackfox-electron ─────────────────────────────────────────

23 const alreadyInDeps = (() => {

24 try {

25 const pkgPath = path.join(projectDir, 'package.json');

26 const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf-8'));

27 const deps = { ...pkg.dependencies, ...pkg.devDependencies };

28 return 'trackfox-electron' in deps;

29 } catch {

30 return false;

31 }

32 })();

34 if (!alreadyInDeps) {

35 try {

36 execSync('npm install trackfox-electron', { cwd: projectDir, stdio: 'ignore' });

37 } catch (err) {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/installers/electron.jsView on unpkg · L35

38 return { success: false, error: `npm install trackfox-electron failed: ${err.message}` };

39 }

40 }

42 // ── No main file found → fall back to manual instructions ─────────────────

43 if (!mainFile) {

44 printManualInstructions(websiteId, domain, apiUrl, version);

45 return { success: true, modifiedFiles: [], isElectron: true };

46 }

48 // ── Read, backup, inject ──────────────────────────────────────────────────

49 let content;

50 try {

51 content = fs.readFileSync(mainFile, 'utf-8');

52 } catch (err) {

53 return { success: false, error: `Could not read ${mainFile}: ${err.message}` };

54 }