registry / @plotday/twister / 0.71.0

@plotday/twister@0.71.0

Plot Twist Creator - Build intelligent extensions that integrate and automate

Static Scan Results

scanned 4d ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 126 file(s), 1.41 MB of source, external domains: api.example.com, api.github.com, api.openai.com, api.plot.day, avatar.example.com, calendar.google.com, example.com, googleapis.com, linear.app, meet.google.com, plot.day, www.googleapis.com, www.iana.org, www.w3.org

Source & flagged code

3 flagged

bin/commands/generate.jsView file

Lines 19-59javascript

19 var ownKeys = function(o) {

20 ownKeys = Object.getOwnPropertyNames || function (o) {

21 var ar = [];

22 for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;

23 return ar;

24 };

25 return ownKeys(o);

26 };

27 return function (mod) {

28 if (mod && mod.__esModule) return mod;

29 var result = {};

30 if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);

31 __setModuleDefault(result, mod);

32 return result;

33 };

34})();

35var __importDefault = (this && this.__importDefault) || function (mod) {

36 return (mod && mod.__esModule) ? mod : { "default": mod };

37};

38Object.defineProperty(exports, "__esModule", { value: true });

39exports.generateCommand = generateCommand;

40const child_process_1 = require("child_process");

41const dotenv = __importStar(require("dotenv"));

High

Child Process

Package source references child process execution.

bin/commands/generate.jsView on unpkg · L39

42const fs = __importStar(require("fs"));

43const path = __importStar(require("path"));

44const prompts_1 = __importDefault(require("prompts"));

45const network_error_1 = require("../utils/network-error");

46const out = __importStar(require("../utils/output"));

47const packageManager_1 = require("../utils/packageManager");

48const sse_1 = require("../utils/sse");

49const token_js_1 = require("../utils/token.js");

50/**

51 * Check if files exist and prompt to overwrite

52 */

53async function promptOverwrite(files) {

54 const existingFiles = files.filter((file) => fs.existsSync(file));

55 if (existingFiles.length === 0) {

56 return { overwrite: true, skip: new Set() };

57 }

58 out.warning(`${existingFiles.length} file(s) already exist`, existingFiles.map((file) => path.basename(file)));

59 const response = await (0, prompts_1.default)({

Lines 253-293javascript

253 writeFile(claudeMdPath, claudeMdTemplate);

254 // Write README.md with template replacements

255 let readmeTemplate = fs.readFileSync(path.join(templatesPath, "README.template.md"), "utf-8");

256 // Replace template variables

257 readmeTemplate = readmeTemplate.replace(/\{\{displayName\}\}/g, source.displayName);

258

bin/plot.cjsView file

Lines 1-4javascript

1#!/usr/bin/env node

2// This is a wrapper that runs the compiled CLI

3require('./index.js');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/plot.cjsView on unpkg · L2

Source & flagged code

3 flagged · loading source

bin/commands/generate.jsView file

39exports.generateCommand = generateCommand; L40: const child_process_1 = require("child_process"); L41: const dotenv = __importStar(require("dotenv"));

High

Child Process

Package source references child process execution.

bin/commands/generate.jsView on unpkg · L39

273const updateCommand = packageManager === "npm" L274: ? "npm install @plotday/twister@latest" L275: : packageManager === "pnpm" ... L277: : "yarn add @plotday/twister@latest"; L278: (0, child_process_1.execSync)(updateCommand, { cwd: twistPath, stdio: "ignore" }); L279: out.progress("Installing dependencies...");

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/commands/generate.jsView on unpkg · L273

bin/plot.cjsView file

2// This is a wrapper that runs the compiled CLI L3: require('./index.js');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/plot.cjsView on unpkg · L2

Findings

2 High4 Medium4 Low

HighChild Processbin/commands/generate.js

HighRuntime Package Installbin/commands/generate.js

MediumDynamic Requirebin/plot.cjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

bin/commands/generate.jsView file

Lines 19-59javascript

19 var ownKeys = function(o) {

20 ownKeys = Object.getOwnPropertyNames || function (o) {

21 var ar = [];

22 for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;

23 return ar;

24 };

25 return ownKeys(o);

26 };

27 return function (mod) {

28 if (mod && mod.__esModule) return mod;

29 var result = {};

30 if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);

31 __setModuleDefault(result, mod);

32 return result;

33 };

34})();

35var __importDefault = (this && this.__importDefault) || function (mod) {

36 return (mod && mod.__esModule) ? mod : { "default": mod };

37};

38Object.defineProperty(exports, "__esModule", { value: true });

39exports.generateCommand = generateCommand;

40const child_process_1 = require("child_process");

41const dotenv = __importStar(require("dotenv"));

High

Child Process

Package source references child process execution.

bin/commands/generate.jsView on unpkg · L39

42const fs = __importStar(require("fs"));

43const path = __importStar(require("path"));

44const prompts_1 = __importDefault(require("prompts"));

45const network_error_1 = require("../utils/network-error");

46const out = __importStar(require("../utils/output"));

47const packageManager_1 = require("../utils/packageManager");

48const sse_1 = require("../utils/sse");

49const token_js_1 = require("../utils/token.js");

50/**

51 * Check if files exist and prompt to overwrite

52 */

53async function promptOverwrite(files) {

54 const existingFiles = files.filter((file) => fs.existsSync(file));

55 if (existingFiles.length === 0) {

56 return { overwrite: true, skip: new Set() };

57 }

58 out.warning(`${existingFiles.length} file(s) already exist`, existingFiles.map((file) => path.basename(file)));

59 const response = await (0, prompts_1.default)({

Lines 253-293javascript

253 writeFile(claudeMdPath, claudeMdTemplate);

254 // Write README.md with template replacements

255 let readmeTemplate = fs.readFileSync(path.join(templatesPath, "README.template.md"), "utf-8");

256 // Replace template variables

257 readmeTemplate = readmeTemplate.replace(/\{\{displayName\}\}/g, source.displayName);

258

bin/plot.cjsView file

Lines 1-4javascript

1#!/usr/bin/env node

2// This is a wrapper that runs the compiled CLI

3require('./index.js');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/plot.cjsView on unpkg · L2