Proposal: Improve Socket Security Score via Monorepo Architecture (Split Core and CLI Packages)

[1abcdefggs]

Background & Problem

Currently, on the security scanning platform Socket, this package (@splists/splist) has a security score of "75" and triggers a "Filesystem access" alert.

The cause of this is the use of Node.js's built-in fs module inside the CLI entry point src/cli/cli.js.

While using fs is a perfectly normal and safe design for a CLI tool that needs to verify the existence of target files, it is currently published to NPM as a single, unified package. As a result, Socket determines that "the entire package carries the risk of accessing the filesystem."

This situation could cause unnecessary security concerns for third parties (consumers) looking to adopt this package, and therefore needs to be addressed.

Proposed Solution

Leveraging our currently clean directory structure (src/core and src/cli), we propose migrating to a Monorepo architecture using npm Workspaces.

We will continue to manage the codebase in a single repository, but upon publishing, we will split and distribute it as the following two independent packages:

1. @splists/core: A pure core logic package that has absolutely no dependency on fs.
2. @splists/cli: A package that imports @splists/core as a dependency and handles the CLI operations (as well as the fs access).

Theory & Benefits of this Approach

By splitting the packages in this manner, the issue will be fundamentally resolved for the following reasons:

• Perfect Core Score: Since @splists/core will not contain fs at all, the "Filesystem access" alert on Socket will completely disappear. Other developers will be able to integrate it into their projects as a "completely safe library."
• Justified CLI File Access: The @splists/cli package will continue to trigger the alert. However, because the package name explicitly includes cli, security evaluators can easily understand and accept that "it's natural for a CLI tool to access files (expected behavior)" due to the clear separation of concerns.
• No Major Code Rewrites Required: The separation of concerns between the core logic and CLI is already well established in the current codebase. Thanks to the design that allows fs to be injected from the outside (similar to Dependency Injection), a smooth migration is possible simply by adjusting package.json and the directory structure.

Tasks

• Create a directory structure for the monorepo (e.g., packages/core, packages/cli).
• Add Workspaces configuration to the root package.json.
• Create separate package.json files for @splists/core and @splists/cli.
• Refactor relative path imports in cli.js to use package imports (e.g., require('@splists/core')).
• Update the CI/CD and npm publish workflows (if applicable).

We welcome any feedback or opinions on this architectural change.