registry / @doc77/core / 0.2.11

@doc77/core@0.2.11

Doc77 核心引擎 — 数据库、文件系统抽象层、预览引擎、Express Server

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 8 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 6 file(s), 260 KB of source, external domains: api.deepseek.com, api.moonshot.cn, api.openai.com, ark.cn-beijing.volces.com, cdn.jsdelivr.net, cdn.tailwindcss.com, cdnjs.cloudflare.com, dashscope.aliyuncs.com, open.bigmodel.cn

Source & flagged code

1 flagged

dist/index.cjsView file

Lines 716-756javascript

716 normalized

717 );

718 } else {

719 db.prepare("DELETE FROM filetree_cache WHERE project_id = ?").run(projectId);

720 }

721}

722function isCacheValid(absDirPath, cachedMtimeMap) {

723 for (const [name, cachedMtime] of Object.entries(cachedMtimeMap)) {

724 try {

725 const stats = fs3.statSync(path3.join(absDirPath, name));

726 if (stats.mtime.toISOString() !== cachedMtime) {

727 return false;

728 }

729 } catch {

730 return false;

731 }

732 }

733 return true;

734}

735

736// src/server/app.ts

737var import_express = __toESM(require("express"), 1);

738var path4 = __toESM(require("path"), 1);

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/index.cjsView on unpkg · L736

739var fs4 = __toESM(require("fs"), 1);

740var import_node_child_process3 = require("child_process");

741

742// src/server/dialog.ts

743var import_node_child_process2 = require("child_process");

744var import_node_fs = require("fs");

745function isWSL() {

746 try {

747 return /microsoft|wsl/i.test((0, import_node_fs.readFileSync)("/proc/version", "utf-8"));

748 } catch {

749 return false;

750 }

751}

752function hasDisplay() {

753 return !!(process.env.DISPLAY || process.env.WAYLAND_DISPLAY);

754}

755function openDirectoryDialog() {

756 if (isWSL()) {

Source & flagged code

1 flagged · loading source

dist/index.cjsView file

736package = @doc77/core; repositoryIdentity = doc77; dependency = express L736: // src/server/app.ts L737: var import_express = __toESM(require("express"), 1); L738: var path4 = __toESM(require("path"), 1);

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/index.cjsView on unpkg · L736

Findings

1 High3 Medium4 Low

HighCopied Package Dependency Bridgedist/index.cjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

1 flagged

dist/index.cjsView file

Lines 716-756javascript

716 normalized

717 );

718 } else {

719 db.prepare("DELETE FROM filetree_cache WHERE project_id = ?").run(projectId);

720 }

721}

722function isCacheValid(absDirPath, cachedMtimeMap) {

723 for (const [name, cachedMtime] of Object.entries(cachedMtimeMap)) {

724 try {

725 const stats = fs3.statSync(path3.join(absDirPath, name));

726 if (stats.mtime.toISOString() !== cachedMtime) {

727 return false;

728 }

729 } catch {

730 return false;

731 }

732 }

733 return true;

734}

735

736// src/server/app.ts

737var import_express = __toESM(require("express"), 1);

738var path4 = __toESM(require("path"), 1);

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/index.cjsView on unpkg · L736

739var fs4 = __toESM(require("fs"), 1);

740var import_node_child_process3 = require("child_process");

741

742// src/server/dialog.ts

743var import_node_child_process2 = require("child_process");

744var import_node_fs = require("fs");

745function isWSL() {

746 try {

747 return /microsoft|wsl/i.test((0, import_node_fs.readFileSync)("/proc/version", "utf-8"));

748 } catch {

749 return false;

750 }

751}

752function hasDisplay() {

753 return !!(process.env.DISPLAY || process.env.WAYLAND_DISPLAY);

754}

755function openDirectoryDialog() {

756 if (isWSL()) {