registry / @docpod/cli / 0.2.1

@docpod/cli@0.2.1

Markdown, instantly polished. A zero-config CLI that turns a repo's Markdown into a modern doc site.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 18 file(s), 82.1 KB of source, external domains: docpod.dev, www.sitemaps.org, www.w3.org

Source & flagged code

3 flagged

dist/load.jsView file

Lines 102-142javascript

102 try {

103 await access(p);

104 return true;

105 } catch {

106 return false;

107 }

108}

109async function findConfig(cwd, explicit) {

110 if (explicit) {

111 const abs = isAbsolute(explicit) ? explicit : resolve(cwd, explicit);

112 return await exists(abs) ? abs : void 0;

113 }

114 for (const name of CONFIG_NAMES) {

115 const abs = resolve(cwd, name);

116 if (await exists(abs)) return abs;

117 }

118}

119/** Load a config module. `.ts` files go through tsx (lazy import). */

120async function importConfig(path) {

121 if (path.endsWith(".json")) return JSON.parse(await readFile(path, "utf8"));

122 if (path.endsWith(".ts")) {

123 const { tsImport } = await import("tsx/esm/api");

124 return unwrapDefault(await tsImport(pathToFileURL(path).href, import.meta.url));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/load.jsView on unpkg · L122

125 }

126 return unwrapDefault(await import(pathToFileURL(path).href));

127}

128/** Peel ESM/CJS interop `default` wrappers until we reach the config object. */

129function unwrapDefault(mod) {

130 let cur = mod;

131 for (let i = 0; i < 3; i++) if (cur && typeof cur === "object" && "default" in cur) cur = cur.default;

132 else break;

133 return cur;

134}

135async function readPkg(cwd) {

136 try {

137 return JSON.parse(await readFile(resolve(cwd, "package.json"), "utf8"));

138 } catch {

139 return {};

140 }

141}

142/**

dist/devserver.jsView file

Lines 1-26javascript

1import { n as renderNode, t as loadSite } from "./site.js";

2import { r as readAsset, t as renderPage } from "./render.js";

3import { t as mimeFor } from "./mime.js";

4import { readFile } from "node:fs/promises";

dist/build.jsView file

Lines 123-154javascript

123 pages,

124 base: config.build.base,

125 builtAt: new Date(started).toISOString()

126 }, null, 2), "utf8");

127 if (config.search.enabled) await runPagefind(outDir, logger);

128 const

Source & flagged code

3 flagged · loading source

dist/load.jsView file

122if (path.endsWith(".ts")) { L123: const { tsImport } = await import("tsx/esm/api"); L124: return unwrapDefault(await tsImport(pathToFileURL(path).href, import.meta.url));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/load.jsView on unpkg · L122

dist/devserver.jsView file

6import { watch } from "node:fs"; L7: import { createServer } from "node:http"; L8: import { createHash } from "node:crypto"; ... L23: } L24: const accept = createHash("sha1").update(key + WS_GUID).digest("base64"); L25: socket.write(`HTTP/1.1 101 Switching Protocols\r L26: Upgrade: websocket\r

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/devserver.jsView on unpkg · L6

dist/build.jsView file

143package = @docpod/cli; repositoryIdentity = docpod; dependency = pagefind L143: try { L144: const { index } = await (await import("pagefind")).createIndex(); L145: await index.addDirectory({ path: outDir });

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/build.jsView on unpkg · L143

Findings

1 High4 Medium5 Low

HighCopied Package Dependency Bridgedist/build.js

MediumDynamic Requiredist/load.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowWeak Cryptodist/devserver.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

dist/load.jsView file

Lines 102-142javascript

102 try {

103 await access(p);

104 return true;

105 } catch {

106 return false;

107 }

108}

109async function findConfig(cwd, explicit) {

110 if (explicit) {

111 const abs = isAbsolute(explicit) ? explicit : resolve(cwd, explicit);

112 return await exists(abs) ? abs : void 0;

113 }

114 for (const name of CONFIG_NAMES) {

115 const abs = resolve(cwd, name);

116 if (await exists(abs)) return abs;

117 }

118}

119/** Load a config module. `.ts` files go through tsx (lazy import). */

120async function importConfig(path) {

121 if (path.endsWith(".json")) return JSON.parse(await readFile(path, "utf8"));

122 if (path.endsWith(".ts")) {

123 const { tsImport } = await import("tsx/esm/api");

124 return unwrapDefault(await tsImport(pathToFileURL(path).href, import.meta.url));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/load.jsView on unpkg · L122

125 }

126 return unwrapDefault(await import(pathToFileURL(path).href));

127}

128/** Peel ESM/CJS interop `default` wrappers until we reach the config object. */

129function unwrapDefault(mod) {

130 let cur = mod;

131 for (let i = 0; i < 3; i++) if (cur && typeof cur === "object" && "default" in cur) cur = cur.default;

132 else break;

133 return cur;

134}

135async function readPkg(cwd) {

136 try {

137 return JSON.parse(await readFile(resolve(cwd, "package.json"), "utf8"));

138 } catch {

139 return {};

140 }

141}

142/**

dist/devserver.jsView file

Lines 1-26javascript

1import { n as renderNode, t as loadSite } from "./site.js";

2import { r as readAsset, t as renderPage } from "./render.js";

3import { t as mimeFor } from "./mime.js";

4import { readFile } from "node:fs/promises";

dist/build.jsView file

Lines 123-154javascript

123 pages,

124 base: config.build.base,

125 builtAt: new Date(started).toISOString()

126 }, null, 2), "utf8");

127 if (config.search.enabled) await runPagefind(outDir, logger);

128 const