registry / tribenest / 0.1.0

tribenest@0.1.0

tribenest — local dev CLI + MCP server for TribeNest code websites

Static Scan Results

scanned 8h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

CopyleftLicense

scanned 17 file(s), 59.3 KB of source, external domains: 127.0.0.1, admin.tribenest.co, api.tribenest.co

Source & flagged code

2 flagged

dist/lib/deploy.jsView file

Lines 1-28javascript

1// Local-build publish: build the site on the creator's machine, upload the

2// resulting dist/ artifact, and let the backend deploy it without building.

3// Shared by the `tribenest build`/`publish` commands and the MCP `publish` tool.

4//

5// NOTE ON STDOUT: the MCP server speaks its protocol over stdout, so these

6// helpers must never write there. `buildLocally({ stream: false })` captures the

7// build output instead of inheriting the parent's stdio; the CLI passes

8// `stream: true` for live output.

9import { spawnSync } from "node:child_process";

10import { existsSync, readdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";

High

Child Process

Package source references child process execution.

dist/lib/deploy.jsView on unpkg · L8

11import { delimiter, dirname, join, relative, sep } from "node:path";

12import { endpoints } from "./api.js";

13import { requireProject } from "./config.js";

14import { isBinaryFilePath } from "./files.js";

15// Serialize a flat config map into dotenv lines (mirrors the server's writer).

16function serializeEnv(vars) {

17 return (Object.entries(vars)

18 .map(([k, v]) => `${k}="${String(v).replace(/\\/g, "\\\\").replace(/"/g, '\\"').replace(/\n/g, "\\n")}"`)

19 .join("\n") + "\n");

20}

21// Build the site with the SAME per-tenant vars the server would inject for a

22// published build, so the artifact matches a server build. The vars go in

23// `.env.production` (Vite loads it in production/build mode, over the dev `.env`)

24// and are removed afterwards so secrets don't linger or get pushed.

25export async function buildLocally(opts) {

26 const { project, env } = requireProject();

27 const o = { apiUrl: env.apiUrl, token: env.pat };

28 const root = process.cwd();

dist/mcp.jsView file

Lines 232-272javascript

232 return text({ eventId: event.id, ticketIds: created.map((t) => t.id), event, tickets: created });

233 }

234 case "read_content":

235 return text(await endpoints.readContent(o, versionId, profileId));

236 case "set_content_fields"

Source & flagged code

2 flagged · loading source

dist/lib/deploy.jsView file

8// `stream: true` for live output. L9: import { spawnSync } from "node:child_process"; L10: import { existsSync, readdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";

High

Child Process

Package source references child process execution.

dist/lib/deploy.jsView on unpkg · L8

dist/mcp.jsView file

252case "check_errors": { L253: const r = spawnSync("npx", ["tsc", "--noEmit"], { cwd: process.cwd(), encoding: "utf-8" }); L254: const out = (r.stdout || "") + (r.stderr || "");

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/mcp.jsView on unpkg · L252

Findings

3 High3 Medium6 Low

HighChild Processdist/lib/deploy.js

HighShell

HighRuntime Package Installdist/mcp.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowCopyleft License

Source & flagged code

2 flagged

dist/lib/deploy.jsView file

Lines 1-28javascript

1// Local-build publish: build the site on the creator's machine, upload the

2// resulting dist/ artifact, and let the backend deploy it without building.

3// Shared by the `tribenest build`/`publish` commands and the MCP `publish` tool.

4//

5// NOTE ON STDOUT: the MCP server speaks its protocol over stdout, so these

6// helpers must never write there. `buildLocally({ stream: false })` captures the

7// build output instead of inheriting the parent's stdio; the CLI passes

8// `stream: true` for live output.

9import { spawnSync } from "node:child_process";

10import { existsSync, readdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";

High

Child Process

Package source references child process execution.

dist/lib/deploy.jsView on unpkg · L8

11import { delimiter, dirname, join, relative, sep } from "node:path";

12import { endpoints } from "./api.js";

13import { requireProject } from "./config.js";

14import { isBinaryFilePath } from "./files.js";

15// Serialize a flat config map into dotenv lines (mirrors the server's writer).

16function serializeEnv(vars) {

17 return (Object.entries(vars)

18 .map(([k, v]) => `${k}="${String(v).replace(/\\/g, "\\\\").replace(/"/g, '\\"').replace(/\n/g, "\\n")}"`)

19 .join("\n") + "\n");

20}

21// Build the site with the SAME per-tenant vars the server would inject for a

22// published build, so the artifact matches a server build. The vars go in

23// `.env.production` (Vite loads it in production/build mode, over the dev `.env`)

24// and are removed afterwards so secrets don't linger or get pushed.

25export async function buildLocally(opts) {

26 const { project, env } = requireProject();

27 const o = { apiUrl: env.apiUrl, token: env.pat };

28 const root = process.cwd();

dist/mcp.jsView file

Lines 232-272javascript

232 return text({ eventId: event.id, ticketIds: created.map((t) => t.id), event, tickets: created });

233 }

234 case "read_content":

235 return text(await endpoints.readContent(o, versionId, profileId));

236 case "set_content_fields"