@lalalic/markcut: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@lalalic/markcut: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

9 flagged · loading source

tests/utils.tsView file

6*/ L7: import { execSync, execFileSync } from "node:child_process"; L8: import { existsSync, mkdirSync, readFileSync, writeFileSync, rmSync, statSync } from "node:fs";

High

Child Process

Package source references child process execution.

tests/utils.tsView on unpkg · L6

81L82: const cmd = `npx remotion render ${composition} "${outPath}" --props="${tmpProps}" --config=remotion.config.ts --log=error`; L83: ... L88: try { L89: execSync(cmd, { L90: cwd: ROOT,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

tests/utils.tsView on unpkg · L81

src/context/EventContext.tsxView file

76try { L77: const fn = new Function(...keys, code); L78: fn(...vals);

Low

Eval

Package source references a known benign dynamic code generation pattern.

src/context/EventContext.tsxView on unpkg · L76

src/types/Include.tsxView file

69L70: import(/* webpackIgnore: true */ importsUrl) L71: .then((mod: any) => {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/types/Include.tsxView on unpkg · L69

src/render/cli.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @lalalic/markcut@2.2.8 matchedIdentity = npm:QGxhbGFsaWMvbWFya2N1dA:2.2.8 similarity = 0.944 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/render/cli.mjsView on unpkg

8Cross-file remote execution chain: src/render/cli.mjs spawns src/player/pipeline.mjs; helper contains network access plus dynamic code execution. L8: */ L9: import { execSync, spawn } from "node:child_process"; L10: import { readFileSync, writeFileSync, mkdirSync, existsSync, copyFileSync } from "node:fs"; ... L20: const __filename = fileURLToPath(import.meta.url); L21: const __dirname = dirname(__filename); L22: const ROOT = resolve(__dirname, "../.."); ... L35: L36: /** Print an error message to stderr. */ L37: function emitError(msg) { console.error(`❌ ${msg}`); } ... L137: L138: const adapted = stageLocalAssets(JSON.parse(JSON.stringify({ ...streamTree, width: dims.width, height: dims.height }))); L139: const tmpProps = join(ROOT, ".tmp", `render-${aspect}.json`);

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

src/render/cli.mjsView on unpkg · L8

8*/ L9: import { execSync, spawn } from "node:child_process"; L10: import { readFileSync, writeFileSync, mkdirSync, existsSync, copyFileSync } from "node:fs"; ... L20: const __filename = fileURLToPath(import.meta.url); L21: const __dirname = dirname(__filename); L22: const ROOT = resolve(__dirname, "../.."); ... L35: L36: /** Print an error message to stderr. */ L37: function emitError(msg) { console.error(`❌ ${msg}`); } ... L137: L138: const adapted = stageLocalAssets(JSON.parse(JSON.stringify({ ...streamTree, width: dims.width, height: dims.height }))); L139: const tmpProps = join(ROOT, ".tmp", `render-${aspect}.json`);

scripts/build-player.shView file

•path = scripts/build-player.sh kind = build_helper sizeBytes = 493 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/build-player.shView on unpkg

src/player/bundle/player.jsView file

•path = src/player/bundle/player.js kind = oversized_source_file sizeBytes = 2327434 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

src/player/bundle/player.jsView on unpkg

Source & flagged code

9 flagged

tests/utils.tsView file

Lines 1-26typescript

1/**

2 * Test utilities for the Remotion Engine integration tests.

3 *

4 * Provides helper functions for rendering stream trees, extracting frames,

5 * and running STT (speech-to-text) on rendered video output.

6 */

7import { execSync, execFileSync } from "node:child_process";

8import { existsSync, mkdirSync, readFileSync, writeFileSync, rmSync, statSync } from "node:fs";

High

Child Process

Package source references child process execution.

tests/utils.tsView on unpkg · L6

9import { resolve, dirname, join } from "node:path";

10import { fileURLToPath } from "node:url";

11import { config } from "dotenv";

12import { DEFAULT_STT_CLI } from "../src/config.mjs";

13

14// Load .env from project root so env vars (GOOGLE_MAPS_API_KEY, etc.) are available

15config({ path: resolve(fileURLToPath(import.meta.url), "../../.env") });

16

17const __filename = fileURLToPath(import.meta.url);

18const __dirname = dirname(__filename);

19export const ROOT = resolve(__dirname, "..");

20export const OUT_DIR = resolve(__dirname, "out");

21export const FIXTURES_DIR = resolve(__dirname, "fixtures");

22

23// Ensure output directory exists

24mkdirSync(OUT_DIR, { recursive: true });

25

26// ── Configuration ──────────────────────────────────────────────────────────

Lines 61-101typescript

61 timeout = RENDER_TIMEOUT,

62 verbose = false,

63 } = options;

64

65 const absFixturePath = fixturePath.startsWith("/")

66 ?

src/context/EventContext.tsxView file

Lines 56-96tsx

56 const register = React.useCallback(

57 (id: string, setState: (partial: Record<string, any>)

src/types/Include.tsxView file

Lines 49-89tsx

49/**

50 * Dynamic import of a component bundle, returning the registry map.

51 * Returns null if the URL is falsy or import fails.

52 */

53function useSubVideoRegistry(importsUrl: string | undefined):

54 { registry

src/render/cli.mjsView file

Lines 1-28javascript

1#!/usr/bin/env node

2/**

3 * CLI entry point for the Remotion engine.

4 *

5 * Pipeline:

6 * .md ──[parse]──▶ descriptive ──[resolve]──▶ resolved ──[compile]──▶ stream tree ──[render]──▶ MP4

7 * (TTS/STT/durations)

8 */

9import { execSync, spawn } from "node:child_process";

scripts/build-player.shView file

•path = scripts/build-player.sh kind = build_helper sizeBytes = 493 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/build-player.shView on unpkg

src/player/bundle/player.jsView file

•path = src/player/bundle/player.js kind = oversized_source_file sizeBytes = 2327434 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

src/player/bundle/player.jsView on unpkg