registry / @dimm-city/print-md / 0.8.1

@dimm-city/print-md@0.8.1

Markdown-to-PDF converter for professional print layout using Paged.js and Ghostscript.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

Manifest

CopyleftLicenseWildcardDependency

scanned 31 file(s), 1.77 MB of source, external domains: 127.0.0.1, api.github.com, api.itch.io, bitbucket.org, broth.itch.ovh, bugzilla.mozilla.org, connect.microsoft.com, css-infos.net, cssdot.ru, dev.azure.com, developer.mozilla.org, drafts.csswg.org, drafts.fxtf.org, git.example.com, github.com, help.dottoro.com, help.shopify.com, itch.io, kdp.amazon.com, learn.microsoft.com, msdn.microsoft.com, phrogz.net, registry.npmjs.org, webkit.org, www.color.org, www.drivethrurpg.com, www.ghostscript.com, www.google.com, www.sitepoint.com, www.w3.org

Source & flagged code

3 flagged

dist/cli-9crbxz3g.jsView file

Lines 17-57javascript

17} from "./cli-fwh13qhj.js";

18import {

19 detectProjectSource,

20 syncRemoteFor

21} from "./cli-1tyj4bk3.js";

22import {

23 defaultGitHttp

Source & flagged code

3 flagged · loading source

dist/cli-9crbxz3g.jsView file

37class BuildError extends Error { L38: exitCode; L39: constructor(message, exitCode = EXIT_CODES.PIPELINE) { ... L453: const lower = url.trim().toLowerCase(); L454: return lower.startsWith("http://") || lower.startsWith("https://") || lower.startsWith("//"); L455: } ... L1067: // src/lib/exec.ts L1068: import { spawn } from "node:child_process"; L1069: import { readdir, mkdir, copyFile } from "node:fs/promises"; ... L1074: var localBin = resolvePath(join(import.meta.dirname, "..", "..", "node_modules", ".bin")); L1075: var enhancedPath = buildEnhancedPath(localBin, process.env.PATH ?? ""); L1076: function enhancedEnv() {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli-9crbxz3g.jsView on unpkg · L37

576async function runLint(opts = {}) { L577: const { glob } = await import("glob"); L578: const { manifest, manifestDir } = await loadManifestWithPath(opts.manifest);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/cli-9crbxz3g.jsView on unpkg · L576

dist/favicon-wkbm9cjn.icoView file

•path = dist/favicon-wkbm9cjn.ico kind = high_entropy_blob sizeBytes = 61444 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/favicon-wkbm9cjn.icoView on unpkg

Findings

2 High5 Medium6 Low

HighSandbox Evasion Gated Capabilitydist/cli-9crbxz3g.js

HighShips High Entropy Blobdist/favicon-wkbm9cjn.ico

MediumDynamic Requiredist/cli-9crbxz3g.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumWildcard Dependency

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowCopyleft License

LPM CLI

Source & flagged code

3 flagged

dist/cli-9crbxz3g.jsView file

Lines 17-57javascript

17} from "./cli-fwh13qhj.js";

18import {

19 detectProjectSource,

20 syncRemoteFor

21} from "./cli-1tyj4bk3.js";

22import {

23 defaultGitHttp

24} from "./cli-mxcqrexc.js";

25import {

26 __require

27} from "./cli-37x76zdn.js";

28

29// src/lib/build-error.ts

30var EXIT_CODES = {

31 OK: 0,

32 FINDINGS: 1,

33 USAGE: 2,

34 PIPELINE: 3

35};

36

37class BuildError extends Error {

38 exitCode;

39 constructor(message, exitCode = EXIT_CODES.PIPELINE) {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli-9crbxz3g.jsView on unpkg · L37

40 super(message);

41 this.name = "BuildError";

42 this.exitCode = exitCode;

43 }

44}

45

46// src/constants.ts

47var NETWORK = {

48 DEFAULT_PORT: 3579

49};

50var DEBOUNCE = {

51 FILE_WATCH: 100

52};

53

54// src/lib/cli-args.ts

55class UsageError extends Error {

56 exitCode;

57 constructor(message, exitCode = EXIT_CODES.USAGE) {

Lines 556-596javascript

556 ...nodeLoc(decl)

557 });

558 }

559 });

560 root.walkRules((rule) => {

561 for (const selector of splitSelectorList(rule.selector)) {

562 if (isPagedjsCrashProneSelector(selector)) {

563 warnings.push({

564 rule: rulePagedjsCrashSelectors,

565 severity: "error",

566 message: `Selector will be skipped by Paged.js (DocumentFragment.querySelectorAll rejects this pattern — break/nth rules won't apply): ${selector}`,

567 ...nodeLoc(rule)

568 });

569 }

570 }

571 });

572 return warnings;

573}

574

575// src/lib/lint-runner.ts

576async function runLint(opts = {}) {

577 const { glob } = await import("glob");

578 const { manifest, manifestDir } = await loadManifestWithPath(opts.manifest);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/cli-9crbxz3g.jsView on unpkg · L576

579 resolveConfig({}, manifest);

580 let files;

581 if (opts.files) {

582 files = await glob([opts.files], { nodir: true, ignore: ["**/*.min.css"] });

583 } else if (manifest.styles?.length) {

584 files = await glob(manifest.styles.map((stylePath) => resolve2(manifestDir, stylePath)), { nodir: true, ignore: ["**/*.min.css"] });

585 } else {

586 const stageFiles = await glob([".build/**/*.css"], {

587 nodir: true,

588 ignore: ["**/*.min.css"]

589 });

590 files = stageFiles.length > 0 ? stageFiles : await glob(["example/**/*.css", "demos/**/*.css"], {

591 ignore: ["node_modules/**", "dist/**"]

592 });

593 }

594 if (files.length === 0) {

595 log.warn("No CSS files found to lint");

596 return { ok: true, riskyCount: 0, filesLinted: 0 };

dist/favicon-wkbm9cjn.icoView file

•path = dist/favicon-wkbm9cjn.ico kind = high_entropy_blob sizeBytes = 61444 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/favicon-wkbm9cjn.icoView on unpkg