registry / @html-validate/eslint-config / 9.12.1

@html-validate/eslint-config@9.12.1

⚠ Under review

Eslint sharable config used by the various HTML-validate packages

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsEvalFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 4 file(s), 226 KB of source, external domains: gitlab.com, mozilla.github.io

Source & flagged code

4 flagged

dist/cli.mjsView file

Lines 5207-5247javascript

5207 frame.topLevel = true;

5208 var context = new Context(ctx || {}, this.blocks, this.env);

5209 this.rootRenderFunc(this.env, context, frame, globalRuntime, function(

Source & flagged code

4 flagged · loading source

dist/cli.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @html-validate/eslint-config@9.11.6 matchedIdentity = npm:[redacted]:9.11.6 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.mjsView on unpkg

5816// src/cli.ts L5817: import child_process from "node:child_process"; L5818: import fs2 from "node:fs";

High

Child Process

Package source references child process execution.

dist/cli.mjsView on unpkg · L5816

6175try { L6176: await exec(`npm install --save-dev ${name}`); L6177: } catch (err) {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli.mjsView on unpkg · L6175

5227var source = compiler.compile(this.tmplStr, this.env.asyncFilters, this.env.extensionsList, this.path, this.env.opts); L5228: var func = new Function(source); L5229: props = func();

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/cli.mjsView on unpkg · L5227

Findings

1 Critical3 High2 Medium6 Low

CriticalPrevious Version Dangerous Deltadist/cli.mjs

HighChild Processdist/cli.mjs

HighShell

HighRuntime Package Installdist/cli.mjs

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvaldist/cli.mjs

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Lines 5796-5836javascript

5796 },

5797 devDependencies: {

5798 "@types/node": "22.20.1",

5799 "@types/nunjucks": "3.2.6",

5800 esbuild: "0.28.1"

5801 },

5802 peerDependencies: {

5803 prettier: "^3.0.0"

5804 },

5805 engines: {

5806 node: "^22.16.0 || >= 24.0.0",

5807 npm: ">= 7"

5808 },

5809 publishConfig: {

5810 access: "public"

5811 }

5812 };

5813 }

5814});

5815

5816// src/cli.ts

5817import child_process from "node:child_process";

5818import fs2 from "node:fs";

High

Child Process

Package source references child process execution.

dist/cli.mjsView on unpkg · L5816

5819import path4 from "node:path";

5820import { parseArgs, promisify as promisify2 } from "node:util";

5821

5822// node_modules/find-up/index.js

5823import path2 from "node:path";

5824

5825// node_modules/locate-path/index.js

5826import process2 from "node:process";

5827import path from "node:path";

5828import fs, { promises as fsPromises } from "node:fs";

5829import { fileURLToPath } from "node:url";

5830

5831// node_modules/yocto-queue/index.js

5832var Node = class {

5833 value;

5834 next;

5835 constructor(value) {

5836 this.value = value;

Lines 6155-6195javascript

6155 }

6156 }

6157}

6158async function ensureDependencyExists(name, options) {

6159 const dst = path4.join(options.rootDir, PACKAGE_JSON);

6160 const data = fs2.readFileSync(dst, "utf-8");

6161 const pkg2 = JSON.parse(data);

6162 const dependencies = /* @__PURE__ */ new Set([

6163 ...Object.keys(pkg2.dependencies || {}),

6164 ...Object.keys(pkg2.devDependencies || {}),

6165 ...Object.keys(pkg2.peerDependencies || {})

6166 ]);

6167 if (dependencies.has(name)) {

6168 return;

6169 }

6170 options.changes++;

6171 if (options.dryRun) {

6172 console.log(`package.json - ${name} dependency is missing`);

6173 } else {

6174 console.log(`package.json - installing dependency "${name}"`);

6175 try {

6176 await exec(`npm install --save-dev ${name}`);

6177 } catch (err) {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli.mjsView on unpkg · L6175

6178 console.error(err.stdout);

6179 console.error(err.stderr);

6180 }

6181 }

6182}

6183async function ensurePkgScript(script, command, options) {

6184 const dst = path4.join(options.rootDir, PACKAGE_JSON);

6185 const data = fs2.readFileSync(dst, "utf-8");

6186 const pkg2 = JSON.parse(data);

6187 if (pkg2.scripts && Object.hasOwn(pkg2.scripts, script) && pkg2.scripts[script] === command) {

6188 return;

6189 }

6190 options.changes++;

6191 if (options.dryRun) {

6192 console.log(`package.json - ${script} script needs update`);

6193 } else {

6194 if (!pkg2.scripts) {

6195 pkg2.scripts = {};