registry / @pinfix/plugin / 1.1.0

@pinfix/plugin@1.1.0

Visual UI annotation overlay for Claude Code-powered source editing in dev servers.

Static Scan Results

scanned 7d ago · by rust-scanner

Static analysis flagged 8 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 11 file(s), 401 KB of source, external domains: docs.python.org, github.com, tc39.es

Source & flagged code

2 flagged

dist/chunk-XCBM54EQ.jsView file

Lines 9-49javascript

9// ../shared/dist/index.js

10var WS_PORT_DEFAULT = 24816;

11var DATA_ATTR = "data-pinfix-source";

12var VUE_BUILTINS = /* @__PURE__ */ new Set([

13 "template",

14 "slot",

15 "transition",

16 "transition-group",

17 "keep-alive",

18 "teleport",

19 "suspense",

20 "component",

21 "fragment"

22]);

24// src/transform.ts

25import { readFileSync } from "fs";

26import { parse as vueParse } from "@vue/compiler-dom";

27var traverse = _traverse.default || _traverse;

28function transformCode(code, id, absolutePath, options) {

29 const [filePath, query] = id.split("?", 2);

30 const params = new URLSearchParams(query || "");

31 if (filePath.endsWith(".vue") && (params.get("lang") === "tsx" || params.get("lang") === "jsx")) {

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/chunk-XCBM54EQ.jsView on unpkg · L29

32 return transformJsx(code, id, absolutePath, options);

33 }

34 if (filePath.endsWith(".vue") && (!query || params.get("type") === "template")) {

35 return transformVue(code, filePath, options);

36 }

37 if (/\.(jsx|tsx)$/.test(filePath)) {

38 return transformJsx(code, id, absolutePath, options);

39 }

40 return null;

41}

42function transformJsx(code, id, absolutePath, options) {

43 const sourceId = id.split("?")[0];

44 let originalSource;

45 try {

46 const filePath = absolutePath || sourceId;

47 originalSource = readFileSync(filePath.split("?")[0], "utf-8");

48 } catch {

49 originalSource = code;

Lines 147-187javascript

147 const attrStr = ` ${DATA_ATTR}="${id}:${line}:${column}"`;

148 s.appendLeft(insertPos, attrStr);

149 hasChanges = true;

150 }

151 if (node.children) {

152 for (const child

Source & flagged code

2 flagged · loading source

dist/chunk-XCBM54EQ.jsView file

167// src/server.ts L168: import { spawn } from "child_process"; L169: import { existsSync, watchFile, unwatchFile, readFileSync as readFileSync2, unlinkSync } from "fs";

High

Child Process

Package source references child process execution.

dist/chunk-XCBM54EQ.jsView on unpkg · L167

29Cross-file remote execution chain: dist/chunk-XCBM54EQ.js spawns dist/overlay.iife.global.js; helper contains network access plus dynamic code execution. L29: const [filePath, query] = id.split("?", 2); L30: const params = new URLSearchParams(query || ""); L31: if (filePath.endsWith(".vue") && (params.get("lang") === "tsx" || params.get("lang") === "jsx")) { ... L167: // src/server.ts L168: import { spawn } from "child_process"; L169: import { existsSync, watchFile, unwatchFile, readFileSync as readFileSync2, unlinkSync } from "fs"; ... L176: function getRuntimeDir() { L177: return typeof __dirname === "string" ? __dirname : dirname(fileURLToPath(import.meta.url)); L178: } ... L209: env: { L210: ...process.env, L211: PINFIX_PORT: String(options.port),

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/chunk-XCBM54EQ.jsView on unpkg · L29

Findings

3 High1 Medium4 Low

HighChild Processdist/chunk-XCBM54EQ.js

HighShell

HighCross File Remote Execution Contextdist/chunk-XCBM54EQ.js

MediumEnvironment Vars

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

dist/chunk-XCBM54EQ.jsView file

Lines 9-49javascript

9// ../shared/dist/index.js

10var WS_PORT_DEFAULT = 24816;

11var DATA_ATTR = "data-pinfix-source";

12var VUE_BUILTINS = /* @__PURE__ */ new Set([

13 "template",

14 "slot",

15 "transition",

16 "transition-group",

17 "keep-alive",

18 "teleport",

19 "suspense",

20 "component",

21 "fragment"

22]);

24// src/transform.ts

25import { readFileSync } from "fs";

26import { parse as vueParse } from "@vue/compiler-dom";

27var traverse = _traverse.default || _traverse;

28function transformCode(code, id, absolutePath, options) {

29 const [filePath, query] = id.split("?", 2);

30 const params = new URLSearchParams(query || "");

31 if (filePath.endsWith(".vue") && (params.get("lang") === "tsx" || params.get("lang") === "jsx")) {

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/chunk-XCBM54EQ.jsView on unpkg · L29

32 return transformJsx(code, id, absolutePath, options);

33 }

34 if (filePath.endsWith(".vue") && (!query || params.get("type") === "template")) {

35 return transformVue(code, filePath, options);

36 }

37 if (/\.(jsx|tsx)$/.test(filePath)) {

38 return transformJsx(code, id, absolutePath, options);

39 }

40 return null;

41}

42function transformJsx(code, id, absolutePath, options) {

43 const sourceId = id.split("?")[0];

44 let originalSource;

45 try {

46 const filePath = absolutePath || sourceId;

47 originalSource = readFileSync(filePath.split("?")[0], "utf-8");

48 } catch {

49 originalSource = code;

Lines 147-187javascript

147 const attrStr = ` ${DATA_ATTR}="${id}:${line}:${column}"`;

148 s.appendLeft(insertPos, attrStr);

149 hasChanges = true;

150 }

151 if (node.children) {

152 for (const child