w3bs.AccountStart building
PACKAGES / Profullstack

sh1pt

CLI that builds one codebase and ships it to app stores, package registries, CDNs and deploy targets, then promotes it.

ThreatCrush · No malware found
INSTALLw3bs install sh1pt.com/sh1pt

No w3bs yet? curl -fsSL https://w3bs.org/install.sh | sh

Get started

What to type once it is installed.

  1. w3bs install sh1pt.com/sh1ptInstall sh1pt and track it for updates
  2. sh1pt initScaffold sh1pt.config.ts in the current project
  3. sh1pt buildBuild every enabled target locally
  4. sh1pt ship --dry-runSimulate publishing the built artifacts to their stores
  5. sh1pt ship statusShow live, pending and in-review state per target

Every option: sh1pt --help · docs ↗

Malware scan

ThreatCrush found no malware indicators in sh1pt 0.3.7. The other findings below are ordinary code-review notes, not malware.

Scanned
2026-11-01 22:56 UTC · threatcrush 0.13.30
Files
3996 (installer + github.com/profullstack/sh1pt)
Findings
2 high · 18 medium · 35 low
55 other findings (not malware)
  • high
    URL built from the Host headersource/packages/bots/wechat/src/index.ts:405js-host-header-trust · CWE-346
  • high
    outbound request to a non-constant URLsource/sites/sh1pt.com/public/sw.js:21js-ssrf-outbound-request · CWE-918
  • medium
    regex with nested unbounded quantifierssource/packages/actions-fleet-core/src/action-pack/schema.ts:3redos-nested-quantifier · CWE-1333
  • medium
    regex with nested unbounded quantifierssource/packages/core/src/setup-helpers.ts:583redos-nested-quantifier · CWE-1333
  • medium
    SQL built from a template literal or f-stringsource/packages/migrate/src/engines/mysql.ts:133sql-template-interpolation · CWE-89
  • medium
    SQL built from a template literal or f-stringsource/packages/migrate/src/engines/postgres.ts:276sql-template-interpolation · CWE-89
  • medium
    SQL built from a template literal or f-stringsource/packages/migrate/src/transforms.ts:178sql-template-interpolation · CWE-89
  • medium
    regex with nested unbounded quantifierssource/packages/policy/src/rules/bundle-id.ts:3redos-nested-quantifier · CWE-1333
  • medium
    SQL assembled by concatenation or interpolationsource/packages/targets/deploy-wordpress/src/index.ts:154sql-string-concatenation · CWE-89
  • medium
    regex with nested unbounded quantifierssource/packages/targets/desktop-linux/src/index.ts:19redos-nested-quantifier · CWE-1333
  • medium
    regex with nested unbounded quantifierssource/packages/targets/desktop-mac/src/index.ts:15redos-nested-quantifier · CWE-1333
  • medium
    regex with nested unbounded quantifierssource/packages/targets/desktop-steamos/src/index.ts:28redos-nested-quantifier · CWE-1333
  • medium
    regex with nested unbounded quantifierssource/packages/targets/mobile-android/src/index.ts:9redos-nested-quantifier · CWE-1333
  • medium
    regex with nested unbounded quantifierssource/packages/targets/mobile-ios/src/index.ts:11redos-nested-quantifier · CWE-1333
  • medium
    regex with nested unbounded quantifierssource/packages/targets/tv-androidtv/src/index.ts:14redos-nested-quantifier · CWE-1333
  • medium
    regex with nested unbounded quantifierssource/packages/targets/tv-firetv/src/index.ts:13redos-nested-quantifier · CWE-1333
  • medium
    regex with nested unbounded quantifierssource/packages/targets/tv-tvos/src/index.ts:14redos-nested-quantifier · CWE-1333
  • medium
    regex with nested unbounded quantifierssource/packages/targets/tv-webos/src/index.ts:26redos-nested-quantifier · CWE-1333
  • medium
    unescaped HTML renderingsource/sites/sh1pt.com/app/blog/[slug]/page.tsx:88js-unescaped-html-sink · CWE-79
  • medium
    unescaped HTML renderingsource/sites/sh1pt.com/app/components/PitFooter.tsx:17js-unescaped-html-sink · CWE-79
  • low
    Hardcoded Credentialsource/packages/affiliates/skimlinks/src/index.test.ts:25secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/packages/affiliates/skimlinks/src/index.test.ts:71secret-generic-credential · CWE-798
  • low
    Generic API Keysource/packages/affiliates/sovrn/src/index.ts:28secret-generic-api-key · CWE-798
  • low
    Hardcoded Credentialsource/packages/agent-providers/opencode/src/__tests__/opencode.test.ts:99secret-generic-credential · CWE-798
  • low
    NoSQL query built from request datasource/packages/ai/amazon-bedrock/src/index.test.ts:121js-nosql-injection · CWE-943
  • low
    Hardcoded Credentialsource/packages/ai/amazon-bedrock/src/index.ts:9secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/packages/ai/amazon-bedrock/src/index.ts:10secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/packages/ai/amazon-bedrock/src/index.ts:11secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/packages/bridges/matrix/src/index.ts:58secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/packages/bridges/matrix/src/index.ts:59secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/packages/bridges/slack/src/index.test.ts:259secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/packages/captcha/captchasolver/src/index.ts:34secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/packages/cli/src/commands/secrets.ts:189secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/packages/cloud/linode/src/index.ts:15secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/packages/migrate/src/platforms/index.test.ts:116secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/packages/observability/sentry/src/index.ts:15secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/packages/outreach/producthunt/src/index.ts:103secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/packages/promo/posthog/src/index.ts:23secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/packages/scanners/threatcrush/test/scan-output.txt:35secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/packages/scanners/threatcrush/test/scan-output.txt:40secret-generic-credential · CWE-798
  • low
    Database URL with credentialssource/packages/scanners/threatcrush/test/scan-output.txt:54secret-database-url · CWE-798
  • low
    Hardcoded Credentialsource/packages/security/snyk/src/index.ts:26secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/packages/social/hashnode/src/index.ts:4secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/packages/social/linkedin/src/index.ts:3secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/packages/social/linkedin/src/index.ts:4secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/packages/social/medium/src/index.ts:4secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/packages/social/snapchat/src/index.ts:5secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/packages/social/tiktok/src/index.ts:5secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/packages/targets/plugin-vscode/src/index.test.ts:115secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/packages/targets/registry-ans/src/index.test.ts:79secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/packages/targets/registry-ans/src/index.ts:49secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/packages/targets/sdk-pypi/src/index.test.ts:49secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/packages/vcs/gitlab/src/index.test.ts:96secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/sites/sh1pt.com/supabase/config.toml:303secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/sites/sh1pt.com/supabase/config.toml:335secret-generic-credential · CWE-798

Badge for your README

ThreatCrush: No malware found

[![ThreatCrush scan](https://w3bs.org/api/packages/sh1pt.com/sh1pt/badge.svg)](https://w3bs.org/packages/sh1pt.com/sh1pt)