registry / @pgpmjs/core / 6.29.1

@pgpmjs/core@6.29.1

PGPM Package and Migration Tools

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 96 file(s), 560 KB of source, external domains: github.com

Source & flagged code

3 flagged

core/class/pgpm.jsView file

Lines 22-62javascript

22 for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;

23 return ar;

24 };

25 return ownKeys(o);

Source & flagged code

3 flagged · loading source

core/class/pgpm.jsView file

42const types_1 = require("@pgpmjs/types"); L43: const child_process_1 = require("child_process"); L44: const fs_1 = __importDefault(require("fs"));

High

Child Process

Package source references child process execution.

core/class/pgpm.jsView on unpkg · L42

812process.chdir(tempDir); L813: (0, child_process_1.execSync)(`npm install ${pkgstr} --production --prefix ./extensions`, { L814: stdio: 'inherit'

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

core/class/pgpm.jsView on unpkg · L812

packaging/package.jsView file

3exports.writePackage = exports.packageModule = exports.cleanTree = void 0; L4: const logger_1 = require("@pgpmjs/logger"); L5: const fs_1 = require("fs");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

packaging/package.jsView on unpkg · L3

Findings

3 High3 Medium4 Low

HighChild Processcore/class/pgpm.js

HighShell

HighRuntime Package Installcore/class/pgpm.js

MediumDynamic Requirepackaging/package.js

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Lines 792-832javascript

792 /**

793 * Installs an extension npm package into the local skitch extensions directory,

794 * and automatically adds it to the current module’s package.json dependencies.

795 */

796 async installModules(...pkgstrs) {

797 this.ensureWorkspace();

798 this.ensureModule();

799 const originalDir = process.cwd();

800 const skitchExtDir = path_1.default.join(this.workspacePath, EXTENSIONS_DIR);

801 const pkgJsonPath = path_1.default.join(this.modulePath, 'package.json');

802 if (!fs_1.default.existsSync(pkgJsonPath)) {

803 throw new Error(`No package.json found at module path: ${this.modulePath}`);

804 }

805 const pkgData = JSON.parse(fs_1.default.readFileSync(pkgJsonPath, 'utf-8'));

806 pkgData.dependencies = pkgData.dependencies || {};

807 const newlyAdded = [];

808 for (const pkgstr of pkgstrs) {

809 const { name } = (0, parse_package_name_1.parse)(pkgstr);

810 const tempDir = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'pgpm-install-'));

811 try {

812 process.chdir(tempDir);

813 (0, child_process_1.execSync)(`npm install ${pkgstr} --production --prefix ./extensions`, {

814 stdio: 'inherit'

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

core/class/pgpm.jsView on unpkg · L812

815 });

816 const matches = glob.sync('./extensions/**/pgpm.plan');

817 const installs = matches.map((conf) => {

818 const fullConf = (0, path_1.resolve)(conf);

819 const extDir = (0, path_1.dirname)(fullConf);

820 const parts = extDir.split('node_modules/');

821 const relativeDir = parts[parts.length - 1];

822 const dstDir = path_1.default.join(skitchExtDir, relativeDir);

823 return { src: extDir, dst: dstDir, pkg: relativeDir };

824 });

825 // Sort deepest paths first so nested node_modules deps are

826 // extracted before their parent directories are moved.

827 installs.sort((a, b) => b.src.split('/').length - a.src.split('/').length);

828 for (const { src, dst, pkg } of installs) {

829 if (fs_1.default.existsSync(dst)) {

830 fs_1.default.rmSync(dst, { recursive: true, force: true });

831 }

832 fs_1.default.mkdirSync(path_1.default.dirname(dst), { recursive: true });

packaging/package.jsView file

Lines 1-23javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.writePackage = exports.packageModule = exports.cleanTree = void 0;

4const logger_1 = require("@pgpmjs/logger");

5const fs_1 = require("fs");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

packaging/package.jsView on unpkg · L3

6const path_1 = require("path");

7const pgsql_deparser_1 = require("pgsql-deparser");

8const pgsql_parser_1 = require("pgsql-parser");

9const files_1 = require("../files");

10const resolve_1 = require("../resolution/resolve");

11const transform_1 = require("./transform");

12const log = new logger_1.Logger('package');

13const noop = () => undefined;

14const cleanTree = (tree) => {

15 return (0, transform_1.transformProps)(tree, {

16 stmt_len: noop,

17 stmt_location: noop,

18 location: noop,

19 });

20};

21exports.cleanTree = cleanTree;

22const filterStatements = (stmts, extension) => {

23 if (!extension)