registry / @plugdev/cli / 0.12.1

@plugdev/cli@0.12.1

Test Minecraft plugins in one command — plug / plugdev CLI (Paper, Folia, Purpur, Pufferfish, Spigot)

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 23 file(s), 332 KB of source, external domains: adoptium.net, api.modrinth.com, fill.papermc.io, github.com, hangar.papermc.io, nodejs.org, piston-meta.mojang.com, pluglabs.app

Source & flagged code

5 flagged

dist/cli.jsView file

Lines 9-49javascript

9} from "./chunk-ABV6HRBH.js";

10import {

11 findJarByPattern,

12 runMavenBuild

13} from "./chunk-QZGABAHC.js";

14import {

15 installPlugTraceJar,

16 writePlugDevIdentity

17} from "./chunk-WRDFI6MO.js";

18import {

19 autoSelectModule,

20 defaultJarPatternForModule,

21 defaultWatchPathsForModule,

22 detectModules,

23 needsModuleSelection

24} from "./chunk-GOYJM6O7.js";

25import {

26 Errors,

27 PlugDevError,

28 formatError,

29 formatErrorJson,

30 getExitCode

31} from "./chunk-MCEK7CMQ.js";

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/cli.jsView on unpkg · L29

32import {

33 checkGradle,

34 checkJava,

35 checkMaven,

36 getResolvedJava,

37 javaChildEnv,

38 javaToolPath,

39 minJavaMajorForServerVersion,

40 parseJavaMajor,

41 requireJava,

42 requireJava21,

43 resolveJava

44} from "./chunk-37TJ7LE3.js";

45import {

46 loadDotEnv,

47 resolveBotTokenEnv

48} from "./chunk-2AEF77LC.js";

49import {

Lines 1132-1172javascript

1132function embeddedClientDir() {

1133 return join9(plugdevHome(), "minecraft");

1134}

1135async function isEmbeddedClientCached(mcVersion) {

1136 const versionJson = join9(

1137 embeddedClientDir(),

bootstrap/plugdev-bootstrap-paper.jarView file

•path = bootstrap/plugdev-bootstrap-paper.jar kind = high_entropy_blob sizeBytes = 18849 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

bootstrap/plugdev-bootstrap-paper.jarView on unpkg

•path = bootstrap/plugdev-bootstrap-paper.jar kind = compressed_blob sizeBytes = 18849 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

bootstrap/plugdev-bootstrap-paper.jarView on unpkg

•path = bootstrap/plugdev-bootstrap-paper.jar kind = nested_archive_needs_inspection sizeBytes = 18849 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

bootstrap/plugdev-bootstrap-paper.jarView on unpkg

Source & flagged code

5 flagged · loading source

dist/cli.jsView file

1152package = @plugdev/cli; repositoryIdentity = plugdev; dependency = @xmcl/core L1152: try { L1153: const { diagnose } = await import("@xmcl/core"); L1154: const report = await diagnose(mcVersion, embeddedClientDir());

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/cli.jsView on unpkg · L1152

29formatErrorJson, L30: getExitCode L31: } from "./chunk-MCEK7CMQ.js"; ... L336: if (result.type === "unknown") { L337: const pkgRaw = await readText(join(cwd, "package.json")); L338: if (pkgRaw) { L339: try { L340: const pkg = JSON.parse(pkgRaw); L341: const deps = { ... L537: import { constants as constants2 } from "fs"; L538: import { execa } from "execa"; L539: async function exists2(path) {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/cli.jsView on unpkg · L29

bootstrap/plugdev-bootstrap-paper.jarView file

•path = bootstrap/plugdev-bootstrap-paper.jar kind = high_entropy_blob sizeBytes = 18849 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

bootstrap/plugdev-bootstrap-paper.jarView on unpkg

•path = bootstrap/plugdev-bootstrap-paper.jar kind = compressed_blob sizeBytes = 18849 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

bootstrap/plugdev-bootstrap-paper.jarView on unpkg

•path = bootstrap/plugdev-bootstrap-paper.jar kind = nested_archive_needs_inspection sizeBytes = 18849 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

bootstrap/plugdev-bootstrap-paper.jarView on unpkg

Findings

2 High4 Medium7 Low

HighCopied Package Dependency Bridgedist/cli.js

HighShips High Entropy Blobbootstrap/plugdev-bootstrap-paper.jar

MediumNetwork

MediumEnvironment Vars

MediumShips Compressed Blobbootstrap/plugdev-bootstrap-paper.jar

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowWeak Cryptodist/cli.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNested Archive Needs Inspectionbootstrap/plugdev-bootstrap-paper.jar

Source & flagged code

5 flagged

dist/cli.jsView file

Lines 9-49javascript

9} from "./chunk-ABV6HRBH.js";

10import {

11 findJarByPattern,

12 runMavenBuild

13} from "./chunk-QZGABAHC.js";

14import {

15 installPlugTraceJar,

16 writePlugDevIdentity

17} from "./chunk-WRDFI6MO.js";

18import {

19 autoSelectModule,

20 defaultJarPatternForModule,

21 defaultWatchPathsForModule,

22 detectModules,

23 needsModuleSelection

24} from "./chunk-GOYJM6O7.js";

25import {

26 Errors,

27 PlugDevError,

28 formatError,

29 formatErrorJson,

30 getExitCode

31} from "./chunk-MCEK7CMQ.js";

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/cli.jsView on unpkg · L29

32import {

33 checkGradle,

34 checkJava,

35 checkMaven,

36 getResolvedJava,

37 javaChildEnv,

38 javaToolPath,

39 minJavaMajorForServerVersion,

40 parseJavaMajor,

41 requireJava,

42 requireJava21,

43 resolveJava

44} from "./chunk-37TJ7LE3.js";

45import {

46 loadDotEnv,

47 resolveBotTokenEnv

48} from "./chunk-2AEF77LC.js";

49import {

Lines 1132-1172javascript

1132function embeddedClientDir() {

1133 return join9(plugdevHome(), "minecraft");

1134}

1135async function isEmbeddedClientCached(mcVersion) {

1136 const versionJson = join9(

1137 embeddedClientDir(),

bootstrap/plugdev-bootstrap-paper.jarView file

•path = bootstrap/plugdev-bootstrap-paper.jar kind = high_entropy_blob sizeBytes = 18849 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

bootstrap/plugdev-bootstrap-paper.jarView on unpkg

•path = bootstrap/plugdev-bootstrap-paper.jar kind = compressed_blob sizeBytes = 18849 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

bootstrap/plugdev-bootstrap-paper.jarView on unpkg

•path = bootstrap/plugdev-bootstrap-paper.jar kind = nested_archive_needs_inspection sizeBytes = 18849 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

bootstrap/plugdev-bootstrap-paper.jarView on unpkg