registry / @b12k/gitleaks / 8.30.1-v.16

@b12k/gitleaks@8.30.1-v.16

The missing NPM wrapper for Gitleaks

Static Scan Results

scanned 16h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 7 file(s), 8.77 KB of source, external domains: github.com

Source & flagged code

3 flagged

package.jsonView file

Lines 76-99json

76 "scripts": {

77 "build": "rslib",

78 "check": "run-p -l check:*",

79 "check:format": "prettier . --check",

80 "check:package-json": "sort-package-json --check",

81 "check:scripts": "eslint . --cache",

82 "check:types": "tsc --noEmit",

83 "deps:check": "ncu -e 1 -c 7",

84 "deps:update": "ncu -du --doctorTest \"pnpm deps:update:doctor\" -c 7",

85 "deps:update:doctor": "run-p -l check:types check:scripts build",

86 "dev": "rslib --watch",

87 "fix": "run-p -l fix:*",

88 "fix:format": "prettier . --write",

89 "fix:package-json": "sort-package-json",

90 "fix:scripts": "eslint . --fix --cache",

91 "ga:notify": "tsx .github/notify.ts",

92 "ga:update-gitleaks": "tsx .github/update-gitleaks.ts",

93 "husky:commit-msg": "commitlint",

94 "husky:pre-commit": "lint-staged",

95 "husky:pre-push": "branch-name-lint",

96 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L96

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L96

97 "release": "release-it --preRelease=v"

98 }

99}

scripts/postinstall.jsView file

Lines 1-8javascript

1import path from 'node:path';

2import { pathToFileURL } from 'node:url';

4const directory = import.meta.dirname;

5// eslint-disable-next-line n/no-process-exit

Source & flagged code

3 flagged · loading source

package.jsonView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code