registry / @chess-pgn/chess-pgn / 1.2.0

@chess-pgn/chess-pgn@1.2.0

Chess library with enhanced PGN support for parsing large, multi-game PGN files.

Static Scan Results

scanned 4h ago · by rust-scanner

Static analysis flagged 8 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessFilesystemShell

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 26 file(s), 678 KB of source

Source & flagged code

2 flagged

test-setup.tsView file

Lines 1-40typescript

1/**

2 * Test setup file for vitest

3 * Compiles worker scripts before tests run

4 */

6import { execSync } from 'child_process'

7import { existsSync, unlinkSync } from 'fs'

High

Child Process

Package source references child process execution.

test-setup.tsView on unpkg · L5

8import { join } from 'path'

10const workerSource = join(__dirname, 'src', 'workerParser.ts')

11const workerOutput = join(__dirname, 'src', 'workerParser.js')

13// Only compile if not already compiled (avoid recompiling in parallel tests)

14if (!existsSync(workerOutput)) {

15 console.log('Compiling worker script for tests...')

16 try {

17 /*

18 * Compile with esbuild for fast bundling that resolves dependencies

19 * This creates a standalone CommonJS file with all dependencies

20 */

21 execSync(

22 `npx esbuild ${workerSource} --bundle --platform=node --format=cjs --outfile=${workerOutput} --external:worker_threads`,

23 { stdio: 'inherit' },

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

test-setup.tsView on unpkg · L20

24 )

25 console.log('Worker script compiled successfully')

26 } catch (error) {

27 console.error('Failed to compile worker script:', error)

28 process.exit(1)

29 }

30}

32// Cleanup on process exit

33process.on('exit', () => {

34 try {

35 if (existsSync(workerOutput)) {

36 unlinkSync(workerOutput)

37 }

38 } catch {

39 // Ignore cleanup errors (file may already be deleted by another process)

40 }

Source & flagged code

2 flagged · loading source

test-setup.tsView file

5L6: import { execSync } from 'child_process' L7: import { existsSync, unlinkSync } from 'fs'

High

Child Process

Package source references child process execution.

test-setup.tsView on unpkg · L5

20*/ L21: execSync( L22: `npx esbuild ${workerSource} --bundle --platform=node --format=cjs --outfile=${workerOutput} --external:worker_threads`, L23: { stdio: 'inherit' },

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

test-setup.tsView on unpkg · L20

Findings

3 High1 Medium4 Low

HighChild Processtest-setup.ts

HighShell

HighRuntime Package Installtest-setup.ts

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

Source & flagged code

2 flagged

test-setup.tsView file

Lines 1-40typescript

1/**

2 * Test setup file for vitest

3 * Compiles worker scripts before tests run

4 */

6import { execSync } from 'child_process'

7import { existsSync, unlinkSync } from 'fs'

High

Child Process

Package source references child process execution.

test-setup.tsView on unpkg · L5

8import { join } from 'path'

10const workerSource = join(__dirname, 'src', 'workerParser.ts')

11const workerOutput = join(__dirname, 'src', 'workerParser.js')

13// Only compile if not already compiled (avoid recompiling in parallel tests)

14if (!existsSync(workerOutput)) {

15 console.log('Compiling worker script for tests...')

16 try {

17 /*

18 * Compile with esbuild for fast bundling that resolves dependencies

19 * This creates a standalone CommonJS file with all dependencies

20 */

21 execSync(

22 `npx esbuild ${workerSource} --bundle --platform=node --format=cjs --outfile=${workerOutput} --external:worker_threads`,

23 { stdio: 'inherit' },

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

test-setup.tsView on unpkg · L20

24 )

25 console.log('Worker script compiled successfully')

26 } catch (error) {

27 console.error('Failed to compile worker script:', error)

28 process.exit(1)

29 }

30}

32// Cleanup on process exit

33process.on('exit', () => {

34 try {

35 if (existsSync(workerOutput)) {

36 unlinkSync(workerOutput)

37 }

38 } catch {

39 // Ignore cleanup errors (file may already be deleted by another process)

40 }