Loading npm security reports…

@gouvfr/dsfr-nexus@1.2.6: Suspicious npm security report (Warn) | LPM Firewall

registry / @gouvfr/dsfr-nexus / 1.2.6

@gouvfr/dsfr-nexus@1.2.6

Le module `dsfr-nexus` est l'interface de ligne de commande (CLI) centrale du Système de Design de l’État - DSFR. Il offre des outils pour gérer et compiler les ressources du DSFR

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 167 file(s), 235 KB of source, external domains: github.com, raw.githubusercontent.com, semver.org, www.systeme-de-design.gouv.fr

Source & flagged code

3 flagged

src/configure/dsfr-archive/archive-release.jsView file

Lines 1-21javascript

1import fs from 'fs';

2import { spawnSync } from 'child_process';

3import { VersionParser } from '../dsfr/state/version/version-parser.js';

High

Child Process

Package source references child process execution.

src/configure/dsfr-archive/archive-release.jsView on unpkg · L1

4import { DSFRConfigurator } from '../dsfr/dsfr-configurator.js';

6class ArchiveRelease {

7 constructor (src) {

8 this._src = src;

9 this._isValid = false;

10 this._isCurrent = false;

11 }

13 get src () {

14 return this._src;

15 }

17 get isValid () {

18 return this._isValid;

19 }

21 get parser () {

src/generate/dsfr/part/part-generator.jsView file

Lines 7-47javascript

7 this._state = state;

8 this._canWrite = false;

9 }

11 get state () {

12 return this._state;

src/preview/dsfr-root/start/start-previewer.jsView file

Lines 1-31javascript

1import path from 'path';

2import { execSync } from 'child_process';

3import { log } from '@gouvfr/dsfr-forge';

5const ROOT

Source & flagged code

3 flagged · loading source

src/configure/dsfr-archive/archive-release.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code