registry / @life-and-dev/mdsite / 0.3.0

@life-and-dev/mdsite@0.3.0

Local-first CLI that orchestrates mdsite-nuxt

AI Security Review

scanned 3d ago · by lpm-firewall-ai

No confirmed malicious attack surface was established. Suspicious primitives are tied to a local static-site CLI and renderer workflow.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs mdsite init/start/generate/preview/prepare or generated Nuxt site loads optional Bible tooltip UI.

Impact

Creates mdsite config/runtime files and may install renderer dependencies or fetch public Bible/CDN assets during normal use.

Mechanism

user-invoked CLI orchestration of bundled Nuxt renderer

Rationale

Static source inspection shows a local-first documentation-site CLI with user-invoked process spawning, dependency installation, file generation, and public content/CDN fetches aligned to its stated renderer behavior. I found no install-time execution in the root package, credential collection, exfiltration, persistence, destructive behavior, or hidden payload.

Evidence

package.jsonbin/mdsite.jsdist/index.jsdist/process/child-process.jsdist/renderer/mdsite-nuxt.jsdist/commands/init.jsdist/commands/start.jsdist/commands/generate.jsdist/commands/prepare.jsmdsite-nuxt/scripts/start.tsmdsite-nuxt/nuxt.config.tsmdsite-nuxt/app/plugins/bible-tooltips.client.tsmdsite.yml.nvmrc.gitignore.mdsite/package.json.mdsite/package-lock.json.github/workflows/deploy.ymlmdsite-nuxt/.envmdsite-nuxt/content.config.yml

Network endpoints6

cdn.jsdelivr.net/npm/@mdi/font@7.4.47/css/materialdesignicons.min.cssfonts.googleapis.com/css2?family=Noto+Sans:wght@400;700&display=swapbolls.life/get-text/bolls.life/get-verse/www.biblegateway.com/passage/biblehub.com/interlinear/

Decision evidence

public snapshot

AI called this Clean at 91.0% confidence as Benign with low false-positive risk.

Evidence for block

Evidence against

package.json has only prepublishOnly; no install/postinstall lifecycle in published root package.
bin/mdsite.js only imports dist/index.js; CLI dispatches user-invoked commands.
dist/renderer/mdsite-nuxt.js runs npm ci/install only to install bundled renderer dependencies when user runs start/generate/preview.
dist/process/child-process.js spawn usage is bounded to npm renderer scripts, browser opener, TCP wait, and stop PID handling.
Network URLs are package-aligned docs/CDN/Bible tooltip links, not exfiltration endpoints.
No credential harvesting, persistence, destructive install-time action, or AI-agent control-surface writes found.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 61 file(s), 311 KB of source, external domains: 0.0.0.0, 127.0.0.1, biblehub.com, bolls.life, cdn.jsdelivr.net, example.com, example.test, fonts.googleapis.com, github.com, preview.local, start.local, www.biblegateway.com, www.w3.org

Source & flagged code

3 flagged

dist/process/child-process.jsView file

Lines 1-21javascript

1import { mkdir, open } from 'node:fs/promises';

2import { spawn } from 'node:child_process';

3import net from 'node:net';

High

Child Process

Package source references child process execution.

dist/process/child-process.jsView on unpkg · L1

4import path from 'node:path';

5export async function runForeground(command, args, cwd, env) {

6 const child = spawn(command, args, {

7 cwd,

8 env,

9 stdio: 'inherit'

10 });

11 const exitCode = await new Promise((resolve, reject) => {

12 child.once('error', reject);

13 child.once('close', (code) => resolve(code ?? 0));

14 });

15 if (exitCode !== 0) {

16 throw new Error(`${command} ${args.join(' ')} failed with exit code ${exitCode}.`);

17 }

18}

19export async function runBackground(command, args, cwd, env, logPath) {

20 await mkdir(path.dirname(logPath), { recursive: true });

21 const logFile = await open(logPath, 'a');

mdsite-nuxt/scripts/start.tsView file

Lines 26-56typescript

26if (isCached && !isBuild && !isGenerate) nuxtCommand = 'dev:cached'

28if (isSetup) {

29 await runSetupHooks('setup', rootDir, { configPath: configArg })

30 process.exit(0)

31}

mdsite-nuxt/nuxt.config.tsView file

•matchType = previous_version_dangerous_delta matchedPackage = @life-and-dev/mdsite@0.2.3 matchedIdentity = npm:QGxpZmUtYW5kLWRldi9tZHNpdGU:0.2.3 similarity = 0.803 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

mdsite-nuxt/nuxt.config.tsView on unpkg

Source & flagged code

3 flagged · loading source

dist/process/child-process.jsView file

1import { mkdir, open } from 'node:fs/promises'; L2: import { spawn } from 'node:child_process'; L3: import net from 'node:net';

High

Child Process

Package source references child process execution.

dist/process/child-process.jsView on unpkg · L1

mdsite-nuxt/scripts/start.tsView file

46L47: const nuxtProcess = spawn('npx', ['nuxt', nuxtCommand], { L48: cwd: rootDir,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

mdsite-nuxt/scripts/start.tsView on unpkg · L46

mdsite-nuxt/nuxt.config.tsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

mdsite-nuxt/nuxt.config.tsView on unpkg

Findings

1 Critical3 High3 Medium5 Low

CriticalPrevious Version Dangerous Deltamdsite-nuxt/nuxt.config.ts

HighChild Processdist/process/child-process.js

HighShell

HighRuntime Package Installmdsite-nuxt/scripts/start.ts

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

dist/process/child-process.jsView file

Lines 1-21javascript

1import { mkdir, open } from 'node:fs/promises';

2import { spawn } from 'node:child_process';

3import net from 'node:net';

High

Child Process

Package source references child process execution.

dist/process/child-process.jsView on unpkg · L1

4import path from 'node:path';

5export async function runForeground(command, args, cwd, env) {

6 const child = spawn(command, args, {

7 cwd,

8 env,

9 stdio: 'inherit'

10 });

11 const exitCode = await new Promise((resolve, reject) => {

12 child.once('error', reject);

13 child.once('close', (code) => resolve(code ?? 0));

14 });

15 if (exitCode !== 0) {

16 throw new Error(`${command} ${args.join(' ')} failed with exit code ${exitCode}.`);

17 }

18}

19export async function runBackground(command, args, cwd, env, logPath) {

20 await mkdir(path.dirname(logPath), { recursive: true });

21 const logFile = await open(logPath, 'a');

mdsite-nuxt/scripts/start.tsView file

Lines 26-56typescript

26if (isCached && !isBuild && !isGenerate) nuxtCommand = 'dev:cached'

28if (isSetup) {

29 await runSetupHooks('setup', rootDir, { configPath: configArg })

30 process.exit(0)

31}

mdsite-nuxt/nuxt.config.tsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

mdsite-nuxt/nuxt.config.tsView on unpkg