registry / uicopilot / 0.1.8

uicopilot@0.1.8

CLI to set up UI Parity — AI-powered Figma comparison for Storybook

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 8 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 53.2 KB of source, external domains: app.uiparity.com, github.com, www.figma.com

Source & flagged code

2 flagged

dist/index.mjsView file

Lines 1-70javascript

1#!/usr/bin/env node

3// src/index.ts

4import { readFileSync as readFileSync3 } from "fs";

5import { fileURLToPath } from "url";

6import { dirname as dirname2, join as join3 } from "path";

8// src/utils.ts

9import { execSync } from "child_process";

10import { existsSync } from "fs";

High

Child Process

Package source references child process execution.

dist/index.mjsView on unpkg · L8

11import { join } from "path";

12import { createInterface } from "readline";

13var bold = (s) => `\x1B[1m${s}\x1B[0m`;

14var green = (s) => `\x1B[32m${s}\x1B[0m`;

15var yellow = (s) => `\x1B[33m${s}\x1B[0m`;

16var red = (s) => `\x1B[31m${s}\x1B[0m`;

17var dim = (s) => `\x1B[2m${s}\x1B[0m`;

18var cyan = (s) => `\x1B[36m${s}\x1B[0m`;

19function log(msg) {

20 console.log(msg);

21}

22function step(msg) {

23 log(` ${green("\u2713")} ${msg}`);

24}

25function warn(msg) {

26 log(` ${yellow("\u26A0")} ${msg}`);

27}

28function error(msg) {

30}

31async function ask(question) {

32 const rl = createInterface({ input: process.stdin, output: process.stdout });

33 return new Promise((resolve2) => {

34 rl.question(` ${question} `, (answer) => {

35 rl.close();

36 resolve2(answer.trim());

37 });

38 });

39}

40function detectPM() {

41 const cwd = process.cwd();

42 if (existsSync(join(cwd, "bun.lockb")) || existsSync(join(cwd, "bun.lock")))

43 return "bun";

44 if (existsSync(join(cwd, "pnpm-lock.yaml"))) return "pnpm";

45 if (existsSync(join(cwd, "yarn.lock"))) return "yarn";

46 return "npm";

47}

48function installCmd(pm, pkg) {

49 switch (pm) {

50 case "bun":

51 return `bun add -d ${pkg}`;

52 case "pnpm":

53 return `pnpm add -D ${pkg}`;

54 case "yarn":

55 return `yarn add -D ${pkg}`;

56 default:

57 return `npm install --save-dev ${pkg}`;

58 }

59}

60function runInstall(pm, cwd) {

61 const cmd = pm === "bun" ? "bun install" : pm === "pnpm" ? "pnpm install" : pm === "yarn" ? "yarn" : "npm install";

62 execSync(cmd, { stdio: "inherit", cwd });

63}

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.mjsView on unpkg · L50

65// src/commands/init.ts

66import { execSync as execSync2 } from "child_process";

67import { readFileSync, writeFileSync, existsSync as existsSync2 } from "fs";

68import { resolve } from "path";

69var ADDON_PACKAGE = "@uicopilot/storybook-addon";

70var DASHBOARD_URL = "https://app.uiparity.com";

Source & flagged code

2 flagged · loading source

dist/index.mjsView file

8// src/utils.ts L9: import { execSync } from "child_process"; L10: import { existsSync } from "fs";

High

Child Process

Package source references child process execution.

dist/index.mjsView on unpkg · L8

50case "bun": L51: return `bun add -d ${pkg}`; L52: case "pnpm": ... L61: const cmd = pm === "bun" ? "bun install" : pm === "pnpm" ? "pnpm install" : pm === "yarn" ? "yarn" : "npm install"; L62: execSync(cmd, { stdio: "inherit", cwd }); L63: }

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.mjsView on unpkg · L50

Findings

3 High1 Medium4 Low

HighChild Processdist/index.mjs

HighShell

HighRuntime Package Installdist/index.mjs

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

dist/index.mjsView file

Lines 1-70javascript

1#!/usr/bin/env node

3// src/index.ts

4import { readFileSync as readFileSync3 } from "fs";

5import { fileURLToPath } from "url";

6import { dirname as dirname2, join as join3 } from "path";

8// src/utils.ts

9import { execSync } from "child_process";

10import { existsSync } from "fs";

High

Child Process

Package source references child process execution.

dist/index.mjsView on unpkg · L8

11import { join } from "path";

12import { createInterface } from "readline";

13var bold = (s) => `\x1B[1m${s}\x1B[0m`;

14var green = (s) => `\x1B[32m${s}\x1B[0m`;

15var yellow = (s) => `\x1B[33m${s}\x1B[0m`;

16var red = (s) => `\x1B[31m${s}\x1B[0m`;

17var dim = (s) => `\x1B[2m${s}\x1B[0m`;

18var cyan = (s) => `\x1B[36m${s}\x1B[0m`;

19function log(msg) {

20 console.log(msg);

21}

22function step(msg) {

23 log(` ${green("\u2713")} ${msg}`);

24}

25function warn(msg) {

26 log(` ${yellow("\u26A0")} ${msg}`);

27}

28function error(msg) {

30}

31async function ask(question) {

32 const rl = createInterface({ input: process.stdin, output: process.stdout });

33 return new Promise((resolve2) => {

34 rl.question(` ${question} `, (answer) => {

35 rl.close();

36 resolve2(answer.trim());

37 });

38 });

39}

40function detectPM() {

41 const cwd = process.cwd();

42 if (existsSync(join(cwd, "bun.lockb")) || existsSync(join(cwd, "bun.lock")))

43 return "bun";

44 if (existsSync(join(cwd, "pnpm-lock.yaml"))) return "pnpm";

45 if (existsSync(join(cwd, "yarn.lock"))) return "yarn";

46 return "npm";

47}

48function installCmd(pm, pkg) {

49 switch (pm) {

50 case "bun":

51 return `bun add -d ${pkg}`;

52 case "pnpm":

53 return `pnpm add -D ${pkg}`;

54 case "yarn":

55 return `yarn add -D ${pkg}`;

56 default:

57 return `npm install --save-dev ${pkg}`;

58 }

59}

60function runInstall(pm, cwd) {

61 const cmd = pm === "bun" ? "bun install" : pm === "pnpm" ? "pnpm install" : pm === "yarn" ? "yarn" : "npm install";

62 execSync(cmd, { stdio: "inherit", cwd });

63}

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.mjsView on unpkg · L50

65// src/commands/init.ts

66import { execSync as execSync2 } from "child_process";

67import { readFileSync, writeFileSync, existsSync as existsSync2 } from "fs";

68import { resolve } from "path";

69var ADDON_PACKAGE = "@uicopilot/storybook-addon";

70var DASHBOARD_URL = "https://app.uiparity.com";