registry / @howells/husky / 0.1.2

@howells/husky@0.1.2

Standardised git hooks for Howells projects. Immutable pre-commit and pre-push configuration.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 8 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 4.41 KB of source

Source & flagged code

2 flagged

bin/howells-husky.mjsView file

Lines 1-37javascript

1#!/usr/bin/env node

3/**

4 * @howells/husky — standardised git hooks installer.

5 *

6 * Usage: add `"prepare": "howells-husky"` to package.json.

7 *

8 * On `pnpm install`, this script:

9 * 1. Runs `husky` to initialise the .husky/ directory

10 * 2. Copies the canonical pre-commit and pre-push hooks

11 * 3. Validates that lint-staged config exists in package.json

12 *

13 * The hook scripts are immutable — they come from the package,

14 * not from the project. This prevents agents or developers from

15 * weakening the configuration to get things to pass.

16 */

18import { spawnSync } from "node:child_process";

19import {

High

Child Process

Package source references child process execution.

bin/howells-husky.mjsView on unpkg · L17

20 copyFileSync,

21 existsSync,

22 mkdirSync,

23 readFileSync,

24 chmodSync,

25} from "node:fs";

26import { dirname, join, resolve } from "node:path";

27import { fileURLToPath } from "node:url";

29const __dirname = import.meta.dirname;

30const packageRoot = resolve(__dirname, "..");

31const projectRoot = process.cwd();

32// `howells-fix` is the current canonical @howells/lint fixer; `howells-ox-fix`

33// and `howells-format` are earlier names still in use by repos mid-migration.

34// Accept all three so a correct lint-staged config never draws a false warning.

35const lintStagedFormatterCommands = [

36 "howells-fix",

37 "howells-ox-fix",

Lines 59-99javascript

60// Skip in CI environments — hooks aren't needed there

61if (process.env.CI === "true" || process.env.VERCEL === "1") {

62 process.exit(0);

63}

65// Skip if not in a git repo (e.g. during npm pack)

66if (!existsSync(join(projectRoot,

Source & flagged code

2 flagged · loading source

bin/howells-husky.mjsView file

17L18: import { spawnSync } from "node:child_process"; L19: import {

High

Child Process

Package source references child process execution.

bin/howells-husky.mjsView on unpkg · L17

79// Fallback: try resolving husky from the project's node_modules L80: const fallbackResult = spawnSync("npx", ["husky"], { L81: cwd: projectRoot,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/howells-husky.mjsView on unpkg · L79

Findings

3 High2 Medium3 Low

HighChild Processbin/howells-husky.mjs

HighShell

HighRuntime Package Installbin/howells-husky.mjs

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

Source & flagged code

2 flagged

bin/howells-husky.mjsView file

Lines 1-37javascript

1#!/usr/bin/env node

3/**

4 * @howells/husky — standardised git hooks installer.

5 *

6 * Usage: add `"prepare": "howells-husky"` to package.json.

7 *

8 * On `pnpm install`, this script:

9 * 1. Runs `husky` to initialise the .husky/ directory

10 * 2. Copies the canonical pre-commit and pre-push hooks

11 * 3. Validates that lint-staged config exists in package.json

12 *

13 * The hook scripts are immutable — they come from the package,

14 * not from the project. This prevents agents or developers from

15 * weakening the configuration to get things to pass.

16 */

18import { spawnSync } from "node:child_process";

19import {

High

Child Process

Package source references child process execution.

bin/howells-husky.mjsView on unpkg · L17

20 copyFileSync,

21 existsSync,

22 mkdirSync,

23 readFileSync,

24 chmodSync,

25} from "node:fs";

26import { dirname, join, resolve } from "node:path";

27import { fileURLToPath } from "node:url";

29const __dirname = import.meta.dirname;

30const packageRoot = resolve(__dirname, "..");

31const projectRoot = process.cwd();

32// `howells-fix` is the current canonical @howells/lint fixer; `howells-ox-fix`

33// and `howells-format` are earlier names still in use by repos mid-migration.

34// Accept all three so a correct lint-staged config never draws a false warning.

35const lintStagedFormatterCommands = [

36 "howells-fix",

37 "howells-ox-fix",

Lines 59-99javascript

60// Skip in CI environments — hooks aren't needed there

61if (process.env.CI === "true" || process.env.VERCEL === "1") {

62 process.exit(0);

63}

65// Skip if not in a git repo (e.g. during npm pack)

66if (!existsSync(join(projectRoot,