registry / @amitdevx/md2pdf / 0.2.3

@amitdevx/md2pdf@0.2.3

Production-quality Markdown to PDF rendering engine.

Static Scan Results

scanned 6d ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 5 file(s), 183 KB of source, external domains: fonts.googleapis.com, fonts.gstatic.com, playwright.dev

Source & flagged code

3 flagged

package.jsonView file

Lines 14-54json

14 }

15 },

16 "bin": {

17 "md2pdf": "dist/cli/index.js"

18 },

19 "files": [

20 "dist",

21 "scripts",

22 "README.md",

23 "LICENSE",

24 "CHANGELOG.md"

25 ],

26 "engines": {

27 "node": ">=18"

28 },

29 "sideEffects": false,

30 "publishConfig": {

31 "access": "public"

32 },

33 "scripts": {

34 "postinstall": "node scripts/install-browser.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L34

35 "build": "tsup && tsc -p tsconfig.build.json --emitDeclarationOnly",

36 "dev": "tsup --watch",

37 "test": "vitest run",

38 "test:watch": "vitest",

39 "bench:mermaid": "node dist/cli/index.js tests/benchmarks/mermaid-50-diagrams.md -o tests/output/mermaid-bench.pdf",

40 "lint": "eslint src/ tests/",

41 "lint:fix": "eslint src/ tests/ --fix",

42 "typecheck": "tsc --noEmit",

43 "clean": "rm -rf dist/",

44 "prepare": "husky install || true",

45 "prepublishOnly": "npm run clean && npm run build"

46 },

47 "repository": "amitdevx/md2pdf",

48 "homepage": "https://github.com/amitdevx/md2pdf#readme",

49 "bugs": {

50 "url": "https://github.com/amitdevx/md2pdf/issues"

51 },

52 "keywords": [

53 "markdown",

54 "pdf",

dist/cli/index.jsView file

Lines 1-40javascript

1#!/usr/bin/env node

2import { visit } from 'unist-util-visit';

3import { createRequire } from 'module';

4import { Command } from 'commander';

5import { unified } from 'unified';

6import remarkParse from 'remark-parse'

Source & flagged code

3 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/install-browser.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/cli/index.jsView file

20import pc3 from 'picocolors'; L21: import { execSync } from 'child_process'; L22:

High

Child Process

Package source references child process execution.

dist/cli/index.jsView on unpkg · L20

1309spinner = ora("Installing Chromium dependencies...").start(); L1310: execSync("npx playwright install chromium", { stdio: "inherit" }); L1311: if (process.platform === "linux") {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli/index.jsView on unpkg · L1309

Findings

4 High2 Medium5 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/cli/index.js

HighShell

HighRuntime Package Installdist/cli/index.js

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

package.jsonView file

Lines 14-54json

14 }

15 },

16 "bin": {

17 "md2pdf": "dist/cli/index.js"

18 },

19 "files": [

20 "dist",

21 "scripts",

22 "README.md",

23 "LICENSE",

24 "CHANGELOG.md"

25 ],

26 "engines": {

27 "node": ">=18"

28 },

29 "sideEffects": false,

30 "publishConfig": {

31 "access": "public"

32 },

33 "scripts": {

34 "postinstall": "node scripts/install-browser.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L34

35 "build": "tsup && tsc -p tsconfig.build.json --emitDeclarationOnly",

36 "dev": "tsup --watch",

37 "test": "vitest run",

38 "test:watch": "vitest",

39 "bench:mermaid": "node dist/cli/index.js tests/benchmarks/mermaid-50-diagrams.md -o tests/output/mermaid-bench.pdf",

40 "lint": "eslint src/ tests/",

41 "lint:fix": "eslint src/ tests/ --fix",

42 "typecheck": "tsc --noEmit",

43 "clean": "rm -rf dist/",

44 "prepare": "husky install || true",

45 "prepublishOnly": "npm run clean && npm run build"

46 },

47 "repository": "amitdevx/md2pdf",

48 "homepage": "https://github.com/amitdevx/md2pdf#readme",

49 "bugs": {

50 "url": "https://github.com/amitdevx/md2pdf/issues"

51 },

52 "keywords": [

53 "markdown",

54 "pdf",

dist/cli/index.jsView file

Lines 1-40javascript

1#!/usr/bin/env node

2import { visit } from 'unist-util-visit';

3import { createRequire } from 'module';

4import { Command } from 'commander';

5import { unified } from 'unified';

6import remarkParse from 'remark-parse'

Lines 1289-1329javascript

1289});

1290var init_default = new Command("init").description("Interactive guided setup for new environments").action(async () => {

1291 console.log(pc3.bold("\n\u{1F680} md2pdf Environment Setup\n"));

1292 let spinner = ora("Checking Node environment...").start();

1293 spinner.succeed(`Node.js ${process.version}`);

1294 spinner = ora("Checking Playwright installation...").start();

1295 let chromiumExecutable = null;

1296 try {

1297 const { chromium: chromium2 } = await import('playwright');

1298 spinner.succeed("Playwright is available");

1299 spinner = ora("Checking for Chromium browser...").start();

1300 chromiumExecutable = chromium2.executablePath();

1301 if (!fs5.existsSync(chromiumExecutable)) {

1302 throw new Error("missing");

1303 }

1304 spinner.succeed(`Chromium exists at ${chromiumExecutable}`);

1305 } catch {

1306 spinner.fail("Chromium browser missing");

1307 console.log(pc3.cyan("\nDownloading Chromium for md2pdf. This may take a minute..."));

1308 try {

1309 spinner = ora("Installing Chromium dependencies...").start();

1310 execSync("npx playwright install chromium", { stdio: "inherit" });

1311 if (process.platform === "linux") {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli/index.jsView on unpkg · L1309

1312 console.log(pc3.cyan("\nInstalling required Linux system libraries..."));

1313 let hasSudo = false;

1314 try {

1315 execSync("which sudo", { stdio: "pipe" });

1316 hasSudo = true;

1317 } catch {

1318 }

1319 if (!hasSudo) {

1320 console.warn(pc3.yellow("\u26A0 sudo not available \u2014 skipping system library install"));

1321 console.log(pc3.dim(" If Playwright fails, install these manually as root:"));

1322 console.log(pc3.dim(" npx playwright install-deps chromium"));

1323 } else {

1324 execSync("sudo npx playwright install-deps chromium", { stdio: "inherit" });

1325 }

1326 }

1327 spinner.succeed("Successfully installed browser dependencies!");

1328 } catch {

1329 spinner.fail("Failed to install dependencies automatically.");