registry / @pgpmjs/core / 6.29.1

@pgpmjs/core@6.29.1

PGPM Package and Migration Tools

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 96 file(s), 560 KB of source, external domains: github.com

Source & flagged code

3 flagged

core/class/pgpm.jsView file

Lines 22-62javascript

22 for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;

23 return ar;

24 };

25 return ownKeys(o);

26 };

27 return function (mod) {

28 if (mod && mod.__esModule) return mod;

29 var result = {};

30 if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);

31 __setModuleDefault(result, mod);

32 return result;

33 };

34})();

35var __importDefault = (this && this.__importDefault) || function (mod) {

36 return (mod && mod.__esModule) ? mod : { "default": mod };

37};

38Object.defineProperty(exports, "__esModule", { value: true });

39exports.PgpmPackage = exports.PackageContext = void 0;

40const env_1 = require("@pgpmjs/env");

41const logger_1 = require("@pgpmjs/logger");

42const types_1 = require("@pgpmjs/types");

43const child_process_1 = require("child_process");

44const fs_1 = __importDefault(require("fs"));

High

Child Process

Package source references child process execution.

core/class/pgpm.jsView on unpkg · L42

45const glob = __importStar(require("glob"));

46const os_1 = __importDefault(require("os"));

47const parse_package_name_1 = require("parse-package-name");

48const path_1 = __importStar(require("path"));

49const pg_cache_1 = require("pg-cache");

50const yanse_1 = __importDefault(require("yanse"));

51const extensions_1 = require("../../extensions/extensions");

52const files_1 = require("../../files");

53const files_2 = require("../../files");

54const writer_1 = require("../../files/extension/writer");

55const generator_1 = require("../../files/plan/generator");

56const parser_1 = require("../../files/plan/parser");

57const validators_1 = require("../../files/plan/validators");

58const client_1 = require("../../migrate/client");

59const modules_1 = require("../../modules/modules");

60const package_1 = require("../../packaging/package");

61const deps_1 = require("../../resolution/deps");

62const target_utils_1 = require("../../utils/target-utils");

Lines 792-832javascript

792 /**

793 * Installs an extension npm package into the local skitch extensions directory,

794 * and automatically adds it to the current module’s package.json dependencies.

795 */

796 async installModules(...pkgstrs) {

797 this.ensureWorkspace();

798 this.ensureModule();

799 const originalDir = process.cwd

packaging/package.jsView file

Lines 1-23javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.writePackage = exports.packageModule = exports.cleanTree = void 0;

4const logger_1 = require(

Source & flagged code

3 flagged · loading source

core/class/pgpm.jsView file

42const types_1 = require("@pgpmjs/types"); L43: const child_process_1 = require("child_process"); L44: const fs_1 = __importDefault(require("fs"));

High

Child Process

Package source references child process execution.

core/class/pgpm.jsView on unpkg · L42

812process.chdir(tempDir); L813: (0, child_process_1.execSync)(`npm install ${pkgstr} --production --prefix ./extensions`, { L814: stdio: 'inherit'

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

core/class/pgpm.jsView on unpkg · L812

packaging/package.jsView file

3exports.writePackage = exports.packageModule = exports.cleanTree = void 0; L4: const logger_1 = require("@pgpmjs/logger"); L5: const fs_1 = require("fs");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

packaging/package.jsView on unpkg · L3

Findings

3 High3 Medium4 Low

HighChild Processcore/class/pgpm.js

HighShell

HighRuntime Package Installcore/class/pgpm.js

MediumDynamic Requirepackaging/package.js

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

core/class/pgpm.jsView file

Lines 22-62javascript

22 for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;

23 return ar;

24 };

25 return ownKeys(o);

26 };

27 return function (mod) {

28 if (mod && mod.__esModule) return mod;

29 var result = {};

30 if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);

31 __setModuleDefault(result, mod);

32 return result;

33 };

34})();

35var __importDefault = (this && this.__importDefault) || function (mod) {

36 return (mod && mod.__esModule) ? mod : { "default": mod };

37};

38Object.defineProperty(exports, "__esModule", { value: true });

39exports.PgpmPackage = exports.PackageContext = void 0;

40const env_1 = require("@pgpmjs/env");

41const logger_1 = require("@pgpmjs/logger");

42const types_1 = require("@pgpmjs/types");

43const child_process_1 = require("child_process");

44const fs_1 = __importDefault(require("fs"));

High

Child Process

Package source references child process execution.

core/class/pgpm.jsView on unpkg · L42

45const glob = __importStar(require("glob"));

46const os_1 = __importDefault(require("os"));

47const parse_package_name_1 = require("parse-package-name");

48const path_1 = __importStar(require("path"));

49const pg_cache_1 = require("pg-cache");

50const yanse_1 = __importDefault(require("yanse"));

51const extensions_1 = require("../../extensions/extensions");

52const files_1 = require("../../files");

53const files_2 = require("../../files");

54const writer_1 = require("../../files/extension/writer");

55const generator_1 = require("../../files/plan/generator");

56const parser_1 = require("../../files/plan/parser");

57const validators_1 = require("../../files/plan/validators");

58const client_1 = require("../../migrate/client");

59const modules_1 = require("../../modules/modules");

60const package_1 = require("../../packaging/package");

61const deps_1 = require("../../resolution/deps");

62const target_utils_1 = require("../../utils/target-utils");

Lines 792-832javascript

792 /**

793 * Installs an extension npm package into the local skitch extensions directory,

794 * and automatically adds it to the current module’s package.json dependencies.

795 */

796 async installModules(...pkgstrs) {

797 this.ensureWorkspace();

798 this.ensureModule();

799 const originalDir = process.cwd

packaging/package.jsView file

Lines 1-23javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.writePackage = exports.packageModule = exports.cleanTree = void 0;

4const logger_1 = require(