registry / @excellent-so/screen-map / 0.2.1

@excellent-so/screen-map@0.2.1

The map of your running app. One command screenshots every route, graphs how they connect, and finds the screens your nav forgot.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 24 file(s), 140 KB of source, external domains: api.github.com, github.com, www.google.com

Source & flagged code

4 flagged

src/chrome.mjsView file

Lines 1-36javascript

1// Screen Map — chrome: tiered, find-first, never-bundle browser strategy (PRD §6).

2//

3// 1. Fast path — find a system Chrome/Chromium/Edge/Brave (env → known install

4// locations per-OS → `which`). Zero-dep, raw filesystem probing.

5// 2. Miss → print the exact missing thing + fix, then OPTIONALLY download-on-demand

6// via @puppeteer/browsers into ~/.cache/screen-map/, on first run, with a

7// visible progress bar — NEVER a hidden postinstall (Locked #5).

8// 3. Never bundle Chromium — version drift is irrelevant for screenshots, and a

9// bundle blows the Open VSX 256 MB cap.

10//

11// The @puppeteer/browsers dependency is OPTIONAL and lazy-imported only for the

12// download fallback, so the common (system-Chrome) case stays truly zero-dep.

14import fs from "node:fs";

15import os from "node:os";

16import path from "node:path";

17import { execFileSync } from "node:child_process";

High

Child Process

Package source references child process execution.

src/chrome.mjsView on unpkg · L16

19export const CACHE_DIR = path.join(os.homedir(), ".cache", "screen-map");

21/** Known Chrome-family install locations by platform. */

22function knownPaths() {

23 const plt = process.platform;

24 if (plt === "darwin") {

25 return [

26 "/Applications/Google Chrome.app/Contents/MacOS/Google Chrome",

27 "/Applications/Google Chrome Canary.app/Contents/MacOS/Google Chrome Canary",

28 "/Applications/Chromium.app/Contents/MacOS/Chromium",

29 "/Applications/Microsoft Edge.app/Contents/MacOS/Microsoft Edge",

30 "/Applications/Brave Browser.app/Contents/MacOS/Brave Browser",

31 "/Applications/Arc.app/Contents/MacOS/Arc",

32 ];

33 }

34 if (plt === "win32") {

35 const pf = process.env["PROGRAMFILES"] || "C:\\Program Files";

36 const pf86 = process.env["PROGRAMFILES(X86)"] || "C:\\Program Files (x86)";

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

src/chrome.mjsView on unpkg · L16

src/config.mjsView file

Lines 68-108javascript

68 }

69 const parent = path.dirname(dir);

70 if (parent === dir) return null; // reached filesystem root

71 dir = parent;

72 }

73}

75/** Auto-detect the App Router directory under `root`: `app/` then `src/app/`. */

src/server.mjsView file

Lines 93-133javascript

93 if (isAlive && !isAlive()) return false;

94 if (await reachable(base, readyPath)) return true;

95 await new Promise((r) => setTimeout(r, 1500

Source & flagged code

4 flagged · loading source

src/chrome.mjsView file

16import path from "node:path"; L17: import { execFileSync } from "node:child_process"; L18:

High

Child Process

Package source references child process execution.

src/chrome.mjsView on unpkg · L16

16import path from "node:path"; L17: import { execFileSync } from "node:child_process"; L18: L19: export const CACHE_DIR = path.join(os.homedir(), ".cache", "screen-map"); L20: ... L22: function knownPaths() { L23: const plt = process.platform; L24: if (plt === "darwin") { ... L34: if (plt === "win32") { L35: const pf = process.env["PROGRAMFILES"] || "C:\\Program Files"; L36: const pf86 = process.env["PROGRAMFILES(X86)"] || "C:\\Program Files (x86)"; ... L131: "Fix it one of these ways:",

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

src/chrome.mjsView on unpkg · L16

src/config.mjsView file

88// ESM/CJS config: import as a module and take the default export (or the module). L89: const mod = await import(pathToFileURL(file).href); L90: return mod.default ?? mod;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/config.mjsView on unpkg · L88

src/server.mjsView file

113const port = cfg.port > 0 ? cfg.port : await pickPort(cfg.portBase); L114: const base = `http://localhost:${port}`; L115: L116: const childEnv = { L117: ...process.env, L118: ...cfg.env, ... L126: const pre = Array.isArray(cfg.prepare) ? cfg.prepare : String(cfg.prepare).trim().split(/\s+/); L127: const r = spawnSync(pre[0], pre.slice(1), { cwd, env: childEnv, stdio: "inherit" }); L128: if (r.status !== 0) throw new Error(`managed server: prepare step failed (exit ${r.status})`);

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

src/server.mjsView on unpkg · L113

Findings

4 High4 Medium4 Low

HighChild Processsrc/chrome.mjs

HighShell

HighSame File Env Network Executionsrc/server.mjs

HighSandbox Evasion Gated Capabilitysrc/chrome.mjs

MediumDynamic Requiresrc/config.mjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

src/chrome.mjsView file

Lines 1-36javascript

1// Screen Map — chrome: tiered, find-first, never-bundle browser strategy (PRD §6).

2//

3// 1. Fast path — find a system Chrome/Chromium/Edge/Brave (env → known install

4// locations per-OS → `which`). Zero-dep, raw filesystem probing.

5// 2. Miss → print the exact missing thing + fix, then OPTIONALLY download-on-demand

6// via @puppeteer/browsers into ~/.cache/screen-map/, on first run, with a

7// visible progress bar — NEVER a hidden postinstall (Locked #5).

8// 3. Never bundle Chromium — version drift is irrelevant for screenshots, and a

9// bundle blows the Open VSX 256 MB cap.

10//

11// The @puppeteer/browsers dependency is OPTIONAL and lazy-imported only for the

12// download fallback, so the common (system-Chrome) case stays truly zero-dep.

14import fs from "node:fs";

15import os from "node:os";

16import path from "node:path";

17import { execFileSync } from "node:child_process";

High

Child Process

Package source references child process execution.

src/chrome.mjsView on unpkg · L16

19export const CACHE_DIR = path.join(os.homedir(), ".cache", "screen-map");

21/** Known Chrome-family install locations by platform. */

22function knownPaths() {

23 const plt = process.platform;

24 if (plt === "darwin") {

25 return [

26 "/Applications/Google Chrome.app/Contents/MacOS/Google Chrome",

27 "/Applications/Google Chrome Canary.app/Contents/MacOS/Google Chrome Canary",

28 "/Applications/Chromium.app/Contents/MacOS/Chromium",

29 "/Applications/Microsoft Edge.app/Contents/MacOS/Microsoft Edge",

30 "/Applications/Brave Browser.app/Contents/MacOS/Brave Browser",

31 "/Applications/Arc.app/Contents/MacOS/Arc",

32 ];

33 }

34 if (plt === "win32") {

35 const pf = process.env["PROGRAMFILES"] || "C:\\Program Files";

36 const pf86 = process.env["PROGRAMFILES(X86)"] || "C:\\Program Files (x86)";

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

src/chrome.mjsView on unpkg · L16

src/config.mjsView file

Lines 68-108javascript

68 }

69 const parent = path.dirname(dir);

70 if (parent === dir) return null; // reached filesystem root

71 dir = parent;

72 }

73}

75/** Auto-detect the App Router directory under `root`: `app/` then `src/app/`. */

src/server.mjsView file

Lines 93-133javascript

93 if (isAlive && !isAlive()) return false;

94 if (await reachable(base, readyPath)) return true;

95 await new Promise((r) => setTimeout(r, 1500