registry / @fnndsc/chili / 3.3.0

@fnndsc/chili@3.3.0

ChILI handles Intelligent Line Interactions: A CLI and library for ChRIS, acting as the controller layer for business logic and user presentation.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 8 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 100 file(s), 331 KB of source, external domains: cdn.jsdelivr.net, cube.chrisproject.org, github.com

Source & flagged code

2 flagged

dist/man/renderer.jsView file

Lines 1-29javascript

1/**

2 * @file AsciiDoc/man page rendering and browser-open helpers.

3 *

4 * @module

5 */

6import fs from "fs";

7import path from "path";

8import chalk from "chalk";

9import { convert as adoc_convert } from "asciidoctor";

10import { exec } from "child_process";

11import os from "os";

High

Child Process

Package source references child process execution.

dist/man/renderer.jsView on unpkg · L9

12const headingStyles = [

13 { regex: /<h1.*?>(.*?)<\/h1>/g, font: "Standard", color: chalk.magenta },

14 { regex: /<h2.*?>(.*?)<\/h2>/g, font: "Slant", color: chalk.yellow },

15 { regex: /<h3.*?>(.*?)<\/h3>/g, font: "Small", color: chalk.green },

16 { regex: /<h4.*?>(.*?)<\/h4>/g, font: "Mini", color: chalk.blue },

17];

18const asciiHeadingStyles = [

19 {

20 regex: /<h1.*?>(.*?)<\/h1>/g,

21 textTransform: (text) => text.toUpperCase(),

22 color: chalk.yellow,

23 },

24 {

25 regex: /<h2.*?>(.*?)<\/h2>/g,

26 textTransform: (text) => text.toUpperCase(),

27 color: chalk.yellow.italic,

28 },

29 {

dist/path/pathCommand.jsView file

Lines 146-186javascript

146 const tempDir = os.tmpdir();

147 const filePath = path.join(tempDir, "mermaid-diagram.html");

148 fs.writeFileSync(filePath, html);

149 await open(filePath);

150}

151

Source & flagged code

2 flagged · loading source

dist/man/renderer.jsView file

9import { convert as adoc_convert } from "asciidoctor"; L10: import { exec } from "child_process"; L11: import os from "os";

High

Child Process

Package source references child process execution.

dist/man/renderer.jsView on unpkg · L9

dist/path/pathCommand.jsView file

166return new Promise((resolve, reject) => { L167: execFile("npx", ["mmdc", "-i", inputFile, "-o", outputFile], (error) => { L168: if (error) {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/path/pathCommand.jsView on unpkg · L166

Findings

3 High1 Medium4 Low

HighChild Processdist/man/renderer.js

HighShell

HighRuntime Package Installdist/path/pathCommand.js

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

dist/man/renderer.jsView file

Lines 1-29javascript

1/**

2 * @file AsciiDoc/man page rendering and browser-open helpers.

3 *

4 * @module

5 */

6import fs from "fs";

7import path from "path";

8import chalk from "chalk";

9import { convert as adoc_convert } from "asciidoctor";

10import { exec } from "child_process";

11import os from "os";

High

Child Process

Package source references child process execution.

dist/man/renderer.jsView on unpkg · L9

12const headingStyles = [

13 { regex: /<h1.*?>(.*?)<\/h1>/g, font: "Standard", color: chalk.magenta },

14 { regex: /<h2.*?>(.*?)<\/h2>/g, font: "Slant", color: chalk.yellow },

15 { regex: /<h3.*?>(.*?)<\/h3>/g, font: "Small", color: chalk.green },

16 { regex: /<h4.*?>(.*?)<\/h4>/g, font: "Mini", color: chalk.blue },

17];

18const asciiHeadingStyles = [

19 {

20 regex: /<h1.*?>(.*?)<\/h1>/g,

21 textTransform: (text) => text.toUpperCase(),

22 color: chalk.yellow,

23 },

24 {

25 regex: /<h2.*?>(.*?)<\/h2>/g,

26 textTransform: (text) => text.toUpperCase(),

27 color: chalk.yellow.italic,

28 },

29 {

dist/path/pathCommand.jsView file

Lines 146-186javascript

146 const tempDir = os.tmpdir();

147 const filePath = path.join(tempDir, "mermaid-diagram.html");

148 fs.writeFileSync(filePath, html);

149 await open(filePath);

150}

151