registry / @amitdevx/md2pdf / 0.2.4

@amitdevx/md2pdf@0.2.4

Production-quality Markdown to PDF rendering engine.

Static Scan Results

scanned 5d ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 5 file(s), 186 KB of source, external domains: fonts.googleapis.com, fonts.gstatic.com, playwright.dev

Source & flagged code

4 flagged

package.jsonView file

Lines 14-54json

14 }

15 },

16 "bin": {

17 "md2pdf": "dist/cli/index.js"

18 },

19 "files": [

20 "dist",

21 "scripts",

22 "README.md",

23 "LICENSE",

24 "CHANGELOG.md"

25 ],

26 "engines": {

27 "node": ">=18"

28 },

29 "sideEffects": false,

30 "publishConfig": {

31 "access": "public"

32 },

33 "scripts": {

34 "postinstall": "node scripts/install-browser.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L34

35 "build": "tsup && tsc -p tsconfig.build.json --emitDeclarationOnly",

36 "dev": "tsup --watch",

37 "test": "vitest run",

38 "test:watch": "vitest",

39 "bench:mermaid": "node dist/cli/index.js tests/benchmarks/mermaid-50-diagrams.md -o tests/output/mermaid-bench.pdf",

40 "lint": "eslint src/ tests/",

41 "lint:fix": "eslint src/ tests/ --fix",

42 "typecheck": "tsc --noEmit",

43 "clean": "rm -rf dist/",

44 "prepare": "husky install || true",

45 "prepublishOnly": "npm run clean && npm run build"

46 },

47 "repository": "amitdevx/md2pdf",

48 "homepage": "https://github.com/amitdevx/md2pdf#readme",

49 "bugs": {

50 "url": "https://github.com/amitdevx/md2pdf/issues"

51 },

52 "keywords": [

53 "markdown",

54 "pdf",

dist/cli/index.jsView file

Lines 1-40javascript

1#!/usr/bin/env node

2import { visit } from 'unist-util-visit';

3import { createRequire } from 'module';

4import { Command } from 'commander';

5import { unified } from 'unified';

6import remarkParse from 'remark-parse'

dist/index.jsView file

Lines 297-337javascript

297 }

298 return html;

299}

300var init_pipeline = __esm({

301 "src/renderer/pipeline.ts"() {

302 init_mermaid();

303 }

304});

305

306// src/errors/detect.ts

Source & flagged code

4 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/install-browser.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/cli/index.jsView file

20import pc3 from 'picocolors'; L21: import { execSync } from 'child_process'; L22:

High

Child Process

Package source references child process execution.

dist/cli/index.jsView on unpkg · L20

1321spinner = ora("Installing Chromium dependencies...").start(); L1322: execSync("npx playwright install chromium", { stdio: "inherit" }); L1323: if (process.platform === "linux") {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli/index.jsView on unpkg · L1321

dist/index.jsView file

317const context = { L318: platform: process.platform, L319: ...contextBase ... L583: :root { L584: --md2pdf-font-family-body: 'Inter', -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Helvetica, Arial, sans-serif; L585: --md2pdf-font-family-heading: inherit; ... L902:  L903: <link rel="preconnect" href="https://fonts.googleapis.com"> L904: <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin> ... L932: if (url.startsWith("file://")) { L933: const allowedDir = "file://" + process.cwd().replace(/\\/g, "/"); L934: if (!url.startsWith(allowedDir)) {

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/index.jsView on unpkg · L317

Findings

5 High2 Medium5 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/cli/index.js

HighShell

HighCloud Metadata Accessdist/index.js

HighRuntime Package Installdist/cli/index.js

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

package.jsonView file

Lines 14-54json

14 }

15 },

16 "bin": {

17 "md2pdf": "dist/cli/index.js"

18 },

19 "files": [

20 "dist",

21 "scripts",

22 "README.md",

23 "LICENSE",

24 "CHANGELOG.md"

25 ],

26 "engines": {

27 "node": ">=18"

28 },

29 "sideEffects": false,

30 "publishConfig": {

31 "access": "public"

32 },

33 "scripts": {

34 "postinstall": "node scripts/install-browser.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L34

35 "build": "tsup && tsc -p tsconfig.build.json --emitDeclarationOnly",

36 "dev": "tsup --watch",

37 "test": "vitest run",

38 "test:watch": "vitest",

39 "bench:mermaid": "node dist/cli/index.js tests/benchmarks/mermaid-50-diagrams.md -o tests/output/mermaid-bench.pdf",

40 "lint": "eslint src/ tests/",

41 "lint:fix": "eslint src/ tests/ --fix",

42 "typecheck": "tsc --noEmit",

43 "clean": "rm -rf dist/",

44 "prepare": "husky install || true",

45 "prepublishOnly": "npm run clean && npm run build"

46 },

47 "repository": "amitdevx/md2pdf",

48 "homepage": "https://github.com/amitdevx/md2pdf#readme",

49 "bugs": {

50 "url": "https://github.com/amitdevx/md2pdf/issues"

51 },

52 "keywords": [

53 "markdown",

54 "pdf",

dist/cli/index.jsView file

Lines 1-40javascript

1#!/usr/bin/env node

2import { visit } from 'unist-util-visit';

3import { createRequire } from 'module';

4import { Command } from 'commander';

5import { unified } from 'unified';

6import remarkParse from 'remark-parse'

dist/index.jsView file

Lines 297-337javascript

297 }

298 return html;

299}

300var init_pipeline = __esm({

301 "src/renderer/pipeline.ts"() {

302 init_mermaid();

303 }

304});

305

306// src/errors/detect.ts

Lines 1301-1341javascript

1301});

1302var init_default = new Command("init").description("Interactive guided setup for new environments").action(async () => {

1303 console.log(pc3.bold("\n\u{1F680} md2pdf Environment Setup\n"));

1304 let spinner = ora("Checking Node environment...").start();

1305 spinner.succeed(`Node.js ${process.version}`);

1306 spinner = ora("Checking Playwright installation...").start();

1307 let chromiumExecutable = null;

1308 try {

1309 const { chromium: chromium2 } = await import('playwright');

1310 spinner.succeed("Playwright is available");

1311 spinner = ora("Checking for Chromium browser...").start();

1312 chromiumExecutable = chromium2.executablePath();

1313 if (!fs5.existsSync(chromiumExecutable)) {

1314 throw new Error("missing");

1315 }

1316 spinner.succeed(`Chromium exists at ${chromiumExecutable}`);

1317 } catch {

1318 spinner.fail("Chromium browser missing");

1319 console.log(pc3.cyan("\nDownloading Chromium for md2pdf. This may take a minute..."));

1320 try {

1321 spinner = ora("Installing Chromium dependencies...").start();

1322 execSync("npx playwright install chromium", { stdio: "inherit" });

1323 if (process.platform === "linux") {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli/index.jsView on unpkg · L1321

1324 console.log(pc3.cyan("\nInstalling required Linux system libraries..."));

1325 let hasSudo = false;

1326 try {

1327 execSync("which sudo", { stdio: "pipe" });

1328 hasSudo = true;

1329 } catch {

1330 }

1331 if (!hasSudo) {

1332 console.warn(pc3.yellow("\u26A0 sudo not available \u2014 skipping system library install"));

1333 console.log(pc3.dim(" If Playwright fails, install these manually as root:"));

1334 console.log(pc3.dim(" npx playwright install-deps chromium"));

1335 } else {

1336 execSync("sudo npx playwright install-deps chromium", { stdio: "inherit" });

1337 }

1338 }

1339 spinner.succeed("Successfully installed browser dependencies!");

1340 } catch {

1341 spinner.fail("Failed to install dependencies automatically.");