registry / @life-and-dev/mdsite / 0.5.1

@life-and-dev/mdsite@0.5.1

Local-first CLI that orchestrates mdsite-nuxt

AI Security Review

scanned 2d ago · by lpm-firewall-ai

No confirmed malicious attack surface. The package is a local-first CLI that initializes and runs a bundled Nuxt markdown site renderer when the user invokes mdsite commands.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs mdsite CLI commands such as init, start/live, generate, preview/static, stop, or prepare github.

Impact

Creates project mdsite files, installs renderer dependencies, starts/stops local Nuxt processes, and generates static site output.

Mechanism

User-invoked local renderer orchestration and project scaffolding

Rationale

The suspicious primitives are aligned with an explicit CLI for running a local Nuxt renderer: child_process, detached processes, npm install/ci, and project writes occur only through user-invoked commands, not install/import-time execution. No credential harvesting, exfiltration, destructive persistence, or foreign AI-agent control-surface mutation was found.

Evidence

package.jsonbin/mdsite.jsdist/index.jsdist/commands/init.jsdist/commands/start.jsdist/commands/preview.jsdist/commands/generate.jsdist/commands/prepare.jsdist/renderer/mdsite-nuxt.jsdist/process/child-process.jsmdsite-nuxt/package.jsonmdsite-nuxt/scripts/start.tsmdsite.yml.nvmrc.gitignore.renderer/package.json.renderer/package-lock.json.renderer/start.json.renderer/preview.json.renderer/start.log.renderer/preview.log.github/workflows/deploy.ymlmdsite-nuxt/.envmdsite-nuxt/content.config.ymlmdsite-nuxt/.output/public

Network endpoints3

cdn.jsdelivr.net/npm/@mdi/font@7.4.47/css/materialdesignicons.min.cssfonts.googleapis.com/css2?family=Noto+Sans:wght@400;700&display=swapgithub.com/life-and-dev/mdsite

Decision evidence

public snapshot

AI called this Clean at 94.0% confidence as Benign with low false-positive risk.

Evidence for block

Evidence against

package.json has no install/postinstall hook; only prepublishOnly for publisher-side tests/build.
bin/mdsite.js only imports dist/index.js, which dispatches explicit CLI commands.
dist/renderer/mdsite-nuxt.js runs npm install/ci only when user-invoked renderer commands need dependencies.
dist/process/child-process.js spawn/background/open-browser helpers are used for local Nuxt renderer workflows.
dist/commands/init.js writes mdsite.yml, .nvmrc, .gitignore, and renderer package files in the current content project only.
No Claude/Codex/Cursor/.mcp control-surface files found.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 64 file(s), 345 KB of source, external domains: 0.0.0.0, 127.0.0.1, biblehub.com, bolls.life, cdn.jsdelivr.net, example.com, example.test, fonts.googleapis.com, github.com, preview.local, start.local, www.biblegateway.com, www.w3.org

Source & flagged code

3 flagged

dist/process/child-process.jsView file

Lines 1-21javascript

1import { mkdir, open } from 'node:fs/promises';

2import { spawn } from 'node:child_process';

3import net from 'node:net';

High

Child Process

Package source references child process execution.

dist/process/child-process.jsView on unpkg · L1

4import path from 'node:path';

5export async function runForeground(command, args, cwd, env) {

6 const child = spawn(command, args, {

7 cwd,

8 env,

9 stdio: 'inherit'

10 });

11 const exitCode = await new Promise((resolve, reject) => {

12 child.once('error', reject);

13 child.once('close', (code) => resolve(code ?? 0));

14 });

15 if (exitCode !== 0) {

16 throw new Error(`${command} ${args.join(' ')} failed with exit code ${exitCode}.`);

17 }

18}

19export async function runBackground(command, args, cwd, env, logPath) {

20 await mkdir(path.dirname(logPath), { recursive: true });

21 const logFile = await open(logPath, 'a');

mdsite-nuxt/scripts/start.tsView file

Lines 26-56typescript

26if (isCached && !isBuild && !isGenerate) nuxtCommand = 'dev:cached'

28if (isSetup) {

29 await runSetupHooks('setup', rootDir, { configPath: configArg })

30 process.exit(0)

31}

mdsite-nuxt/nuxt.config.tsView file

•matchType = previous_version_dangerous_delta matchedPackage = @life-and-dev/mdsite@0.5.0 matchedIdentity = npm:QGxpZmUtYW5kLWRldi9tZHNpdGU:0.5.0 similarity = 0.953 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

mdsite-nuxt/nuxt.config.tsView on unpkg

Source & flagged code

3 flagged · loading source

dist/process/child-process.jsView file

1import { mkdir, open } from 'node:fs/promises'; L2: import { spawn } from 'node:child_process'; L3: import net from 'node:net';

High

Child Process

Package source references child process execution.

dist/process/child-process.jsView on unpkg · L1

mdsite-nuxt/scripts/start.tsView file

46L47: const nuxtProcess = spawn('npx', ['nuxt', nuxtCommand], { L48: cwd: rootDir,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

mdsite-nuxt/scripts/start.tsView on unpkg · L46

mdsite-nuxt/nuxt.config.tsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

mdsite-nuxt/nuxt.config.tsView on unpkg

Findings

1 Critical3 High3 Medium5 Low

CriticalPrevious Version Dangerous Deltamdsite-nuxt/nuxt.config.ts

HighChild Processdist/process/child-process.js

HighShell

HighRuntime Package Installmdsite-nuxt/scripts/start.ts

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

dist/process/child-process.jsView file

Lines 1-21javascript

1import { mkdir, open } from 'node:fs/promises';

2import { spawn } from 'node:child_process';

3import net from 'node:net';

High

Child Process

Package source references child process execution.

dist/process/child-process.jsView on unpkg · L1

4import path from 'node:path';

5export async function runForeground(command, args, cwd, env) {

6 const child = spawn(command, args, {

7 cwd,

8 env,

9 stdio: 'inherit'

10 });

11 const exitCode = await new Promise((resolve, reject) => {

12 child.once('error', reject);

13 child.once('close', (code) => resolve(code ?? 0));

14 });

15 if (exitCode !== 0) {

16 throw new Error(`${command} ${args.join(' ')} failed with exit code ${exitCode}.`);

17 }

18}

19export async function runBackground(command, args, cwd, env, logPath) {

20 await mkdir(path.dirname(logPath), { recursive: true });

21 const logFile = await open(logPath, 'a');

mdsite-nuxt/scripts/start.tsView file

Lines 26-56typescript

26if (isCached && !isBuild && !isGenerate) nuxtCommand = 'dev:cached'

28if (isSetup) {

29 await runSetupHooks('setup', rootDir, { configPath: configArg })

30 process.exit(0)

31}

mdsite-nuxt/nuxt.config.tsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

mdsite-nuxt/nuxt.config.tsView on unpkg