registry / @docmd/engine-rust / 0.8.12

@docmd/engine-rust@0.8.12

Rust-accelerated engine for docmd. The postinstall script downloads a pre-built platform binary from npm CDN (unpkg/jsdelivr). No code is executed beyond copying the .node file. Source: https://github.com/docmd-io/docmd

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 7 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

DynamicRequireFilesystemNetwork

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 7.54 KB of source, external domains: cdn.jsdelivr.net, unpkg.com

Source & flagged code

3 flagged

package.jsonView file

Lines 1-36json

2 "name": "@docmd/engine-rust",

3 "version": "0.8.12",

4 "description": "Rust-accelerated engine for docmd. The postinstall script downloads a pre-built platform binary from npm CDN (unpkg/jsdelivr). No code is executed beyond copying the .node file. Source: https://github.com/docmd-io/docmd",

5 "type": "module",

Source & flagged code

3 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.cjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/index.jsView file

18const __dirname = path.dirname(fileURLToPath(import.meta.url)); L19: const require = createRequire(import.meta.url); L20: const SUPPORTED = ['darwin-arm64', 'darwin-x64', 'linux-x64', 'linux-arm64', 'win32-x64'];

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L18

Findings

1 High3 Medium3 Low

HighInstall Time Lifecycle Scriptspackage.json

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requiredist/index.js

MediumNetwork

LowScripts Present

LowFilesystem

LowUrl Strings

dist/index.jsView file

Lines 1-38javascript

1/**

2 * --------------------------------------------------------------------

3 * docmd : the zero-config documentation engine.

4 *

5 * @package @docmd/core (and ecosystem)

6 * @website https://docmd.io

7 * @repository https://github.com/docmd-io/docmd

8 * @license MIT

10 *

11 * [docmd-source] - Please do not remove this header.

12 * --------------------------------------------------------------------

13 */

14import { createRequire } from 'module';

15import * as path from 'path';

16import * as fs from 'fs';

17import { fileURLToPath } from 'url';

18const __dirname = path.dirname(fileURLToPath(import.meta.url));

19const require = createRequire(import.meta.url);

20const SUPPORTED = ['darwin-arm64', 'darwin-x64', 'linux-x64', 'linux-arm64', 'win32-x64'];

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L18

21const BINARY_NAMES = {

22 'darwin-arm64': 'docmd-engine-darwin-arm64.node',

23 'darwin-x64': 'docmd-engine-darwin-x64.node',

24 'linux-x64': 'docmd-engine-linux-x64.node',

25 'linux-arm64': 'docmd-engine-linux-arm64.node',

26 'win32-x64': 'docmd-engine-win32-x64.node',

27};

28function detectPlatform() {

29 const id = `${process.platform}-${process.arch}`;

30 return SUPPORTED.includes(id) ? id : null;

31}

32// ---------------------------------------------------------------------------

33// Binary Loading

34// ---------------------------------------------------------------------------

35function resolveBinaryPath(platformId) {

36 const name = BINARY_NAMES[platformId];

37 // bin/ is sibling to dist/ (both under package root)

38 const pkgRoot = path.join(__dirname, '..');