registry / @flun/desktop-builder / 1.0.3

@flun/desktop-builder@1.0.3

将任意 Node.js 网站一键打包为当前桌面应用('win', 'mac', 'linux')（基于 Electron）,支持高度自定义配置;

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 5 file(s), 34.9 KB of source, external domains: electronjs.org, mirrors.huaweicloud.com, npmmirror.com, www.abc.com

Source & flagged code

4 flagged

package.jsonView file

Lines 1-35json

2 "name": "@flun/desktop-builder",

3 "version": "1.0.3",

4 "description": "将任意 Node.js 网站一键打包为当前桌面应用('win', 'mac', 'linux')（基于 Electron）,支持高度自定义配置;",

5 "type": "module",

6 "types": "index.d.ts",

7 "exports": {

8 ".": "./index.js"

9 },

10 "main": "index.js",

11 "bin": {

12 "desktop-builder": "./index.js"

13 },

14 "scripts": {

15 "postinstall": "node copy-files.js 2>&1"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L15

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L15

16 },

17 "keywords": [

18 "electron",

19 "desktop",

20 "nodejs",

21 "packager",

22 "installer",

23 "nsis",

24 "dmg",

25 "appimage"

26 ],

27 "author": "flun <open@flun.top>",

28 "license": "ISC",

29 "repository": {

30 "type": "git",

31 "url": "git+https://github.com/OpenFlun/desktop-builder.git"

32 },

33 "homepage": "https://github.com/OpenFlun/desktop-builder#readme",

34 "bugs": {

35 "url": "https://github.com/OpenFlun/desktop-builder/issues"

electron-main.jsView file

Lines 244-284javascript

244

245 const ready = await waitForServer(port, 30000);

246 if (ready) return;

247

248 log(`服务器未就绪 (尝试 ${attempt}/3),重试...`), killServerProcess(), await sleep(2000

lib/setup.icoView file

•path = lib/setup.ico kind = high_entropy_blob sizeBytes = 14040 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

lib/setup.icoView on unpkg

Source & flagged code

4 flagged · loading source

package.jsonView file

•scripts.postinstall = node copy-files.js 2>&1

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node copy-files.js 2>&1

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

electron-main.jsView file

264/^(async\s+)?(function\s*(\w*\s*)?$|\($\s*=>|async\s*\s*=>)/.test(newItem.click.trim())) L265: try { newItem.click = eval(newItem.click) } catch (_) { } L266:

Low

Eval

Package source references a known benign dynamic code generation pattern.

electron-main.jsView on unpkg · L264

lib/setup.icoView file

•path = lib/setup.ico kind = high_entropy_blob sizeBytes = 14040 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

lib/setup.icoView on unpkg

Findings

2 High4 Medium5 Low

HighInstall Time Lifecycle Scriptspackage.json

HighShips High Entropy Bloblib/setup.ico

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvalelectron-main.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

package.jsonView file

Lines 1-35json

2 "name": "@flun/desktop-builder",

3 "version": "1.0.3",

4 "description": "将任意 Node.js 网站一键打包为当前桌面应用('win', 'mac', 'linux')（基于 Electron）,支持高度自定义配置;",

5 "type": "module",

6 "types": "index.d.ts",

7 "exports": {

8 ".": "./index.js"

9 },

10 "main": "index.js",

11 "bin": {

12 "desktop-builder": "./index.js"

13 },

14 "scripts": {

15 "postinstall": "node copy-files.js 2>&1"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L15

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L15

16 },

17 "keywords": [

18 "electron",

19 "desktop",

20 "nodejs",

21 "packager",

22 "installer",

23 "nsis",

24 "dmg",

25 "appimage"

26 ],

27 "author": "flun <open@flun.top>",

28 "license": "ISC",

29 "repository": {

30 "type": "git",

31 "url": "git+https://github.com/OpenFlun/desktop-builder.git"

32 },

33 "homepage": "https://github.com/OpenFlun/desktop-builder#readme",

34 "bugs": {

35 "url": "https://github.com/OpenFlun/desktop-builder/issues"

electron-main.jsView file

Lines 244-284javascript

244

245 const ready = await waitForServer(port, 30000);

246 if (ready) return;

247

248 log(`服务器未就绪 (尝试 ${attempt}/3),重试...`), killServerProcess(), await sleep(2000

lib/setup.icoView file

•path = lib/setup.ico kind = high_entropy_blob sizeBytes = 14040 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

lib/setup.icoView on unpkg