registry / @html-validate/eslint-config / 9.10.0

@html-validate/eslint-config@9.10.0

Eslint sharable config used by the various HTML-validate packages

Static Scan Results

scanned 12d ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsEvalFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 4 file(s), 338 KB of source, external domains: gitlab.com, mozilla.github.io

Source & flagged code

3 flagged

dist/cli.mjsView file

Lines 8373-8413javascript

8373 frame.topLevel = true;

8374 var context = new Context(ctx || {}, this.blocks, this.env);

8375 this.rootRenderFunc(this.env, context, frame, globalRuntime, function(err) {

8376 if (err) {

8377 cb(err, null);

8378 } else {

8379 cb(null, context.getExported());

8380 }

8381 });

8382 };

8383 _proto3.compile = function compile() {

8384 if (!this.compiled) {

8385 this._compile();

8386 }

8387 };

8388 _proto3._compile = function _compile() {

8389 var props;

8390 if (this.tmplProps) {

8391 props = this.tmplProps;

8392 } else {

8393 var source = compiler.compile(this.tmplStr, this.env.asyncFilters, this.env.extensionsList, this.path, this.env.opts);

8394 var func = new Function(source);

8395 props = func();

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/cli.mjsView on unpkg · L8393

8396 }

8397 this.blocks = this._getBlocks(props);

8398 this.rootRenderFunc = props.root;

8399 this.compiled = true;

8400 };

8401 _proto3._getBlocks = function _getBlocks(props) {

8402 var blocks = {};

8403 lib.keys(props).forEach(function(k) {

8404 if (k.slice(0, 2) === "b_") {

8405 blocks[k.slice(2)] = props[k];

8406 }

8407 });

8408 return blocks;

8409 };

8410 return Template2;

8411 })(Obj);

8412 module.exports = {

8413 Environment,

Lines 8965-9005javascript

8965 "@types/argparse": "2.0.17",

8966 "@types/node": "22.20.0",

8967 "@types/nunjucks": "3.2.6",

8968 esbuild: "0.28.1"

8969 },

8970 peerDependencies: {

8971 prettier: "^3.0.0"

8972 },

Lines 9324-9364javascript

9324 }

9325 }

9326}

9327async function ensureDependencyExists(name, options) {

9328 const dst = path4.join(options.rootDir, PACKAGE_JSON);

9329 const data = fs2.readFileSync(dst, "utf-8");

Source & flagged code

3 flagged · loading source

dist/cli.mjsView file

8985var import_argparse = __toESM(require_argparse(), 1); L8986: import child_process from "node:child_process"; L8987: import fs2 from "node:fs";

High

Child Process

Package source references child process execution.

dist/cli.mjsView on unpkg · L8985

9344try { L9345: await exec(`npm install --save-dev ${name}`); L9346: } catch (err) {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli.mjsView on unpkg · L9344

8393var source = compiler.compile(this.tmplStr, this.env.asyncFilters, this.env.extensionsList, this.path, this.env.opts); L8394: var func = new Function(source); L8395: props = func();

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/cli.mjsView on unpkg · L8393

Findings

3 High2 Medium6 Low

HighChild Processdist/cli.mjs

HighShell

HighRuntime Package Installdist/cli.mjs

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvaldist/cli.mjs

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

dist/cli.mjsView file

Lines 8373-8413javascript

8373 frame.topLevel = true;

8374 var context = new Context(ctx || {}, this.blocks, this.env);

8375 this.rootRenderFunc(this.env, context, frame, globalRuntime, function(err) {

8376 if (err) {

8377 cb(err, null);

8378 } else {

8379 cb(null, context.getExported());

8380 }

8381 });

8382 };

8383 _proto3.compile = function compile() {

8384 if (!this.compiled) {

8385 this._compile();

8386 }

8387 };

8388 _proto3._compile = function _compile() {

8389 var props;

8390 if (this.tmplProps) {

8391 props = this.tmplProps;

8392 } else {

8393 var source = compiler.compile(this.tmplStr, this.env.asyncFilters, this.env.extensionsList, this.path, this.env.opts);

8394 var func = new Function(source);

8395 props = func();

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/cli.mjsView on unpkg · L8393

8396 }

8397 this.blocks = this._getBlocks(props);

8398 this.rootRenderFunc = props.root;

8399 this.compiled = true;

8400 };

8401 _proto3._getBlocks = function _getBlocks(props) {

8402 var blocks = {};

8403 lib.keys(props).forEach(function(k) {

8404 if (k.slice(0, 2) === "b_") {

8405 blocks[k.slice(2)] = props[k];

8406 }

8407 });

8408 return blocks;

8409 };

8410 return Template2;

8411 })(Obj);

8412 module.exports = {

8413 Environment,

Lines 8965-9005javascript

8965 "@types/argparse": "2.0.17",

8966 "@types/node": "22.20.0",

8967 "@types/nunjucks": "3.2.6",

8968 esbuild: "0.28.1"

8969 },

8970 peerDependencies: {

8971 prettier: "^3.0.0"

8972 },

Lines 9324-9364javascript

9324 }

9325 }

9326}

9327async function ensureDependencyExists(name, options) {

9328 const dst = path4.join(options.rootDir, PACKAGE_JSON);

9329 const data = fs2.readFileSync(dst, "utf-8");