registry / @plugdev/cli / 0.12.1

@plugdev/cli@0.12.1

Test Minecraft plugins in one command — plug / plugdev CLI (Paper, Folia, Purpur, Pufferfish, Spigot)

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 23 file(s), 332 KB of source, external domains: adoptium.net, api.modrinth.com, fill.papermc.io, github.com, hangar.papermc.io, nodejs.org, piston-meta.mojang.com, pluglabs.app

Source & flagged code

5 flagged

dist/cli.jsView file

Lines 9-49javascript

9} from "./chunk-ABV6HRBH.js";

10import {

11 findJarByPattern,

12 runMavenBuild

13} from "./chunk-QZGABAHC.js";

14import {

15 installPlugTraceJar,

16 writePlugDevIdentity

17} from

Source & flagged code

5 flagged · loading source

dist/cli.jsView file

1152package = @plugdev/cli; repositoryIdentity = plugdev; dependency = @xmcl/core L1152: try { L1153: const { diagnose } = await import("@xmcl/core"); L1154: const report = await diagnose(mcVersion, embeddedClientDir());

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/cli.jsView on unpkg · L1152

29formatErrorJson, L30: getExitCode L31: } from "./chunk-MCEK7CMQ.js"; ... L336: if (result.type === "unknown") { L337: const pkgRaw = await readText(join(cwd, "package.json")); L338: if (pkgRaw) { L339: try { L340: const pkg = JSON.parse(pkgRaw); L341: const deps = { ... L537: import { constants as constants2 } from "fs"; L538: import { execa } from "execa"; L539: async function exists2(path) {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/cli.jsView on unpkg · L29

bootstrap/plugdev-bootstrap-paper.jarView file

•path = bootstrap/plugdev-bootstrap-paper.jar kind = high_entropy_blob sizeBytes = 18849 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

bootstrap/plugdev-bootstrap-paper.jarView on unpkg

•path = bootstrap/plugdev-bootstrap-paper.jar kind = compressed_blob sizeBytes = 18849 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

bootstrap/plugdev-bootstrap-paper.jarView on unpkg

•path = bootstrap/plugdev-bootstrap-paper.jar kind = nested_archive_needs_inspection sizeBytes = 18849 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

bootstrap/plugdev-bootstrap-paper.jarView on unpkg

Findings

2 High4 Medium7 Low

HighCopied Package Dependency Bridgedist/cli.js

HighShips High Entropy Blobbootstrap/plugdev-bootstrap-paper.jar

MediumNetwork

MediumEnvironment Vars

MediumShips Compressed Blobbootstrap/plugdev-bootstrap-paper.jar

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowWeak Cryptodist/cli.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNested Archive Needs Inspectionbootstrap/plugdev-bootstrap-paper.jar

Lines 1132-1172javascript

1132function embeddedClientDir() {

1133 return join9(plugdevHome(), "minecraft");

1134}

1135async function isEmbeddedClientCached(mcVersion) {

1136 const versionJson = join9(

1137 embeddedClientDir(),

1138 "versions",

1139 mcVersion,

1140 `${mcVersion}.json`

1141 );

1142 try {

1143 await access8(versionJson, constants3.F_OK);

1144 return true;

1145 } catch {

1146 return false;

1147 }

1148}

1149var BLOCKING_ROLES = /* @__PURE__ */ new Set(["library", "minecraftJar", "versionJson"]);

1150async function isEmbeddedClientReady(mcVersion) {

1151 if (!await isEmbeddedClientCached(mcVersion)) return false;

1152 try {

1153 const { diagnose } = await import("@xmcl/core");

1154 const report = await diagnose(mcVersion, embeddedClientDir());

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/cli.jsView on unpkg · L1152

1155 return !report.issues.some((i) => BLOCKING_ROLES.has(i.role));

1156 } catch {

1157 return false;

1158 }

1159}

1160function isMissingLibrariesError(err) {

1161 if (!err || typeof err !== "object") return false;

1162 const e = err;

1163 if (e.error === "MissingLibraries") return true;

1164 return typeof e.message === "string" && e.message.includes("Missing") && e.message.includes("libraries");

1165}

1166async function purgeEmptyAssetObjects(gamePath = embeddedClientDir()) {

1167 const objectsRoot = join9(gamePath, "assets", "objects");

1168 let removed = 0;

1169 let dirs;

1170 try {

1171 dirs = await readdir2(objectsRoot);

1172 } catch {

bootstrap/plugdev-bootstrap-paper.jarView file

•path = bootstrap/plugdev-bootstrap-paper.jar kind = high_entropy_blob sizeBytes = 18849 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

bootstrap/plugdev-bootstrap-paper.jarView on unpkg

•path = bootstrap/plugdev-bootstrap-paper.jar kind = compressed_blob sizeBytes = 18849 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

bootstrap/plugdev-bootstrap-paper.jarView on unpkg

•path = bootstrap/plugdev-bootstrap-paper.jar kind = nested_archive_needs_inspection sizeBytes = 18849 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

bootstrap/plugdev-bootstrap-paper.jarView on unpkg