registry  /  @flun/html-template  /  5.0.31

@flun/html-template@5.0.31

一个HTML模板工具包,提供开发服务器和模板编译功能,支持自定义标签和快捷输入,变量定义,包含文件引用,帮助开发者模块化处理HTML;

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
Supply chain
HighEntropyStringsUrlStrings
ManifestNo manifest risk signals triggered.
scanned 27 file(s), 325 KB of source, external domains: work.weixin.qq.com, www.npmjs.com

Source & flagged code

5 flagged · loading source
package.jsonView file
•scripts.postinstall = node copy-files.js 2>&1
High
Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg
•scripts.postinstall = node copy-files.js 2>&1
Medium
Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg
static/utils/foldgutter.jsView file
3(function (mod) { L4: if (typeof exports == "object" && typeof module == "object") mod(require("../../lib/codemirror"), require("./foldcode")); L5: else if (typeof define == "function" && define.amd) define(["../../lib/codemirror", "./foldcode"], mod);
Medium
Dynamic Require

Package source references dynamic require/import behavior.

static/utils/foldgutter.jsView on unpkg · L3
services/templateService.jsView file
29*/ L30: const CWD = process.cwd(), templatesDir = 'templates', staticDir = 'static', customizeDir = 'customize', L31: accountDir = 'account', defaultPort = 7296; ... L126: * 2. 函数参数 (options.port) L127: * 3. 环境变量 (process.env.PORT) L128: * 4. 默认值 (常量 defaultPort)
Medium
Unsafe Vm Context

Package source executes code through a VM context API.

services/templateService.jsView on unpkg · L29
compile.jsView file
•matchType = previous_version_dangerous_delta matchedPackage = @flun/html-template@5.0.26 matchedIdentity = npm:QGZsdW4vaHRtbC10ZW1wbGF0ZQ:5.0.26 similarity = 0.778 summary = stored previous version shares package body but lacks this dangerous source file
High
Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

compile.jsView on unpkg

Findings

2 High6 Medium4 Low
HighInstall Time Lifecycle Scriptspackage.json
HighPrevious Version Dangerous Deltacompile.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requirestatic/utils/foldgutter.js
MediumUnsafe Vm Contextservices/templateService.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings