← Home

@scenar/cli

npm Repository Homepage

Scenar CLI — validate scenarios, generate narration, and render videos.

28
Versions
Apache-2.0
License
No
Install Scripts
Missing
Provenance

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.

Maintainers

whysosuresh

Keywords

scenarscenarioclinarrationttsvalidateyamlvideorenderremotion

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
phantom-deps phantom-dep:@scenar/embed AI (phantom-deps): Same-org package, likely used via bundled build output. ai
semgrep semgrep:etc-passwd-access AI (semgrep): Test asserting path traversal is rejected, not actual access. ai
semgrep semgrep:silent-process-exec AI (semgrep): Cross-platform open-URL-in-browser helper for `serve`, not a reverse shell. ai
semgrep semgrep:silent-process-exec-var AI (semgrep): Same open-URL call as silent-process-exec finding. ai
source-diff obfuscated-file:example-bundle/assets/index-BLQ14SEo.js AI (source-diff): React/bundled build artifact with license headers, not obfuscation. ai
source-diff obfuscated-file:example-bundle/embed.js AI (source-diff): Minified embed SDK using postMessage protocol, not malicious. ai
phantom-deps phantom-dep:@bufbuild/protobuf AI (phantom-deps): protobuf runtime used via generated connectrpc stubs; heuristic FP. ai
phantom-deps phantom-dep:@scenar/core AI (phantom-deps): Same-org monorepo dep; may be used transitively rather than directly imported. ai
typosquat typosquat.levenshtein:joi AI (typosquat): @scenar/cli is a scoped CLI tool unrelated to joi; Levenshtein match is coincidental. ai

Versions (showing 28 of 28)

Version Deps Published
0.4.0 5 / 0
0.3.0 10 / 0
0.2.1 9 / 0
0.2.0 9 / 0
0.1.20 9 / 0
0.1.19 5 / 0
0.1.18 5 / 0
0.1.17 5 / 0
0.1.16 5 / 0
0.1.15 5 / 0
0.1.14 5 / 0
0.1.13 5 / 0
0.1.12 5 / 0
0.1.11 5 / 0
0.1.10 5 / 0
0.1.9 5 / 0
0.1.8 5 / 0
0.1.7 5 / 0
0.1.6 4 / 0
0.1.5 4 / 0
0.1.4 4 / 0
0.1.3 4 / 0
0.1.2 4 / 0
0.1.1 4 / 0
0.1.0 4 / 0
0.0.4 3 / 0
0.0.3 3 / 0
0.0.2 3 / 0

v0.4.0

13 findings
HIGH New obfuscated file: example-bundle/assets/index-BLQ14SEo.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: example-bundle/embed.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH etc-passwd-access: src/__tests__/serve-request-path.test.ts:27 semgrep

Accessing /etc/passwd or /etc/shadow — credential harvesting on Linux Source: https://github.com/stigmer/scenar/blob/6f91dbb6007c78b48ef9eb3b20992b9c3488963c/src/__tests__/serve-request-path.test.ts#L27 25 | it("rejects parent-directory traversal in every form", () => { 26 | expect(resolveStaticPath("/../secret")).toBeNull(); > 27 | expect(resolveStaticPath("/assets/../../etc/passwd")).toBeNull(); 28 | expect(resolveStaticPath("/%2e%2e/secret")).toBeNull(); 29 | expect(resolveStaticPath("/foo/%2e%2e/%2e%2e/bar")).toBeNull();

HIGH etc-passwd-access: src/__tests__/serve-static-server.test.ts:86 semgrep

Accessing /etc/passwd or /etc/shadow — credential harvesting on Linux Source: https://github.com/stigmer/scenar/blob/6f91dbb6007c78b48ef9eb3b20992b9c3488963c/src/__tests__/serve-static-server.test.ts#L86 84 | // Sent verbatim via node:http so the "%2e%2e" survives to the server. 85 | expect(await rawGetStatus(server.url, "/%2e%2e/%2e%2e/secret")).toBe(400); > 86 | expect(await rawGetStatus(server.url, "/assets/%2e%2e/%2e%2e/etc/passwd")).toBe(400); 87 | }); 88 | });

HIGH silent-process-exec: src/commands/serve.js:77 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/stigmer/scenar/blob/6f91dbb6007c78b48ef9eb3b20992b9c3488963c/src/commands/serve.js#L77 75 | const command = platform === "darwin" ? "open" : platform === "win32" ? "start" : "xdg-open"; 76 | try { > 77 | const child = spawn(command, [url], { stdio: "ignore", detached: true, shell: platform === "win32" }); 78 | child.on("error", () => { }); 79 | child.unref();

HIGH silent-process-exec-var: src/commands/serve.js:77 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/stigmer/scenar/blob/6f91dbb6007c78b48ef9eb3b20992b9c3488963c/src/commands/serve.js#L77 75 | const command = platform === "darwin" ? "open" : platform === "win32" ? "start" : "xdg-open"; 76 | try { > 77 | const child = spawn(command, [url], { stdio: "ignore", detached: true, shell: platform === "win32" }); 78 | child.on("error", () => { }); 79 | child.unref();

HIGH silent-process-exec: src/commands/serve.ts:100 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/stigmer/scenar/blob/6f91dbb6007c78b48ef9eb3b20992b9c3488963c/src/commands/serve.ts#L100 98 | const command = platform === "darwin" ? "open" : platform === "win32" ? "start" : "xdg-open"; 99 | try { > 100 | const child = spawn(command, [url], { stdio: "ignore", detached: true, shell: platform === "win32" }); 101 | child.on("error", () => {}); 102 | child.unref();

HIGH silent-process-exec-var: src/commands/serve.ts:100 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/stigmer/scenar/blob/6f91dbb6007c78b48ef9eb3b20992b9c3488963c/src/commands/serve.ts#L100 98 | const command = platform === "darwin" ? "open" : platform === "win32" ? "start" : "xdg-open"; 99 | try { > 100 | const child = spawn(command, [url], { stdio: "ignore", detached: true, shell: platform === "win32" }); 101 | child.on("error", () => {}); 102 | child.unref();

HIGH silent-process-exec: src/commands/try.js:84 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/stigmer/scenar/blob/6f91dbb6007c78b48ef9eb3b20992b9c3488963c/src/commands/try.js#L84 82 | const command = platform === "darwin" ? "open" : platform === "win32" ? "start" : "xdg-open"; 83 | try { > 84 | const child = spawn(command, [url], { stdio: "ignore", detached: true, shell: platform === "win32" }); 85 | child.on("error", () => { }); 86 | child.unref();

HIGH silent-process-exec-var: src/commands/try.js:84 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/stigmer/scenar/blob/6f91dbb6007c78b48ef9eb3b20992b9c3488963c/src/commands/try.js#L84 82 | const command = platform === "darwin" ? "open" : platform === "win32" ? "start" : "xdg-open"; 83 | try { > 84 | const child = spawn(command, [url], { stdio: "ignore", detached: true, shell: platform === "win32" }); 85 | child.on("error", () => { }); 86 | child.unref();

HIGH silent-process-exec: src/commands/try.ts:107 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/stigmer/scenar/blob/6f91dbb6007c78b48ef9eb3b20992b9c3488963c/src/commands/try.ts#L107 105 | const command = platform === "darwin" ? "open" : platform === "win32" ? "start" : "xdg-open"; 106 | try { > 107 | const child = spawn(command, [url], { stdio: "ignore", detached: true, shell: platform === "win32" }); 108 | child.on("error", () => {}); 109 | child.unref();

HIGH silent-process-exec-var: src/commands/try.ts:107 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/stigmer/scenar/blob/6f91dbb6007c78b48ef9eb3b20992b9c3488963c/src/commands/try.ts#L107 105 | const command = platform === "darwin" ? "open" : platform === "win32" ? "start" : "xdg-open"; 106 | try { > 107 | const child = spawn(command, [url], { stdio: "ignore", detached: true, shell: platform === "win32" }); 108 | child.on("error", () => {}); 109 | child.unref();

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.3.0

13 findings
HIGH New obfuscated file: example-bundle/assets/index-BLQ14SEo.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: example-bundle/embed.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH etc-passwd-access: src/__tests__/serve-request-path.test.ts:27 semgrep

Accessing /etc/passwd or /etc/shadow — credential harvesting on Linux Source: https://github.com/stigmer/scenar/blob/d4a899ae5507059aebc0fff3f2aee48760c89bdd/src/__tests__/serve-request-path.test.ts#L27 25 | it("rejects parent-directory traversal in every form", () => { 26 | expect(resolveStaticPath("/../secret")).toBeNull(); > 27 | expect(resolveStaticPath("/assets/../../etc/passwd")).toBeNull(); 28 | expect(resolveStaticPath("/%2e%2e/secret")).toBeNull(); 29 | expect(resolveStaticPath("/foo/%2e%2e/%2e%2e/bar")).toBeNull();

HIGH etc-passwd-access: src/__tests__/serve-static-server.test.ts:86 semgrep

Accessing /etc/passwd or /etc/shadow — credential harvesting on Linux Source: https://github.com/stigmer/scenar/blob/d4a899ae5507059aebc0fff3f2aee48760c89bdd/src/__tests__/serve-static-server.test.ts#L86 84 | // Sent verbatim via node:http so the "%2e%2e" survives to the server. 85 | expect(await rawGetStatus(server.url, "/%2e%2e/%2e%2e/secret")).toBe(400); > 86 | expect(await rawGetStatus(server.url, "/assets/%2e%2e/%2e%2e/etc/passwd")).toBe(400); 87 | }); 88 | });

HIGH silent-process-exec: src/commands/serve.js:78 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/stigmer/scenar/blob/d4a899ae5507059aebc0fff3f2aee48760c89bdd/src/commands/serve.js#L78 76 | const command = platform === "darwin" ? "open" : platform === "win32" ? "start" : "xdg-open"; 77 | try { > 78 | const child = spawn(command, [url], { stdio: "ignore", detached: true, shell: platform === "win32" }); 79 | child.on("error", () => { }); 80 | child.unref();

HIGH silent-process-exec-var: src/commands/serve.js:78 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/stigmer/scenar/blob/d4a899ae5507059aebc0fff3f2aee48760c89bdd/src/commands/serve.js#L78 76 | const command = platform === "darwin" ? "open" : platform === "win32" ? "start" : "xdg-open"; 77 | try { > 78 | const child = spawn(command, [url], { stdio: "ignore", detached: true, shell: platform === "win32" }); 79 | child.on("error", () => { }); 80 | child.unref();

HIGH silent-process-exec: src/commands/serve.ts:101 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/stigmer/scenar/blob/d4a899ae5507059aebc0fff3f2aee48760c89bdd/src/commands/serve.ts#L101 99 | const command = platform === "darwin" ? "open" : platform === "win32" ? "start" : "xdg-open"; 100 | try { > 101 | const child = spawn(command, [url], { stdio: "ignore", detached: true, shell: platform === "win32" }); 102 | child.on("error", () => {}); 103 | child.unref();

HIGH silent-process-exec-var: src/commands/serve.ts:101 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/stigmer/scenar/blob/d4a899ae5507059aebc0fff3f2aee48760c89bdd/src/commands/serve.ts#L101 99 | const command = platform === "darwin" ? "open" : platform === "win32" ? "start" : "xdg-open"; 100 | try { > 101 | const child = spawn(command, [url], { stdio: "ignore", detached: true, shell: platform === "win32" }); 102 | child.on("error", () => {}); 103 | child.unref();

HIGH silent-process-exec: src/commands/try.js:84 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/stigmer/scenar/blob/d4a899ae5507059aebc0fff3f2aee48760c89bdd/src/commands/try.js#L84 82 | const command = platform === "darwin" ? "open" : platform === "win32" ? "start" : "xdg-open"; 83 | try { > 84 | const child = spawn(command, [url], { stdio: "ignore", detached: true, shell: platform === "win32" }); 85 | child.on("error", () => { }); 86 | child.unref();

HIGH silent-process-exec-var: src/commands/try.js:84 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/stigmer/scenar/blob/d4a899ae5507059aebc0fff3f2aee48760c89bdd/src/commands/try.js#L84 82 | const command = platform === "darwin" ? "open" : platform === "win32" ? "start" : "xdg-open"; 83 | try { > 84 | const child = spawn(command, [url], { stdio: "ignore", detached: true, shell: platform === "win32" }); 85 | child.on("error", () => { }); 86 | child.unref();

HIGH silent-process-exec: src/commands/try.ts:107 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/stigmer/scenar/blob/d4a899ae5507059aebc0fff3f2aee48760c89bdd/src/commands/try.ts#L107 105 | const command = platform === "darwin" ? "open" : platform === "win32" ? "start" : "xdg-open"; 106 | try { > 107 | const child = spawn(command, [url], { stdio: "ignore", detached: true, shell: platform === "win32" }); 108 | child.on("error", () => {}); 109 | child.unref();

HIGH silent-process-exec-var: src/commands/try.ts:107 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/stigmer/scenar/blob/d4a899ae5507059aebc0fff3f2aee48760c89bdd/src/commands/try.ts#L107 105 | const command = platform === "darwin" ? "open" : platform === "win32" ? "start" : "xdg-open"; 106 | try { > 107 | const child = spawn(command, [url], { stdio: "ignore", detached: true, shell: platform === "win32" }); 108 | child.on("error", () => {}); 109 | child.unref();

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.2.1

12 findings
HIGH New obfuscated file: example-bundle/assets/index-BLQ14SEo.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH etc-passwd-access: src/__tests__/serve-request-path.test.ts:27 semgrep

Accessing /etc/passwd or /etc/shadow — credential harvesting on Linux Source: https://github.com/stigmer/scenar/blob/56408a359c6d5ff408cfba59d60b693096c6f7fc/src/__tests__/serve-request-path.test.ts#L27 25 | it("rejects parent-directory traversal in every form", () => { 26 | expect(resolveStaticPath("/../secret")).toBeNull(); > 27 | expect(resolveStaticPath("/assets/../../etc/passwd")).toBeNull(); 28 | expect(resolveStaticPath("/%2e%2e/secret")).toBeNull(); 29 | expect(resolveStaticPath("/foo/%2e%2e/%2e%2e/bar")).toBeNull();

HIGH etc-passwd-access: src/__tests__/serve-static-server.test.ts:86 semgrep

Accessing /etc/passwd or /etc/shadow — credential harvesting on Linux Source: https://github.com/stigmer/scenar/blob/56408a359c6d5ff408cfba59d60b693096c6f7fc/src/__tests__/serve-static-server.test.ts#L86 84 | // Sent verbatim via node:http so the "%2e%2e" survives to the server. 85 | expect(await rawGetStatus(server.url, "/%2e%2e/%2e%2e/secret")).toBe(400); > 86 | expect(await rawGetStatus(server.url, "/assets/%2e%2e/%2e%2e/etc/passwd")).toBe(400); 87 | }); 88 | });

HIGH silent-process-exec: src/commands/serve.js:76 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/stigmer/scenar/blob/56408a359c6d5ff408cfba59d60b693096c6f7fc/src/commands/serve.js#L76 74 | const command = platform === "darwin" ? "open" : platform === "win32" ? "start" : "xdg-open"; 75 | try { > 76 | const child = spawn(command, [url], { stdio: "ignore", detached: true, shell: platform === "win32" }); 77 | child.on("error", () => { }); 78 | child.unref();

HIGH silent-process-exec-var: src/commands/serve.js:76 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/stigmer/scenar/blob/56408a359c6d5ff408cfba59d60b693096c6f7fc/src/commands/serve.js#L76 74 | const command = platform === "darwin" ? "open" : platform === "win32" ? "start" : "xdg-open"; 75 | try { > 76 | const child = spawn(command, [url], { stdio: "ignore", detached: true, shell: platform === "win32" }); 77 | child.on("error", () => { }); 78 | child.unref();

HIGH silent-process-exec: src/commands/serve.ts:97 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/stigmer/scenar/blob/56408a359c6d5ff408cfba59d60b693096c6f7fc/src/commands/serve.ts#L97 95 | const command = platform === "darwin" ? "open" : platform === "win32" ? "start" : "xdg-open"; 96 | try { > 97 | const child = spawn(command, [url], { stdio: "ignore", detached: true, shell: platform === "win32" }); 98 | child.on("error", () => {}); 99 | child.unref();

HIGH silent-process-exec-var: src/commands/serve.ts:97 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/stigmer/scenar/blob/56408a359c6d5ff408cfba59d60b693096c6f7fc/src/commands/serve.ts#L97 95 | const command = platform === "darwin" ? "open" : platform === "win32" ? "start" : "xdg-open"; 96 | try { > 97 | const child = spawn(command, [url], { stdio: "ignore", detached: true, shell: platform === "win32" }); 98 | child.on("error", () => {}); 99 | child.unref();

HIGH silent-process-exec: src/commands/try.js:84 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/stigmer/scenar/blob/56408a359c6d5ff408cfba59d60b693096c6f7fc/src/commands/try.js#L84 82 | const command = platform === "darwin" ? "open" : platform === "win32" ? "start" : "xdg-open"; 83 | try { > 84 | const child = spawn(command, [url], { stdio: "ignore", detached: true, shell: platform === "win32" }); 85 | child.on("error", () => { }); 86 | child.unref();

HIGH silent-process-exec-var: src/commands/try.js:84 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/stigmer/scenar/blob/56408a359c6d5ff408cfba59d60b693096c6f7fc/src/commands/try.js#L84 82 | const command = platform === "darwin" ? "open" : platform === "win32" ? "start" : "xdg-open"; 83 | try { > 84 | const child = spawn(command, [url], { stdio: "ignore", detached: true, shell: platform === "win32" }); 85 | child.on("error", () => { }); 86 | child.unref();

HIGH silent-process-exec: src/commands/try.ts:107 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/stigmer/scenar/blob/56408a359c6d5ff408cfba59d60b693096c6f7fc/src/commands/try.ts#L107 105 | const command = platform === "darwin" ? "open" : platform === "win32" ? "start" : "xdg-open"; 106 | try { > 107 | const child = spawn(command, [url], { stdio: "ignore", detached: true, shell: platform === "win32" }); 108 | child.on("error", () => {}); 109 | child.unref();

HIGH silent-process-exec-var: src/commands/try.ts:107 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/stigmer/scenar/blob/56408a359c6d5ff408cfba59d60b693096c6f7fc/src/commands/try.ts#L107 105 | const command = platform === "darwin" ? "open" : platform === "win32" ? "start" : "xdg-open"; 106 | try { > 107 | const child = spawn(command, [url], { stdio: "ignore", detached: true, shell: platform === "win32" }); 108 | child.on("error", () => {}); 109 | child.unref();

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.2.0

7 findings
HIGH etc-passwd-access: src/__tests__/serve-request-path.test.ts:27 semgrep

Accessing /etc/passwd or /etc/shadow — credential harvesting on Linux Source: https://github.com/stigmer/scenar/blob/b7b27e68c8840592fe2dd77c3bcb1c7ef61dac59/src/__tests__/serve-request-path.test.ts#L27 25 | it("rejects parent-directory traversal in every form", () => { 26 | expect(resolveStaticPath("/../secret")).toBeNull(); > 27 | expect(resolveStaticPath("/assets/../../etc/passwd")).toBeNull(); 28 | expect(resolveStaticPath("/%2e%2e/secret")).toBeNull(); 29 | expect(resolveStaticPath("/foo/%2e%2e/%2e%2e/bar")).toBeNull();

HIGH etc-passwd-access: src/__tests__/serve-static-server.test.ts:86 semgrep

Accessing /etc/passwd or /etc/shadow — credential harvesting on Linux Source: https://github.com/stigmer/scenar/blob/b7b27e68c8840592fe2dd77c3bcb1c7ef61dac59/src/__tests__/serve-static-server.test.ts#L86 84 | // Sent verbatim via node:http so the "%2e%2e" survives to the server. 85 | expect(await rawGetStatus(server.url, "/%2e%2e/%2e%2e/secret")).toBe(400); > 86 | expect(await rawGetStatus(server.url, "/assets/%2e%2e/%2e%2e/etc/passwd")).toBe(400); 87 | }); 88 | });

HIGH silent-process-exec: src/commands/serve.js:76 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/stigmer/scenar/blob/b7b27e68c8840592fe2dd77c3bcb1c7ef61dac59/src/commands/serve.js#L76 74 | const command = platform === "darwin" ? "open" : platform === "win32" ? "start" : "xdg-open"; 75 | try { > 76 | const child = spawn(command, [url], { stdio: "ignore", detached: true, shell: platform === "win32" }); 77 | child.on("error", () => { }); 78 | child.unref();

HIGH silent-process-exec-var: src/commands/serve.js:76 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/stigmer/scenar/blob/b7b27e68c8840592fe2dd77c3bcb1c7ef61dac59/src/commands/serve.js#L76 74 | const command = platform === "darwin" ? "open" : platform === "win32" ? "start" : "xdg-open"; 75 | try { > 76 | const child = spawn(command, [url], { stdio: "ignore", detached: true, shell: platform === "win32" }); 77 | child.on("error", () => { }); 78 | child.unref();

HIGH silent-process-exec: src/commands/serve.ts:97 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/stigmer/scenar/blob/b7b27e68c8840592fe2dd77c3bcb1c7ef61dac59/src/commands/serve.ts#L97 95 | const command = platform === "darwin" ? "open" : platform === "win32" ? "start" : "xdg-open"; 96 | try { > 97 | const child = spawn(command, [url], { stdio: "ignore", detached: true, shell: platform === "win32" }); 98 | child.on("error", () => {}); 99 | child.unref();

HIGH silent-process-exec-var: src/commands/serve.ts:97 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/stigmer/scenar/blob/b7b27e68c8840592fe2dd77c3bcb1c7ef61dac59/src/commands/serve.ts#L97 95 | const command = platform === "darwin" ? "open" : platform === "win32" ? "start" : "xdg-open"; 96 | try { > 97 | const child = spawn(command, [url], { stdio: "ignore", detached: true, shell: platform === "win32" }); 98 | child.on("error", () => {}); 99 | child.unref();

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.20

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.