search

ossf / package-analysis

Open Source Package Analysis
Apache License 2.0
720 stars 48 forks source link

Run CLI binaries #63

Open oliverchang opened 3 years ago

oliverchang commented 3 years ago

Some packages may include CLI binaries. We should try running them.

calebbrown commented 1 year ago

Ecosystems like Python, NPM, Ruby support creating CLI scripts during install (e.g. scripts in package.json).

A dynamic analysis step could invoke each of these scripts.

This is more important for languages like NPM where we only import the top level package. And also useful for Python to ensure any __main__ guarded sections are executed.

calebbrown commented 1 year ago

This would need to be an additional "phase" for dynamic analysis.