registry / @oclif/plugin-test-esbuild / 0.5.161

@oclif/plugin-test-esbuild@0.5.161

Bundled plugin for testing

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 15 file(s), 470 KB of source, external domains: codeload.github.com, developer.mozilla.org, gist.githubusercontent.com, github.com, jsperf.com, registry.npmjs.org, stackoverflow.com

Oversized source lightweight scan

dist/chunk-T2I5QBUT.js10.0 MB file, sampled 256 KB

ChildProcessEnvironmentVarsEvalHighEntropyStringsUrlStringsdeveloper.mozilla.orggithub.comjsperf.comstackoverflow.com

Source & flagged code

4 flagged

dist/index.jsView file

Lines 101-141javascript

101 const nodeRendered = ctx.renderFn(node);

102 result.push([

103 neighbours.slice(0, key.length - 1).map((n) => n ? ctx.spacerNeighbour : ctx.spacerNoNeighbour).join(""),

104 neighbours[key.length - 1] ? ctx.keyNeighbour : ctx.keyNoNeighbour,

105 key[key.length - 1],

106 nodeRendered === void 0 ? "" : `${ctx.separator}${node}`,

107 isCircular ? ctx.breakCircularWith : ""

108 ].join(""));

109 if (node instanceof Object && !Array.isArray(node) && !isCircular) {

110 keys.push(...sort(Object.keys(node)).map((k) => key.concat(k)));

111 lookup[key.length] = node;

112 }

113 }

114 return ctx.joined === true ? result.join("\n") : result;

115};

116

117// node_modules/@oclif/plugin-plugins/lib/plugins.js

118init_cjs_shims();

119var import_core4 = __toESM(require_lib(), 1);

120var import_debug4 = __toESM(require_src(), 1);

121var import_semver = __toESM(require_semver(), 1);

122import { spawn as spawn2 } from "node:child_process";

123import { access, mkdir, readFile as readFile2, rename, rm, writeFile } from "node:fs/promises";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L121

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/index.jsView on unpkg · L121

124import { basename, dirname, join as join2, parse, resolve } from "node:path";

125import { fileURLToPath as fileURLToPath3 } from "node:url";

126

127// node_modules/@oclif/plugin-plugins/lib/npm.js

128init_cjs_shims();

129var import_core2 = __toESM(require_lib(), 1);

130var import_debug2 = __toESM(require_src(), 1);

131import { readFile } from "node:fs/promises";

132import { createRequire } from "node:module";

133import { join, sep } from "node:path";

134

135// node_modules/@oclif/plugin-plugins/lib/spawn.js

136init_cjs_shims();

137var import_core = __toESM(require_lib(), 1);

138var import_debug = __toESM(require_src(), 1);

139import { spawn as cpSpawn } from "node:child_process";

140

141// node_modules/npm-run-path/index.js

Lines 198-238javascript

198

199// node_modules/@oclif/plugin-plugins/lib/spawn.js

200var debug = (0, import_debug.default)("@oclif/plugin-plugins:spawn");

201async function spawn(modulePath, args = [], { cwd, logLevel }) {

202 return new Promise((resolve2, reject) =>

dist/chunk-T2I5QBUT.jsView file

•path = dist/chunk-T2I5QBUT.js kind = oversized_source_file sizeBytes = 10508451 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/chunk-T2I5QBUT.jsView on unpkg

Source & flagged code

4 flagged · loading source

dist/index.jsView file

121var import_semver = __toESM(require_semver(), 1); L122: import { spawn as spawn2 } from "node:child_process"; L123: import { access, mkdir, readFile as readFile2, rename, rm, writeFile } from "node:fs/promises";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L121

218windowsVerbatimArguments: true, L219: ...process.platform === "win32" && modulePath.toLowerCase().endsWith(".cmd") && { shell: true } L220: });

High

Shell

Package source references shell execution.

dist/index.jsView on unpkg · L218

121Cross-file remote execution chain: dist/index.js spawns dist/npa-L34VQLAA.js; helper contains network access plus dynamic code execution. L121: var import_semver = __toESM(require_semver(), 1); L122: import { spawn as spawn2 } from "node:child_process"; L123: import { access, mkdir, readFile as readFile2, rename, rm, writeFile } from "node:fs/promises"; ... L150: const { L151: env = process.env, L152: platform = process.platform L153: } = options; ... L221: const possibleLastLinesOfNpmInstall = ["up to date", "added"]; L222: const stderr = []; L223: const stdout = []; ... L310: * Get the path to the npm CLI file. L311: * This will resolve npm to the pinned version in `@oclif/plugin-plugins/package.json` if it exists.

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/index.jsView on unpkg · L121

dist/chunk-T2I5QBUT.jsView file

•path = dist/chunk-T2I5QBUT.js kind = oversized_source_file sizeBytes = 10508451 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/chunk-T2I5QBUT.jsView on unpkg

Findings

4 High3 Medium6 Low

HighChild Processdist/index.js

HighShelldist/index.js

HighCross File Remote Execution Contextdist/index.js

HighOversized Source Filedist/chunk-T2I5QBUT.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEval

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

dist/index.jsView file

Lines 101-141javascript

101 const nodeRendered = ctx.renderFn(node);

102 result.push([

103 neighbours.slice(0, key.length - 1).map((n) => n ? ctx.spacerNeighbour : ctx.spacerNoNeighbour).join(""),

104 neighbours[key.length - 1] ? ctx.keyNeighbour : ctx.keyNoNeighbour,

105 key[key.length - 1],

106 nodeRendered === void 0 ? "" : `${ctx.separator}${node}`,

107 isCircular ? ctx.breakCircularWith : ""

108 ].join(""));

109 if (node instanceof Object && !Array.isArray(node) && !isCircular) {

110 keys.push(...sort(Object.keys(node)).map((k) => key.concat(k)));

111 lookup[key.length] = node;

112 }

113 }

114 return ctx.joined === true ? result.join("\n") : result;

115};

116

117// node_modules/@oclif/plugin-plugins/lib/plugins.js

118init_cjs_shims();

119var import_core4 = __toESM(require_lib(), 1);

120var import_debug4 = __toESM(require_src(), 1);

121var import_semver = __toESM(require_semver(), 1);

122import { spawn as spawn2 } from "node:child_process";

123import { access, mkdir, readFile as readFile2, rename, rm, writeFile } from "node:fs/promises";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L121

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/index.jsView on unpkg · L121

124import { basename, dirname, join as join2, parse, resolve } from "node:path";

125import { fileURLToPath as fileURLToPath3 } from "node:url";

126

127// node_modules/@oclif/plugin-plugins/lib/npm.js

128init_cjs_shims();

129var import_core2 = __toESM(require_lib(), 1);

130var import_debug2 = __toESM(require_src(), 1);

131import { readFile } from "node:fs/promises";

132import { createRequire } from "node:module";

133import { join, sep } from "node:path";

134

135// node_modules/@oclif/plugin-plugins/lib/spawn.js

136init_cjs_shims();

137var import_core = __toESM(require_lib(), 1);

138var import_debug = __toESM(require_src(), 1);

139import { spawn as cpSpawn } from "node:child_process";

140

141// node_modules/npm-run-path/index.js

Lines 198-238javascript

198

199// node_modules/@oclif/plugin-plugins/lib/spawn.js

200var debug = (0, import_debug.default)("@oclif/plugin-plugins:spawn");

201async function spawn(modulePath, args = [], { cwd, logLevel }) {

202 return new Promise((resolve2, reject) =>

dist/chunk-T2I5QBUT.jsView file

•path = dist/chunk-T2I5QBUT.js kind = oversized_source_file sizeBytes = 10508451 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/chunk-T2I5QBUT.jsView on unpkg