registry / @niyase/plugin-sdk / 0.2.0

@niyase/plugin-sdk@0.2.0

SDK for building niyase certified plugins

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

WildcardDependency

scanned 24 file(s), 1.04 MB of source, external domains: api.niyase.com, json-schema.org, react.dev, www.npmjs.com, www.w3.org

Source & flagged code

4 flagged

bin/commands/test.mjsView file

Lines 1-18javascript

1import { spawnSync } from "node:child_process";

High

Child Process

Package source references child process execution.

bin/commands/test.mjsView on unpkg · L1

3export async function runTest(extraArgs = []) {

4 // `niyase-plugin new` で scaffold した直後はテスト未記述なので、テストファイルが

Source & flagged code

4 flagged · loading source

bin/commands/test.mjsView file

1import { spawnSync } from "node:child_process"; L2:

High

Child Process

Package source references child process execution.

bin/commands/test.mjsView on unpkg · L1

bin/commands/lint.mjsView file

44if (existsSync(join(cwd, "tsconfig.json"))) { L45: const r = spawnSync("npx", ["tsc", "--noEmit"], { L46: cwd,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/commands/lint.mjsView on unpkg · L44

15{ re: /\bfetch\s*\(/, msg: "fetch() は不可。niyase.data / niyase.core を使う" }, L16: { re: /\beval\s*\(/, msg: "eval() は不可" }, L17: { re: /new\s+Function\s*\(/, msg: "new Function() は不可" },

Low

Eval

Package source references a known benign dynamic code generation pattern.

bin/commands/lint.mjsView on unpkg · L15

bin/lib/load-manifest.mjsView file

38}); L39: const mod = await import(pathToFileURL(outfile).href); L40: return mod.manifest ?? mod.default;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/lib/load-manifest.mjsView on unpkg · L38

Findings

3 High5 Medium6 Low

HighChild Processbin/commands/test.mjs

HighShell

HighRuntime Package Installbin/commands/lint.mjs

MediumDynamic Requirebin/lib/load-manifest.mjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumWildcard Dependency

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvalbin/commands/lint.mjs

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

bin/commands/lint.mjsView file

Lines 1-64javascript

1import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";

2import { join, resolve } from "node:path";

3import { spawnSync } from "node:child_process";

4import { fileURLToPath } from "node:url";

5import { loadManifest } from "../lib/load-manifest.mjs";

7const here = fileURLToPath(new URL(".", import.meta.url));

8// dist/manifest.js（projection）から実バリデータを使う（api 側と同一）

9const { validateManifest } = await import(

10 join(here, "..", "..", "dist", "manifest.js")

11);

13// §10.4 L0: bridge を迂回する危険パターン

14const BANNED = [

15 { re: /\bfetch\s*\(/, msg: "fetch() は不可。niyase.data / niyase.core を使う" },

16 { re: /\beval\s*\(/, msg: "eval() は不可" },

17 { re: /new\s+Function\s*\(/, msg: "new Function() は不可" },

Low

Eval

Package source references a known benign dynamic code generation pattern.

bin/commands/lint.mjsView on unpkg · L15

18 { re: /document\.cookie/, msg: "document.cookie へのアクセスは不可" },

19 { re: /\blocalStorage\b/, msg: "localStorage は不可（隔離フレームでは無効）" },

20 { re: /\bXMLHttpRequest\b/, msg: "XMLHttpRequest は不可" },

21 {

22 re: /window\.__niyase(Externals|Plugins)\b/,

23 msg: "window.__niyase* の直叩きは不可（useNiyase() を使う）",

24 },

25];

27function walk(dir, acc = []) {

28 for (const name of readdirSync(dir)) {

29 if (name === "node_modules" || name === "dist") continue;

30 const p = join(dir, name);

31 const st = statSync(p);

32 if (st.isDirectory()) walk(p, acc);

33 else if (/\.(ts|tsx|js|jsx)$/.test(name)) acc.push(p);

34 }

35 return acc;

36}

38export async function runLint() {

39 const cwd = process.cwd();

40 let errors = 0;

41 let warnings = 0;

43 // 1. tsc --noEmit（tsconfig があれば）

44 if (existsSync(join(cwd, "tsconfig.json"))) {

45 const r = spawnSync("npx", ["tsc", "--noEmit"], {

46 cwd,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/commands/lint.mjsView on unpkg · L44

47 stdio: "inherit",

48 shell: process.platform === "win32",

49 });

50 if (r.status !== 0) {

51 console.error("✗ tsc --noEmit に失敗");

52 errors++;

53 } else {

54 console.log("✓ tsc --noEmit");

55 }

56 }

58 // 2. manifest 検証（@repo/plugins と同一バリデータ）

59 const manifestPath = ["src/manifest.ts", "src/manifest.tsx", "manifest.ts"]

60 .map((p) => join(cwd, p))

61 .find(existsSync);

62 if (!manifestPath) {

63 console.error("✗ src/manifest.ts が見つかりません");

64 errors++;

bin/lib/load-manifest.mjsView file

Lines 18-45javascript

18 bundle: true,

19 format: "esm",

20 platform: "node",

21 target: "es2022",

22 outfile,

23 plugins: [

24 {

25 name: "sdk-stub",

26 setup(b) {

27 b.onResolve({ filter: /^@niyase\/plugin-sdk/ }, () => ({

28 path: "sdk",

29 namespace: "sdk-stub",

30 }));

31 b.onLoad({ filter: /.*/, namespace: "sdk-stub" }, () => ({

32 contents: `export function defineManifest(m){return m;}`,

33 loader: "js",

34 }));

35 },

36 },

37 ],

38 });

39 const mod = await import(pathToFileURL(outfile).href);

40 return mod.manifest ?? mod.default;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/lib/load-manifest.mjsView on unpkg · L38

41 } finally {

42 rmSync(dir, { recursive: true, force: true });

43 }

44}