registry  /  @flun/html-template  /  5.0.26

@flun/html-template@5.0.26

一个HTML模板工具包,提供开发服务器和模板编译功能,支持自定义标签和快捷输入,变量定义,包含文件引用,帮助开发者模块化处理HTML;

Static Scan Results

scanned 10d ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
Supply chain
HighEntropyStringsUrlStrings
ManifestNo manifest risk signals triggered.
scanned 27 file(s), 325 KB of source, external domains: work.weixin.qq.com, www.npmjs.com

Source & flagged code

4 flagged · loading source
package.jsonView file
•scripts.postinstall = node copy-files.js 2>&1
High
Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg
•scripts.postinstall = node copy-files.js 2>&1
Medium
Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg
static/utils/foldgutter.jsView file
3(function (mod) { L4: if (typeof exports == "object" && typeof module == "object") mod(require("../../lib/codemirror"), require("./foldcode")); L5: else if (typeof define == "function" && define.amd) define(["../../lib/codemirror", "./foldcode"], mod);
Medium
Dynamic Require

Package source references dynamic require/import behavior.

static/utils/foldgutter.jsView on unpkg · L3
services/templateService.jsView file
29*/ L30: const CWD = process.cwd(), templatesDir = 'templates', staticDir = 'static', customizeDir = 'customize', L31: accountDir = 'account', defaultPort = 7296; ... L129: * 2. 函数参数 (options.port) L130: * 3. 环境变量 (process.env.PORT) L131: * 4. 默认值 (常量 defaultPort)
Medium
Unsafe Vm Context

Package source executes code through a VM context API.

services/templateService.jsView on unpkg · L29

Findings

1 High6 Medium4 Low
HighInstall Time Lifecycle Scriptspackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requirestatic/utils/foldgutter.js
MediumUnsafe Vm Contextservices/templateService.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings