registry / @life-and-dev/mdsite / 0.7.0

@life-and-dev/mdsite@0.7.0

Local-first CLI that orchestrates mdsite-nuxt

AI Security Review

scanned 8h ago · by lpm-firewall-ai

No confirmed malicious attack surface. The package is a local static-site CLI that installs/starts its bundled Nuxt renderer only during explicit mdsite commands and may fetch Bible tooltip data in the generated browser app.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

explicit mdsite CLI commands or browser use of generated site tooltips

Impact

local project files/state are created or cleaned as documented; no malicious persistence or exfiltration identified

Mechanism

local renderer orchestration and optional browser API fetches

Rationale

Static inspection shows suspicious primitives are aligned with a CLI that initializes, builds, previews, and cleans a local Nuxt documentation site. There is no install-time execution by the npm package and no concrete malicious chain.

Evidence

package.jsonbin/mdsite.jsdist/index.jsdist/process/child-process.jsdist/renderer/mdsite-nuxt.jsdist/commands/init.jsdist/commands/start.jsdist/commands/preview.jsdist/commands/generate.jsdist/commands/clean.jsdist/commands/stop.jsdist/commands/prepare.jsmdsite.yml.nvmrc.gitignore.github/workflows/deploy.ymlmdsite-nuxt/.envmdsite-nuxt/content.config.yml<paths.build>/live.json<paths.build>/static.json<paths.build>/live.log<paths.build>/static.log<paths.output>/public

Network endpoints6

bolls.life/get-text/bolls.life/get-verse/www.biblegateway.com/passage/biblehub.com/interlinear/cdn.jsdelivr.net/npm/@mdi/font@7.4.47/css/materialdesignicons.min.cssfonts.googleapis.com/css2?family=Noto+Sans:wght@400;700&display=swap

Decision evidence

public snapshot

AI called this Clean at 93.0% confidence as Benign with low false-positive risk.

Evidence for block

dist/renderer/mdsite-nuxt.js runs npm ci/install for bundled renderer dependencies when explicit CLI commands prepare the renderer.
dist/process/child-process.js spawns npm/open/xdg-open/cmd and manages detached local renderer processes.
mdsite-nuxt/app/plugins/bible-tooltips.client.ts fetches Bible verse data from bolls.life in browser when tooltip feature is used.

Evidence against

package.json has no preinstall/install/postinstall; only prepublishOnly and a bin entry.
bin/mdsite.js only imports dist/index.js; commands are user-invoked CLI actions.
Project writes are package-aligned: mdsite.yml, .nvmrc, .gitignore, renderer .env/content.config.yml, runtime state/logs, output dirs, GitHub workflow on prepare github.
No credential harvesting, broad filesystem scanning, remote payload loading, AI-agent config mutation, or exfiltration found in inspected source.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 68 file(s), 372 KB of source, external domains: 0.0.0.0, 10.0.0.5, 127.0.0.1, biblehub.com, bolls.life, cdn.jsdelivr.net, example.com, example.test, fonts.googleapis.com, github.com, preview.local, start.local, www.biblegateway.com, www.w3.org

Source & flagged code

3 flagged

dist/process/child-process.jsView file

Lines 1-21javascript

1import { mkdir, open, readFile } from 'node:fs/promises';

2import { spawn } from 'node:child_process';

3import net from 'node:net';

High

Child Process

Package source references child process execution.

dist/process/child-process.jsView on unpkg · L1

4import path from 'node:path';

5export async function runForeground(command, args, cwd, env) {

6 const child = spawn(command, args, {

7 cwd,

8 env,

9 stdio: 'inherit'

10 });

11 const exitCode = await new Promise((resolve, reject) => {

12 child.once('error', reject);

13 child.once('close', (code) => resolve(code ?? 0));

14 });

15 if (exitCode !== 0) {

16 throw new Error(`${command} ${args.join(' ')} failed with exit code ${exitCode}.`);

17 }

18}

19export async function runBackground(command, args, cwd, env, logPath) {

20 await mkdir(path.dirname(logPath), { recursive: true });

21 const logFile = await open(logPath, 'a');

•matchType = previous_version_dangerous_delta matchedPackage = @life-and-dev/mdsite@0.6.0 matchedIdentity = npm:QGxpZmUtYW5kLWRldi9tZHNpdGU:0.6.0 similarity = 0.545 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/process/child-process.jsView on unpkg

mdsite-nuxt/scripts/start.tsView file

Lines 25-55typescript

25if (isPreview) nuxtCommand = 'preview'

26if (isCached && !isBuild && !isGenerate) nuxtCommand = 'dev:cached'

28if (isSetup) {

29 await runSetupHooks('setup', rootDir, { configPath: configArg })

30 process.exit

Source & flagged code

3 flagged · loading source

dist/process/child-process.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/process/child-process.jsView on unpkg

1import { mkdir, open, readFile } from 'node:fs/promises'; L2: import { spawn } from 'node:child_process'; L3: import net from 'node:net';

High

Child Process

Package source references child process execution.

dist/process/child-process.jsView on unpkg · L1

mdsite-nuxt/scripts/start.tsView file

45L46: const nuxtProcess = spawn('npx', ['nuxt', nuxtCommand], { L47: cwd: rootDir,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

mdsite-nuxt/scripts/start.tsView on unpkg · L45

Findings

1 Critical3 High3 Medium5 Low

CriticalPrevious Version Dangerous Deltadist/process/child-process.js

HighChild Processdist/process/child-process.js

HighShell

HighRuntime Package Installmdsite-nuxt/scripts/start.ts

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

dist/process/child-process.jsView file

Lines 1-21javascript

1import { mkdir, open, readFile } from 'node:fs/promises';

2import { spawn } from 'node:child_process';

3import net from 'node:net';

High

Child Process

Package source references child process execution.

dist/process/child-process.jsView on unpkg · L1

4import path from 'node:path';

5export async function runForeground(command, args, cwd, env) {

6 const child = spawn(command, args, {

7 cwd,

8 env,

9 stdio: 'inherit'

10 });

11 const exitCode = await new Promise((resolve, reject) => {

12 child.once('error', reject);

13 child.once('close', (code) => resolve(code ?? 0));

14 });

15 if (exitCode !== 0) {

16 throw new Error(`${command} ${args.join(' ')} failed with exit code ${exitCode}.`);

17 }

18}

19export async function runBackground(command, args, cwd, env, logPath) {

20 await mkdir(path.dirname(logPath), { recursive: true });

21 const logFile = await open(logPath, 'a');

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/process/child-process.jsView on unpkg

mdsite-nuxt/scripts/start.tsView file

Lines 25-55typescript

25if (isPreview) nuxtCommand = 'preview'

26if (isCached && !isBuild && !isGenerate) nuxtCommand = 'dev:cached'

28if (isSetup) {

29 await runSetupHooks('setup', rootDir, { configPath: configArg })

30 process.exit