registry / @paramour-js/next / 0.1.2

@paramour-js/next@0.1.2

Next.js integration for paramour: withTypedRoutes, App and Pages Router hooks, PageProps glue, and the codegen CLI.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 6 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireFilesystem

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 29 file(s), 123 KB of source

Source & flagged code

2 flagged

bin/paramour.jsView file

Lines 1-20javascript

1#!/usr/bin/env node

2// Committed bin stub: pnpm creates bin shims at install time and silently

3// skips any whose target doesn't exist yet — dist/cli.js only exists after

4// a build, so pointing `bin` at it left the examples' shims uncreated (and

5// a second install won't retry: an up-to-date lockfile skips the link

6// phase). This file always exists, so the shim is always created; it just

7// delegates to the built CLI.

8import { existsSync } from "node:fs";

Source & flagged code

2 flagged · loading source

bin/paramour.jsView file

18L19: await import(cli.href);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/paramour.jsView on unpkg · L18

dist/init/wrap-next-config.jsView file

8package = @paramour-js/next; repositoryIdentity = paramour; dependency = magicast L8: export async function detectWrapState(source) { L9: const { parseModule } = await import("magicast"); L10: try {

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/init/wrap-next-config.jsView on unpkg · L8

Findings

1 High2 Medium3 Low

HighCopied Package Dependency Bridgedist/init/wrap-next-config.js

MediumDynamic Requirebin/paramour.js

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

dist/init/wrap-next-config.jsView file

Lines 1-28javascript

1import { existsSync } from "node:fs";

2import { join } from "node:path";

3const IMPORT_LINE = `import { withTypedRoutes } from "@paramour-js/next";`;

4/**

5 * Wrap-state probe for `doctor`: same import/callee detection the codemod

6 * uses for idempotence, without mutating anything.

7 */

8export async function detectWrapState(source) {

9 const { parseModule } = await import("magicast");

10 try {

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/init/wrap-next-config.jsView on unpkg · L8

11 const mod = parseModule(source);

12 const local = withTypedRoutesLocal(mod.imports.$items);

13 return isWrappedCall(mod.exports.default, local)

14 ? "wrapped"

15 : "not-wrapped";

16 }

17 catch {

18 return "unparseable";

19 }

20}

21/** Probe order mirrors init's scaffolding preference: ts, mjs, js. */

22export function findNextConfig(projectRoot) {

23 const probes = [

24 ["next.config.ts", "ts"],

25 ["next.config.mjs", "mjs"],

26 ["next.config.js", "js"],

27 ];

28 for (const [name, lang] of probes) {