registry / @extenshi/cli / 0.8.0
@extenshi/cli@0.8.0
Pre-publish security scanner for browser extensions
Static Scan Results
scanned 4mo ago · by rust-scannerStatic analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
One or more suspicious static signals were detected.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsTelemetryUrlStrings
NoLicense
Source & flagged code
4 flaggedpackage.jsonView file
•scripts.postinstall = node scripts/postinstall.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.cjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/review-checks.jsView file
247// A pre-publish "will the store reject this?" gate must only flag what the
L248: // developer can act on AND what the store actually rejects. eval()/new Function()
L249: // and dynamic-<script> patterns inside a bundled third-party library (webpack
Low
Eval
Package source references a known benign dynamic code generation pattern.
dist/review-checks.jsFindings
1 High5 Medium8 Low
HighInstall Time Lifecycle Scriptspackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requiredist/auto-update.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvaldist/review-checks.js
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @extenshi/cli@0.8.0.
See all versions of @extenshi/cli for other recorded verdicts.
- Review the evidence and your use of @extenshi/cli@0.8.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.