registry / ugly-app / 0.1.734

ugly-app@0.1.734

A full-stack TypeScript framework for shipping production web apps with one CLI. Scaffold with `npx ugly-app init my-app` and get an opinionated Express + React + PostgreSQL stack with built-in auth, type-safe RPC over WebSocket and HTTP, real-time docume

Static Scan Results

scanned 2d ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

NoLicense

scanned 1,085 file(s), 6.97 MB of source, external domains: 127.0.0.1, accounts.google.com, api.cloudflare.com, api.githubcopilot.com, api.ugly.bot, app.x, blob.ugly.bot, cdn.example.com, cdn.ugly.bot, console.neon.tech, dash.cloudflare.com, docs.mcp.cloudflare.com, example.com, example.test, github.com, mcp.atlassian.com, mcp.deepwiki.com, mcp.linear.app, mcp.notion.com, mcp.sentry.dev, mcp.stripe.com, mcp.vercel.com, myapp.com, news.app, oauth2.googleapis.com, oauth2.neon.tech, other.app, placehold.co, rtc.live.cloudflare.com, ugly.bot, vega.github.io, www.gstatic.com, www.w3.org, x.com, x.example.com, y.com

Source & flagged code

5 flagged

dist/native/server/binaries.jsView file

Lines 1-26javascript

1/**

2 * Bundled-binary provisioning for the native daemon (lifted from Ugly Studio so

3 * the daemon AND the test harness share one implementation). A host (Ugly

4 * Studio) bundles a small set of tools by downloading them from its own R2

5 * mirror on first launch; everything else resolves on the system PATH.

6 *

7 * Pure fs/child_process/fetch (no Electron) and fully parameterized — the

8 * install root + manifest mirror are injected via `BinaryProvisionConfig`, so

High

Child Process

Package source references child process execution.

dist/native/server/binaries.jsView on unpkg · L6

9 * nothing here hardcodes a particular app's paths or hostnames.

10 *

11 * The mirror exposes `<manifestBase>/binaries-manifest.json`:

12 * { "<tool>": { "version": "x", "archives": { "<platform>-<arch>": { "url" } } } }

13 * One `tar -xf` covers every platform's asset (bsdtar on mac/win unpacks zip).

14 */

15import { basename, join } from 'node:path';

16import { chmodSync, existsSync, mkdirSync, readdirSync, rmSync, writeFileSync } from 'node:fs';

17import { execFile } from 'node:child_process';

18import { promisify } from 'node:util';

19const execFileP = promisify(execFile);

20const exeName = (tool) => (process.platform === 'win32' ? `${tool}.exe` : tool);

21function safeReaddir(dir) {

22 try {

23 return readdirSync(dir);

24 }

25 catch {

26 return [];

dist/inspect/client.jsView file

Lines 1-39javascript

1// Transport-agnostic typed facade over the `inspect.*` native channels. The

2// desktop inspect UI and ugly-code both drive inspection through this client; it

3// is bound to a transport that speaks invoke/subscribe (a UglyNative router, a

4// proxyClient connected to a remote device, or a direct in-process host).

5//

6// Live streams (console/network/picked) ride per-target dynamic event names

7// (`inspect.console:<targetId>`), matching how the host fans subscriptions out.

8export class InspectClient {

9 transport;

dist/cli/uglyappConfig.jsView file

Lines 171-211javascript

171/** Update a single field in .uglyapp without rewriting the whole file. */

172export function updateUglyAppField(cwd, key, value) {

173 const configPath = path.join(cwd, '.uglyapp');

174 let data = {};

175 try

dist/server/Logging.jsView file

Lines 9-49javascript

9// transitively load the whole collection ORM either.

10const RANDOM_ID_ALPHABET = 'ModuleSymbhasOwnPr-0123456789ABCDEFGHNRVfgctiUvz_KqYTJkLxpZXIjQW';

11function randomId() {

12 let out = '';

13 for (let i = 0; i < 21

dist/cli/publish/providers/cloudflare.jsView file

Lines 1102-1142javascript

1102 */

1103export async function detectContainerProject(projectDir) {

1104 const found = await readProjectWranglerConfig(projectDir);

1105 if (!found)

1106 return

Source & flagged code

5 flagged · loading source

dist/native/server/binaries.jsView file

6* L7: * Pure fs/child_process/fetch (no Electron) and fully parameterized — the L8: * install root + manifest mirror are injected via `BinaryProvisionConfig`, so

High

Child Process

Package source references child process execution.

dist/native/server/binaries.jsView on unpkg · L6

dist/inspect/client.jsView file

19} L20: eval(req) { L21: return this.invoke('inspect.eval', req);

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/inspect/client.jsView on unpkg · L19

dist/cli/uglyappConfig.jsView file

191try { L192: const esbuild = (await import('esbuild')); L193: if (typeof esbuild.stop === 'function') {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/cli/uglyappConfig.jsView on unpkg · L191

dist/server/Logging.jsView file

29function getStudioSessionId() { L30: const raw = process.env['UGLY_STUDIO_SESSION_ID']; L31: return raw && raw.length > 0 ? raw : undefined; ... L327: const date = new Date().toISOString().split('T')[0]; // YYYY-MM-DD L328: return path.join(process.cwd(), 'logs', `dev-${date}.jsonl`); L329: } ... L506: }; L507: // debug: captured to JSONL only in dev, NOT printed to stdout L508: console.debug = (...args) => {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/server/Logging.jsView on unpkg · L29

dist/cli/publish/providers/cloudflare.jsView file

1122* 4. Upload secrets non-interactively via `wrangler secret bulk <file>`. L1123: * 5. `npx wrangler deploy -c <tempConfig>` — wrangler builds + pushes the L1124: * container image and binds the container DO. ... L1130: const fsp = await import('node:fs/promises'); L1131: const { spawn } = await import('node:child_process'); L1132: if (!opts.apiToken || !opts.accountId || !opts.scriptName) {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli/publish/providers/cloudflare.jsView on unpkg · L1122

Findings

3 High4 Medium7 Low

HighChild Processdist/native/server/binaries.js

HighShell

HighRuntime Package Installdist/cli/publish/providers/cloudflare.js

MediumDynamic Requiredist/cli/uglyappConfig.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvaldist/inspect/client.js

LowWeak Cryptodist/server/Logging.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

5 flagged

dist/native/server/binaries.jsView file

Lines 1-26javascript

1/**

2 * Bundled-binary provisioning for the native daemon (lifted from Ugly Studio so

3 * the daemon AND the test harness share one implementation). A host (Ugly

4 * Studio) bundles a small set of tools by downloading them from its own R2

5 * mirror on first launch; everything else resolves on the system PATH.

6 *

7 * Pure fs/child_process/fetch (no Electron) and fully parameterized — the

8 * install root + manifest mirror are injected via `BinaryProvisionConfig`, so

High

Child Process

Package source references child process execution.

dist/native/server/binaries.jsView on unpkg · L6

9 * nothing here hardcodes a particular app's paths or hostnames.

10 *

11 * The mirror exposes `<manifestBase>/binaries-manifest.json`:

12 * { "<tool>": { "version": "x", "archives": { "<platform>-<arch>": { "url" } } } }

13 * One `tar -xf` covers every platform's asset (bsdtar on mac/win unpacks zip).

14 */

15import { basename, join } from 'node:path';

16import { chmodSync, existsSync, mkdirSync, readdirSync, rmSync, writeFileSync } from 'node:fs';

17import { execFile } from 'node:child_process';

18import { promisify } from 'node:util';

19const execFileP = promisify(execFile);

20const exeName = (tool) => (process.platform === 'win32' ? `${tool}.exe` : tool);

21function safeReaddir(dir) {

22 try {

23 return readdirSync(dir);

24 }

25 catch {

26 return [];

dist/inspect/client.jsView file

Lines 1-39javascript

1// Transport-agnostic typed facade over the `inspect.*` native channels. The

2// desktop inspect UI and ugly-code both drive inspection through this client; it

3// is bound to a transport that speaks invoke/subscribe (a UglyNative router, a

4// proxyClient connected to a remote device, or a direct in-process host).

5//

6// Live streams (console/network/picked) ride per-target dynamic event names

7// (`inspect.console:<targetId>`), matching how the host fans subscriptions out.

8export class InspectClient {

9 transport;

dist/cli/uglyappConfig.jsView file

Lines 171-211javascript

171/** Update a single field in .uglyapp without rewriting the whole file. */

172export function updateUglyAppField(cwd, key, value) {

173 const configPath = path.join(cwd, '.uglyapp');

174 let data = {};

175 try

dist/server/Logging.jsView file

Lines 9-49javascript

9// transitively load the whole collection ORM either.

10const RANDOM_ID_ALPHABET = 'ModuleSymbhasOwnPr-0123456789ABCDEFGHNRVfgctiUvz_KqYTJkLxpZXIjQW';

11function randomId() {

12 let out = '';

13 for (let i = 0; i < 21

dist/cli/publish/providers/cloudflare.jsView file

Lines 1102-1142javascript

1102 */

1103export async function detectContainerProject(projectDir) {

1104 const found = await readProjectWranglerConfig(projectDir);

1105 if (!found)

1106 return