registry / @opentf/web-docs / 0.2.0

@opentf/web-docs@0.2.0

Documentation-site generator for OTF Web — themed shell components (sidebar, TOC, callouts, tabs), a build-time nav generator, and a default light/dark theme.

AI Security Review

scanned 4d ago · by lpm-firewall-ai

No confirmed malicious attack surface was found. The package is a documentation-site component/build helper with build-time filesystem reads, git metadata queries, and Pagefind index generation aligned to its purpose.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

User imports docs UI components or explicitly invokes docs build integrations via the host @opentf/web toolchain.

Impact

Generates docs metadata and local search assets; no credential access or exfiltration behavior identified.

Mechanism

docs navigation/blog/search/last-updated generation

Rationale

Static inspection shows the flagged primitives are expected docs-generator behavior: runtime Pagefind import, frontmatter/page scanning, git timestamp lookup, and local index output. There is no install-time/import-time malware, exfiltration, persistence, destructive action, or unconsented control-surface mutation.

Evidence

package.jsonindex.jscomponents/Search.jsxbuild/frontmatter.jsbuild/pagefind.jsbuild/docs-nav-plugin.jsbuild/blog-posts-plugin.jsbuild/last-updated.jsbuild/last-updated-plugin.jscaller-provided app/docs/blog page files readcaller-provided siteDir/pagefind written by Pagefind

Decision evidence

public snapshot

AI called this Clean at 94.0% confidence as Benign with low false-positive risk.

Evidence for block

Evidence against

package.json has no install/preinstall/postinstall lifecycle hooks and exports only docs components/config/build helpers.
components/Search.jsx dynamically imports /pagefind/pagefind.js only on user search UI use; it is package-aligned static search runtime loading.
build/frontmatter.js only readFileSyncs caller-provided markdown paths and parses frontmatter; scanner Unicode hit is an optional BOM in regex, not bidi control flow.
build/pagefind.js writes Pagefind index files under caller-provided siteDir/pagefind during explicit build indexing.
build/last-updated*.js uses execFileSync git log/rev-parse only for docs metadata during build/dev, with fixed git arguments.
rg found no credential harvesting, exfiltration endpoints, lifecycle execution, destructive file operations, or AI-agent control-surface writes.

Behavioral surface

Source

ChildProcessDynamicRequireFilesystemShell

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 44 file(s), 85.1 KB of source

Source & flagged code

3 flagged

components/Search.jsxView file

Lines 1-36jsx

1// Pagefind-backed search modal (Phase 2). The navbar's `SearchTrigger` and the global

2// ⌘K / Ctrl+K shortcut open it via `window.__otfwOpenSearch`, which this component

3// installs on mount. The static index is generated at build time (`otfw build --ssg`

4// with `docs.search.provider === "pagefind"`) and lives at `/pagefind/`; we load its

5// runtime on first open so pages without a search never pay for it.

6//

7// Note: results only exist against a built site (`dist/`). In dev there is no index,

8// so the modal opens but reports no results — expected.

9import { onMount, router, RawHtml, Portal } from "@opentf/web";

11let pagefindPromise = null;

12function loadPagefind() {

13 if (!pagefindPromise) {

14 // A non-literal specifier keeps the bundler from trying to resolve the index at

15 // build time (it doesn't exist yet) — it stays a runtime import of the static file.

16 const path = "/pagefind/pagefind.js";

17 pagefindPromise = import(/* @vite-ignore */ path).then(async (pf) => {

18 await pf.init?.();

Medium

Dynamic Require

Package source references dynamic require/import behavior.

components/Search.jsxView on unpkg · L16

19 return pf;

20 });

21 }

22 return pagefindPromise;

23}

25export default function Search() {

26 let open = $state(false);

27 let query = $state("");

28 let results = $state([]);

29 let active = $state(0);

30 let loading = $state(false);

31 const inputRef = $ref();

33 let timer;

34 let token = 0;

36 async function runSearch(q) {

build/frontmatter.jsView file

Lines 1-38javascript

1// Minimal YAML frontmatter reader for the nav generator.

2//

3// Mirrors the flat-scalar parser in the Rust MDX front-end

4// (crates/otfw_compiler/src/mdx.rs `frontmatter_object`): a leading `---` block of

5// `key: value` lines, scalars only. Booleans/numbers are coerced; everything else is

6// a string. Nested maps / lists are out of scope (a follow-up, same as the Rust side).

8import { readFileSync } from "node:fs";

10/** Parse the leading frontmatter block of an .mdx/.md file into a flat object. */

Source & flagged code

3 flagged · loading source

components/Search.jsxView file

16const path = "/pagefind/pagefind.js"; L17: pagefindPromise = import(/* @vite-ignore */ path).then(async (pf) => { L18: await pf.init?.();

Medium

Dynamic Require

Package source references dynamic require/import behavior.

components/Search.jsxView on unpkg · L16

build/frontmatter.jsView file

18contains invisible/control Unicode U+FEFF (zero width no-break space) const m = source.match(/^<U+FEFF>?---\r?\n([\s\S]*?)\r?\n---/);

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

build/frontmatter.jsView on unpkg · L18

•Trigger-reachable chain: manifest.exports -> build/index.js -> build/blog-posts-plugin.js -> build/frontmatter.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

build/frontmatter.jsView on unpkg

Findings

2 Critical2 Medium3 Low

CriticalTrojan Source Unicodebuild/frontmatter.js

CriticalTrigger Reachable Dangerous Capabilitybuild/frontmatter.js

MediumDynamic Requirecomponents/Search.jsx

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

Source & flagged code

3 flagged

components/Search.jsxView file

Lines 1-36jsx

1// Pagefind-backed search modal (Phase 2). The navbar's `SearchTrigger` and the global

2// ⌘K / Ctrl+K shortcut open it via `window.__otfwOpenSearch`, which this component

3// installs on mount. The static index is generated at build time (`otfw build --ssg`

4// with `docs.search.provider === "pagefind"`) and lives at `/pagefind/`; we load its

5// runtime on first open so pages without a search never pay for it.

6//

7// Note: results only exist against a built site (`dist/`). In dev there is no index,

8// so the modal opens but reports no results — expected.

9import { onMount, router, RawHtml, Portal } from "@opentf/web";

11let pagefindPromise = null;

12function loadPagefind() {

13 if (!pagefindPromise) {

14 // A non-literal specifier keeps the bundler from trying to resolve the index at

15 // build time (it doesn't exist yet) — it stays a runtime import of the static file.

16 const path = "/pagefind/pagefind.js";

17 pagefindPromise = import(/* @vite-ignore */ path).then(async (pf) => {

18 await pf.init?.();

Medium

Dynamic Require

Package source references dynamic require/import behavior.

components/Search.jsxView on unpkg · L16

19 return pf;

20 });

21 }

22 return pagefindPromise;

23}

25export default function Search() {

26 let open = $state(false);

27 let query = $state("");

28 let results = $state([]);

29 let active = $state(0);

30 let loading = $state(false);

31 const inputRef = $ref();

33 let timer;

34 let token = 0;

36 async function runSearch(q) {

build/frontmatter.jsView file

Lines 1-38javascript

1// Minimal YAML frontmatter reader for the nav generator.

2//

3// Mirrors the flat-scalar parser in the Rust MDX front-end

4// (crates/otfw_compiler/src/mdx.rs `frontmatter_object`): a leading `---` block of

5// `key: value` lines, scalars only. Booleans/numbers are coerced; everything else is

6// a string. Nested maps / lists are out of scope (a follow-up, same as the Rust side).

8import { readFileSync } from "node:fs";

10/** Parse the leading frontmatter block of an .mdx/.md file into a flat object. */