registry / @lukoweb/apitogo / 0.1.44

@lukoweb/apitogo@0.1.44

Framework for building high quality, interactive API documentation.

Static Scan Results

scanned 6d ago · by rust-scanner

Static analysis flagged 17 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsTelemetryUrlStrings

Manifest

NoLicense

scanned 445 file(s), 1.54 MB of source, external domains: api.github.com, api.zuploedge.com, apitogo.com, app.posthog.com, cdn.jsdelivr.net, cdn.simpleicons.org, cdn.zudoku.dev, chatgpt.com, claude.ai, code.visualstudio.com, deploy-server-dotnet2-b3fkcaaraydbckfe.canadacentral-01.azurewebsites.net, docs.apitogo.com, docs.cursor.com, docs.mcp.run, dp-example.azurecontainerapps.io, example.com, fonts.googleapis.com, github.com, help.openai.com, httpproblems.com, llmstxt.org, lucide.dev, modelcontextprotocol.io, securetoken.google.com, swagger.io, test.local, ui.shadcn.com, www.example.com, www.w3.org, zudoku.dev, zuplo.com

Source & flagged code

8 flagged

dist/cli/cli.jsView file

Lines 1-37javascript

1var __defProp = Object.defineProperty;

2var __getOwnPropNames = Object.getOwnPropertyNames;

3var __esm = (fn, res) => function __init() {

4 return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;

5};

6var __export = (target, all) => {

7 for (var name in all)

8 __defProp(target, name, { get: all[name], enumerable: true });

9};

11// src/cli/common/package-json.ts

12import { readFileSync } from "node:fs";

13import path from "node:path";

14import { fileURLToPath } from "node:url";

15var getPackageJsonPath, getPackageJson, getZudokuPackageJson, getZudokuRootDir;

16var init_package_json = __esm({

17 "src/cli/common/package-json.ts"() {

18 getPackageJsonPath = (pkg) => fileURLToPath(import.meta.resolve(`${pkg}/package.json`)).replaceAll(

19 path.sep,

20 path.posix.sep

21 );

22 getPackageJson = (pkgPath) => JSON.parse(readFileSync(pkgPath, "utf-8"));

23 getZudokuPackageJson = () => getPackageJson(getPackageJsonPath("@lukoweb/apitogo"));

24 getZudokuRootDir = () => path.dirname(getPackageJsonPath("@lukoweb/apitogo"));

25 }

26});

28// src/cli/common/logger.ts

29import { createLogger } from "vite";

30var logger, loggerError, isExpectedWarning, wrapWarnFilter;

31var init_logger = __esm({

32 "src/cli/common/logger.ts"() {

33 logger = createLogger(

34 process.env.LOG_LEVEL ?? "info",

35 {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli/cli.jsView on unpkg · L17

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

dist/cli/cli.jsView on unpkg · L17

36 prefix: "apitogo"

37 }

Lines 7339-7393javascript

7339 data: { _mdxExplicitJsx: true }

7340 });

7341 continue;

7342 }

7343 if (child.type === "paragraph" && child.children.every((c) => c.type === "text" && !c.value.trim

Lines 8960-9000javascript

8960 logger.error("\u274C Build failed");

8961 logger.error(message);

8962 process.exit(1);

8963 }

8964 if (argv.preview) {

8965 await preview({

8966 dir: argv.dir,

8967 port: typeof argv.preview ===

dist/cli/worker.jsView file

Lines 97-137javascript

97 }

98 return val;

99};

100

101// src/config/validators/ProtectedRoutesSchema.ts

102var ProtectedRoutesInputSchema = z.optional(

103 z.union([

104 z.array(z.string()),

105 z.record(

dist/declarations/config/validators/ZudokuConfig.d.tsView file

Lines 295-335typescript

295 clerkPubKey: z.ZodCustom<`pk_test_${string}` | `pk_live_${string}`, `pk_test_${string}` | `pk_live_${string}`>;

296 jwtTemplateName: z.ZodDefault<z.ZodOptional<z.ZodString>>;

Source & flagged code

8 flagged · loading source

dist/cli/cli.jsView file

7359// src/vite/mdx/remark-last-modified.ts L7360: import { spawnSync } from "node:child_process"; L7361: import { stat as stat3 } from "node:fs/promises";

High

Child Process

Package source references child process execution.

dist/cli/cli.jsView on unpkg · L7359

8980native: "%windir%\\System32", L8981: mixed: "%windir%\\sysnative\\cmd.exe /c %windir%\\System32" L8982: };

High

Shell

Package source references shell execution.

dist/cli/cli.jsView on unpkg · L8980

7373if (!checkGitAvailable()) return false; L7374: const result = spawnSync("git", ["rev-parse", "--is-shallow-repository"], { L7375: encoding: "utf-8", ... L7382: hasWarnedShallowClone = true; L7383: if (process.env.VERCEL) { L7384: console.warn( ... L7388: console.warn( L7389: "The repository is shallow cloned, so the latest modified time may not be accurate. See https://github.com/actions/checkout#fetch-all-history-for-all-tags-and-branches to fetch all... L7390: );

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli/cli.jsView on unpkg · L7373

17"src/cli/common/package-json.ts"() { L18: getPackageJsonPath = (pkg) => fileURLToPath(import.meta.resolve(`${pkg}/package.json`)).replaceAll( L19: path.sep, ... L21: ); L22: getPackageJson = (pkgPath) => JSON.parse(readFileSync(pkgPath, "utf-8")); L23: getZudokuPackageJson = () => getPackageJson(getPackageJsonPath("@lukoweb/apitogo")); ... L33: logger = createLogger( L34: process.env.LOG_LEVEL ?? "info", L35: { ... L492: `Language "${lang}" is not loaded for syntax highlighting. Add it to \`syntaxHighlighting.languages\` in your config. Falling back to plain text. L493: See https://docs.apitogo.com/docs/markdown/code-blocks#configuration` L494: );

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli/cli.jsView on unpkg · L17

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

dist/cli/cli.jsView on unpkg · L17

dist/cli/worker.jsView file

117var { template, distDir, serverConfigPath, entryServerPath, writeRedirects } = Piscina.workerData; L118: var server = await import(entryServerPath); L119: var rawConfig = await import(serverConfigPath).then(

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/cli/worker.jsView on unpkg · L117

dist/declarations/config/validators/ZudokuConfig.d.tsView file

315patternName = generic_password severity = medium line = 315 matchedText = password...rd";

Medium

Secret Pattern

Hardcoded password in dist/declarations/config/validators/ZudokuConfig.d.ts

dist/declarations/config/validators/ZudokuConfig.d.tsView on unpkg · L315

6719patternName = generic_password severity = medium line = 6719 matchedText = password...rd";

Medium

Secret Pattern

Hardcoded password in dist/declarations/config/validators/ZudokuConfig.d.ts

dist/declarations/config/validators/ZudokuConfig.d.tsView on unpkg · L6719

Findings

4 High7 Medium6 Low

HighChild Processdist/cli/cli.js

HighShelldist/cli/cli.js

HighSame File Env Network Executiondist/cli/cli.js

HighSandbox Evasion Gated Capabilitydist/cli/cli.js

MediumDynamic Requiredist/cli/worker.js

MediumUnsafe Vm Contextdist/cli/cli.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumSecret Patterndist/declarations/config/validators/ZudokuConfig.d.ts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

LowNo License

Source & flagged code

8 flagged

dist/cli/cli.jsView file

Lines 1-37javascript

1var __defProp = Object.defineProperty;

2var __getOwnPropNames = Object.getOwnPropertyNames;

3var __esm = (fn, res) => function __init() {

4 return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;

5};

6var __export = (target, all) => {

7 for (var name in all)

8 __defProp(target, name, { get: all[name], enumerable: true });

9};

11// src/cli/common/package-json.ts

12import { readFileSync } from "node:fs";

13import path from "node:path";

14import { fileURLToPath } from "node:url";

15var getPackageJsonPath, getPackageJson, getZudokuPackageJson, getZudokuRootDir;

16var init_package_json = __esm({

17 "src/cli/common/package-json.ts"() {

18 getPackageJsonPath = (pkg) => fileURLToPath(import.meta.resolve(`${pkg}/package.json`)).replaceAll(

19 path.sep,

20 path.posix.sep

21 );

22 getPackageJson = (pkgPath) => JSON.parse(readFileSync(pkgPath, "utf-8"));

23 getZudokuPackageJson = () => getPackageJson(getPackageJsonPath("@lukoweb/apitogo"));

24 getZudokuRootDir = () => path.dirname(getPackageJsonPath("@lukoweb/apitogo"));

25 }

26});

28// src/cli/common/logger.ts

29import { createLogger } from "vite";

30var logger, loggerError, isExpectedWarning, wrapWarnFilter;

31var init_logger = __esm({

32 "src/cli/common/logger.ts"() {

33 logger = createLogger(

34 process.env.LOG_LEVEL ?? "info",

35 {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli/cli.jsView on unpkg · L17

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

dist/cli/cli.jsView on unpkg · L17

36 prefix: "apitogo"

37 }

Lines 7339-7393javascript

7339 data: { _mdxExplicitJsx: true }

7340 });

7341 continue;

7342 }

7343 if (child.type === "paragraph" && child.children.every((c) => c.type === "text" && !c.value.trim

Lines 8960-9000javascript

8960 logger.error("\u274C Build failed");

8961 logger.error(message);

8962 process.exit(1);

8963 }

8964 if (argv.preview) {

8965 await preview({

8966 dir: argv.dir,

8967 port: typeof argv.preview ===

dist/cli/worker.jsView file

Lines 97-137javascript

97 }

98 return val;

99};

100

101// src/config/validators/ProtectedRoutesSchema.ts

102var ProtectedRoutesInputSchema = z.optional(

103 z.union([

104 z.array(z.string()),

105 z.record(

dist/declarations/config/validators/ZudokuConfig.d.tsView file

Lines 295-335typescript

295 clerkPubKey: z.ZodCustom<`pk_test_${string}` | `pk_live_${string}`, `pk_test_${string}` | `pk_live_${string}`>;

296 jwtTemplateName: z.ZodDefault<z.ZodOptional<z.ZodString>>;