registry  /  @cfmleditor/tree-sitter-cfml  /  0.26.30

@cfmleditor/tree-sitter-cfml@0.26.30

CFML grammar for tree-sitter

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessEnvironmentVarsFilesystemNativeBindingsShell
Supply chain
HighEntropyStringsUrlStrings
ManifestNo manifest risk signals triggered.
scanned 20 file(s), 111 KB of source, external domains: stackoverflow.com

Source & flagged code

4 flagged · loading source
package.jsonView file
•scripts.postinstall = node scripts/ensure-tree-sitter-cli-binary.js
High
Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg
scripts/build.jsView file
3const {join} = require('path'); L4: const {spawnSync} = require('child_process'); L5: const {spawnTreeSitter, spawnTreeSitterAsync, root} = require('./tree-sitter-cli.cjs');
High
Child Process

Package source references child process execution.

scripts/build.jsView on unpkg · L3
32// Rebuild native addon L33: const rb = spawnSync('npx', ['node-gyp', 'rebuild'], {cwd: root, stdio: 'inherit'}); L34: if (rb.status !== 0) {
High
Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/build.jsView on unpkg · L32
binding.gypView file
•path = binding.gyp kind = build_helper sizeBytes = 792 magicHex = [redacted]
Medium
Ships Build Helper

Package ships non-JavaScript build or shell helper files.

binding.gypView on unpkg

Findings

4 High3 Medium4 Low
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processscripts/build.js
HighShell
HighRuntime Package Installscripts/build.js
MediumEnvironment Vars
MediumShips Build Helperbinding.gyp
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings