registry / uniweb / 0.12.37

uniweb@0.12.37

Create structured Vite + React sites with content/code separation

Static Scan Results

scanned 12d ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 66 file(s), 657 KB of source, external domains: 127.0.0.1, api.github.com, assets.uniweb.app, github.com, raw.githubusercontent.com, registry.npmjs.org, uniweb.app

Source & flagged code

4 flagged

src/index.jsView file

Lines 4-44javascript

4 * Uniweb CLI

5 *

6 * Scaffolds new Uniweb sites and foundations, builds projects, and generates docs.

7 *

8 * Install globally:

9 * npm i -g uniweb

10 *

11 * Usage:

12 * uniweb create [project-name]

13 * uniweb create --template marketing

14 * uniweb add foundation [name]

15 * uniweb build

16 * uniweb docs

17 *

18 * Global install delegation:

19 * When installed globally, project-bound commands (build, docs, etc.) are

20 * delegated to the project-local CLI if one exists in node_modules. This

21 * ensures version alignment between the CLI and @uniweb/build.

22 */

24import { existsSync, readFileSync } from 'node:fs'

25import { execSync, spawn as spawnChild } from 'node:child_process'

26import { resolve, join, relative, dirname, basename } from 'node:path'

High

Child Process

Package source references child process execution.

src/index.jsView on unpkg · L24

27import { fileURLToPath } from 'node:url'

28import prompts from 'prompts'

29// `doctor`, `add`, `publish`, and `deploy` are loaded lazily via

30// importProjectCommand() — each imports `@uniweb/build` at the top,

31// so a static import here would crash `npx uniweb@latest create …`

32// (no @uniweb/build in the npx scratch dir) before any command runs.

33// Same pattern as `build` and `docs`.

34import { i18n } from './commands/i18n.js'

35import { inspect } from './commands/inspect.js'

36import { invite } from './commands/invite.js'

37import { handoff } from './commands/handoff.js'

38import { update } from './commands/update.js'

39import { clone } from './commands/clone.js'

40import { template } from './commands/template.js'

41import {

42 resolveTemplate,

43 parseTemplateId,

44} from './templates/index.js'

Lines 185-225javascript

185 } catch { /* ignore — version check is best-effort */ }

186

187 return new Promise((resolve, reject) => {

188 const child = spawnChild(

189 process.execPath,

190 [localCliPath, ...process.argv.slice(2)],

src/commands/build.jsView file

Lines 119-159javascript

119 }

120 } catch {

121 // Ignore parse errors

122 }

123 }

124

125 // Foundation vs site: delegate to the canonical classifier in @uniweb/build.

126 const kind = classifyPackage(projectDir)

127 if (kind)

src/commands/register.jsView file

Lines 255-295javascript

255 return { exitCode: 2 }

256 }

257 if (!schemas || Object.keys(schemas).length === 0) {

258 error('No data schemas found in this package.')

259 log(` ${colors.

Source & flagged code

4 flagged · loading source

src/index.jsView file

24import { existsSync, readFileSync } from 'node:fs' L25: import { execSync, spawn as spawnChild } from 'node:child_process' L26: import { resolve, join, relative, dirname, basename } from 'node:path'

High

Child Process

Package source references child process execution.

src/index.jsView on unpkg · L24

205try { L206: return await import(modulePath) L207: } catch (err) {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/index.jsView on unpkg · L205

src/commands/build.jsView file

139stdio: 'inherit', L140: shell: true, L141: })

High

Shell

Package source references shell execution.

src/commands/build.jsView on unpkg · L139

src/commands/register.jsView file

275try { L276: execSync('npx uniweb build --target foundation', { cwd: targetDir, stdio: 'inherit' }) L277: } catch (err) {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/commands/register.jsView on unpkg · L275

Findings

3 High4 Medium4 Low

HighChild Processsrc/index.js

HighShellsrc/commands/build.js

HighRuntime Package Installsrc/commands/register.js

MediumDynamic Requiresrc/index.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

src/index.jsView file

Lines 4-44javascript

4 * Uniweb CLI

5 *

6 * Scaffolds new Uniweb sites and foundations, builds projects, and generates docs.

7 *

8 * Install globally:

9 * npm i -g uniweb

10 *

11 * Usage:

12 * uniweb create [project-name]

13 * uniweb create --template marketing

14 * uniweb add foundation [name]

15 * uniweb build

16 * uniweb docs

17 *

18 * Global install delegation:

19 * When installed globally, project-bound commands (build, docs, etc.) are

20 * delegated to the project-local CLI if one exists in node_modules. This

21 * ensures version alignment between the CLI and @uniweb/build.

22 */

24import { existsSync, readFileSync } from 'node:fs'

25import { execSync, spawn as spawnChild } from 'node:child_process'

26import { resolve, join, relative, dirname, basename } from 'node:path'

High

Child Process

Package source references child process execution.

src/index.jsView on unpkg · L24

27import { fileURLToPath } from 'node:url'

28import prompts from 'prompts'

29// `doctor`, `add`, `publish`, and `deploy` are loaded lazily via

30// importProjectCommand() — each imports `@uniweb/build` at the top,

31// so a static import here would crash `npx uniweb@latest create …`

32// (no @uniweb/build in the npx scratch dir) before any command runs.

33// Same pattern as `build` and `docs`.

34import { i18n } from './commands/i18n.js'

35import { inspect } from './commands/inspect.js'

36import { invite } from './commands/invite.js'

37import { handoff } from './commands/handoff.js'

38import { update } from './commands/update.js'

39import { clone } from './commands/clone.js'

40import { template } from './commands/template.js'

41import {

42 resolveTemplate,

43 parseTemplateId,

44} from './templates/index.js'

Lines 185-225javascript

185 } catch { /* ignore — version check is best-effort */ }

186

187 return new Promise((resolve, reject) => {

188 const child = spawnChild(

189 process.execPath,

190 [localCliPath, ...process.argv.slice(2)],

src/commands/build.jsView file

Lines 119-159javascript

119 }

120 } catch {

121 // Ignore parse errors

122 }

123 }

124

125 // Foundation vs site: delegate to the canonical classifier in @uniweb/build.

126 const kind = classifyPackage(projectDir)

127 if (kind)

src/commands/register.jsView file

Lines 255-295javascript

255 return { exitCode: 2 }

256 }

257 if (!schemas || Object.keys(schemas).length === 0) {

258 error('No data schemas found in this package.')

259 log(` ${colors.