registry / @excellent-so/screen-map / 0.2.2

@excellent-so/screen-map@0.2.2

The map of your running app. One command screenshots every route, graphs how they connect, and finds the screens your nav forgot.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 24 file(s), 140 KB of source, external domains: api.github.com, github.com, www.google.com

Source & flagged code

4 flagged

src/chrome.mjsView file

Lines 1-36javascript

1// Screen Map — chrome: tiered, find-first, never-bundle browser strategy (PRD §6).

2//

3// 1. Fast path — find a system Chrome/Chromium/Edge/Brave (env → known install

4// locations per-OS → `which`). Zero-dep, raw filesystem probing.

5// 2. Miss → print the exact missing thing + fix, then OPTIONALLY download-on-demand

6// via @puppeteer/browsers into ~/.cache/screen-map/, on first run, with a

7// visible progress bar — NEVER a hidden postinstall (Locked #5).

8// 3. Never bundle Chromium — version drift is irrelevant for screenshots, and a

9// bundle blows the Open VSX 256 MB cap.

Source & flagged code

4 flagged · loading source

src/chrome.mjsView file

16import path from "node:path"; L17: import { execFileSync } from "node:child_process"; L18:

High

Child Process

Package source references child process execution.

src/chrome.mjsView on unpkg · L16

16import path from "node:path"; L17: import { execFileSync } from "node:child_process"; L18: L19: export const CACHE_DIR = path.join(os.homedir(), ".cache", "screen-map"); L20: ... L22: function knownPaths() { L23: const plt = process.platform; L24: if (plt === "darwin") { ... L34: if (plt === "win32") { L35: const pf = process.env["PROGRAMFILES"] || "C:\\Program Files"; L36: const pf86 = process.env["PROGRAMFILES(X86)"] || "C:\\Program Files (x86)"; ... L131: "Fix it one of these ways:",

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

src/chrome.mjsView on unpkg · L16

src/config.mjsView file

88// ESM/CJS config: import as a module and take the default export (or the module). L89: const mod = await import(pathToFileURL(file).href); L90: return mod.default ?? mod;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/config.mjsView on unpkg · L88

src/server.mjsView file

113const port = cfg.port > 0 ? cfg.port : await pickPort(cfg.portBase); L114: const base = `http://localhost:${port}`; L115: L116: const childEnv = { L117: ...process.env, L118: ...cfg.env, ... L126: const pre = Array.isArray(cfg.prepare) ? cfg.prepare : String(cfg.prepare).trim().split(/\s+/); L127: const r = spawnSync(pre[0], pre.slice(1), { cwd, env: childEnv, stdio: "inherit" }); L128: if (r.status !== 0) throw new Error(`managed server: prepare step failed (exit ${r.status})`);

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

src/server.mjsView on unpkg · L113

Findings

4 High4 Medium4 Low

HighChild Processsrc/chrome.mjs

HighShell

HighSame File Env Network Executionsrc/server.mjs

HighSandbox Evasion Gated Capabilitysrc/chrome.mjs

MediumDynamic Requiresrc/config.mjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

src/config.mjsView file

Lines 68-108javascript

68 }

69 const parent = path.dirname(dir);

70 if (parent === dir) return null; // reached filesystem root

71 dir = parent;

72 }

73}

75/** Auto-detect the App Router directory under `root`: `app/` then `src/app/`. */

76export function detectAppDir(root) {

77 for (const candidate of ["app", "src/app"]) {

78 const abs = path.join(root, candidate);

79 if (fs.existsSync(abs) && fs.statSync(abs).isDirectory()) return candidate;

80 }

81 return "app"; // last-resort default; a build will report zero screens if wrong

82}

84async function loadRaw(file) {

85 if (file.endsWith(".json")) {

86 return JSON.parse(fs.readFileSync(file, "utf8"));

87 }

88 // ESM/CJS config: import as a module and take the default export (or the module).

89 const mod = await import(pathToFileURL(file).href);

90 return mod.default ?? mod;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/config.mjsView on unpkg · L88

91}

93/** Coerce `config.groups` into a `(route) => group` function. */

94function normalizeGroups(groups) {

95 if (typeof groups === "function") return groups;

96 if (groups && typeof groups === "object") {

97 // { root-segment: group } map, else the root segment itself.

98 return (route) => {

99 const root = route.split("/").filter(Boolean)[0] || "root";

100 return groups[root] || root;

101 };

102 }

103 // Default: the first path segment is the group.

104 return (route) => route.split("/").filter(Boolean)[0] || "root";

105}

106

107/** Coerce a nav-backbone entry ("/path" or { to, label }) into { to, label }. */

108function normalizeBackbone(list) {

src/server.mjsView file

Lines 93-133javascript

93 if (isAlive && !isAlive()) return false;

94 if (await reachable(base, readyPath)) return true;

95 await new Promise((r) => setTimeout(r, 1500));

96 }

97 return false;

98}

100/**

101 * Start a managed dev server from a normalized `server` config. Returns

102 * { base, port, stop(), restarts() }.

103 *

104 * @param {object} o

105 * @param {object} o.server normalized server config (see normalizeServer)

106 * @param {string} o.root config root (cwd is resolved relative to it)

107 * @param {(m:string)=>void} [o.log]

108 */

109export async function startManagedServer({ server, root, log = () => {} }) {

110 const cfg = normalizeServer(server);

111 if (!cfg) throw new Error("managed server: no `server.command` configured");

112 const cwd = path.resolve(root, cfg.cwd);

113 const port = cfg.port > 0 ? cfg.port : await pickPort(cfg.portBase);

114 const base = `http://localhost:${port}`;

115

116 const childEnv = {

117 ...process.env,

118 ...cfg.env,

119 PORT: String(port),

120 SCREENMAP_BASE: "", // never let an inherited override redirect the child

121 };

122 if (cfg.distDirEnv) childEnv[cfg.distDirEnv] = cfg.distDir;

123

124 if (cfg.prepare) {

125 log(`● managed server: prepare — ${Array.isArray(cfg.prepare) ? cfg.prepare.join(" ") : cfg.prepare}`);

126 const pre = Array.isArray(cfg.prepare) ? cfg.prepare : String(cfg.prepare).trim().split(/\s+/);

127 const r = spawnSync(pre[0], pre.slice(1), { cwd, env: childEnv, stdio: "inherit" });

128 if (r.status !== 0) throw new Error(`managed server: prepare step failed (exit ${r.status})`);

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

src/server.mjsView on unpkg · L113

129 }

130

131 const argv = cfg.portFlag ? [...cfg.command.slice(1), cfg.portFlag, String(port)] : cfg.command.slice(1);

132 log(`● managed dev server`);

133 log(` command: ${cfg.command[0]} ${argv.join(" ")} (cwd ${path.relative(root, cwd) || "."})`);