registry / @casomoltd/tooling / 0.20.3

@casomoltd/tooling@0.20.3

Casomo's shared dev config: ESLint, Prettier, commitlint, knip & jscpd presets and dev CLIs (git hooks, readability, screenshots)

Static Scan Results

scanned 4h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 11 file(s), 23.1 KB of source, external domains: cdn.jsdelivr.net

Source & flagged code

3 flagged

bin/utils.mjsView file

Lines 1-20javascript

1/**

2 * Shared helpers for CLI bin scripts.

3 */

5import path from "node:path";

6import fs from "node:fs";

7import {pathToFileURL} from "node:url";

9/**

10 * Load an optional per-repo config file from cwd.

11 *

12 * Each CLI tool looks for `<tool>.config.mjs` (e.g.

13 * `readability.config.mjs`) in the consumer's project root.

14 */

15export async function loadConfig(filename) {

16 const cfgPath = path.join(process.cwd(), filename);

17 if (!fs.existsSync(cfgPath)) return {};

18 return import(pathToFileURL(cfgPath).href);

19}

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/utils.mjsView on unpkg · L17

bin/render-report.mjsView file

Lines 1-40javascript

1#!/usr/bin/env node

3/**

4 * Render a markdown + mermaid report to a self-contained HTML file and open it

5 * in the browser — the reliable renderer for agent reports (docs-xray,

6 * design-xray) whose mermaid diagrams render unreliably in editor previews.

7 *

8 * The report `.md` is inlined into an HTML harness that loads `marked` and

9 * `mermaid` from CDN, so the output is one portable file — no build step, no

10 * editor extension. Write reports into a repo-local dir (e.g. `scratch/`), not

11 * `/tmp`: sandboxed browsers (snap/flatpak) often can't read outside $HOME.

bin/check-version.shView file

•path = bin/check-version.sh kind = build_helper sizeBytes = 718 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/check-version.shView on unpkg

Source & flagged code

3 flagged · loading source

bin/utils.mjsView file

17if (!fs.existsSync(cfgPath)) return {}; L18: return import(pathToFileURL(cfgPath).href); L19: }

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/utils.mjsView on unpkg · L17

bin/render-report.mjsView file

20* L21: * Exit codes: L22: * 0 HTML written (and opened unless --no-open) ... L24: */ L25: import {spawn} from "node:child_process"; L26: import {existsSync, readFileSync, writeFileSync} from "node:fs"; ... L88: <script type="module"> L89: import { marked } from "https://cdn.jsdelivr.net/npm/marked/lib/marked.esm.js"; L90: import mermaid from "https://cdn.jsdelivr.net/npm/mermaid@11/dist/mermaid.esm.min.mjs"; ... L115: // xdg-mime default firefox_firefox.desktop text/html L116: const opener = process.platform === "darwin" ? "open" : "xdg-open"; L117: spawn(opener, [url], {detached: true, stdio: "ignore"}).unref();

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/render-report.mjsView on unpkg · L20

bin/check-version.shView file

•path = bin/check-version.sh kind = build_helper sizeBytes = 718 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/check-version.shView on unpkg

Findings

1 High5 Medium4 Low

HighSandbox Evasion Gated Capabilitybin/render-report.mjs

MediumDynamic Requirebin/utils.mjs

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperbin/check-version.sh

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowUrl Strings

Source & flagged code

3 flagged

bin/utils.mjsView file

Lines 1-20javascript

1/**

2 * Shared helpers for CLI bin scripts.

3 */

5import path from "node:path";

6import fs from "node:fs";

7import {pathToFileURL} from "node:url";

9/**

10 * Load an optional per-repo config file from cwd.

11 *

12 * Each CLI tool looks for `<tool>.config.mjs` (e.g.

13 * `readability.config.mjs`) in the consumer's project root.

14 */

15export async function loadConfig(filename) {

16 const cfgPath = path.join(process.cwd(), filename);

17 if (!fs.existsSync(cfgPath)) return {};

18 return import(pathToFileURL(cfgPath).href);

19}

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/utils.mjsView on unpkg · L17

bin/render-report.mjsView file

Lines 1-40javascript

1#!/usr/bin/env node

3/**

4 * Render a markdown + mermaid report to a self-contained HTML file and open it

5 * in the browser — the reliable renderer for agent reports (docs-xray,

6 * design-xray) whose mermaid diagrams render unreliably in editor previews.

7 *

8 * The report `.md` is inlined into an HTML harness that loads `marked` and

9 * `mermaid` from CDN, so the output is one portable file — no build step, no

10 * editor extension. Write reports into a repo-local dir (e.g. `scratch/`), not

11 * `/tmp`: sandboxed browsers (snap/flatpak) often can't read outside $HOME.

bin/check-version.shView file

•path = bin/check-version.sh kind = build_helper sizeBytes = 718 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/check-version.shView on unpkg