registry  /  @plugdev/cli  /  0.7.0

@plugdev/cli@0.7.0

npm run dev for Minecraft plugins and mods

Static Scan Results

scanned 6d ago · by rust-scanner

Static analysis completed at 93.0% confidence. No malicious behavior was detected; 13 low-signal pattern(s) were surfaced and cleared.

Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
Supply chain
HighEntropyStringsUrlStrings
ManifestNo manifest risk signals triggered.
scanned 11 file(s), 165 KB of source, external domains: adoptium.net, api.modrinth.com, fill.papermc.io, github.com, hangar.papermc.io

Source & flagged code

5 flagged · loading source
dist/cli.jsView file
•matchType = previous_version_dangerous_delta matchedPackage = @plugdev/cli@0.6.1 matchedIdentity = npm:QHBsdWdkZXYvY2xp:0.6.1 similarity = 0.444 summary = stored previous version shares package body but lacks this dangerous source file
High
Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.jsView on unpkg
6formatErrorJson, L7: getExitCode L8: } from "./chunk-ANYMKJPX.js"; ... L218: if (!schemaRaw) return void 0; L219: const schema = JSON.parse(schemaRaw); L220: const ajv = new Ajv2020({ allErrors: true, strict: false }); ... L307: // src/util/tools.ts L308: import { execa } from "execa"; L309: import { join as join3 } from "path"; ... L333: async function checkGradle(cwd) { L334: const gradlew = process.platform === "win32" ? "gradlew.bat" : "gradlew"; L335: const path = join3(cwd, gradlew);
Low
Weak Crypto

Package source references weak cryptographic algorithms.

dist/cli.jsView on unpkg · L6
bootstrap/plugdev-bootstrap-paper.jarView file
•path = bootstrap/plugdev-bootstrap-paper.jar kind = high_entropy_blob sizeBytes = 12606 magicHex = [redacted]
High
Ships High Entropy Blob

Package ships high-entropy non-source blobs.

bootstrap/plugdev-bootstrap-paper.jarView on unpkg
•path = bootstrap/plugdev-bootstrap-paper.jar kind = compressed_blob sizeBytes = 12606 magicHex = [redacted]
Medium
Ships Compressed Blob

Package ships compressed or archive-like blobs.

bootstrap/plugdev-bootstrap-paper.jarView on unpkg
•path = bootstrap/plugdev-bootstrap-paper.jar kind = nested_archive_needs_inspection sizeBytes = 12606 magicHex = [redacted]
Low
Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

bootstrap/plugdev-bootstrap-paper.jarView on unpkg

Findings

2 High4 Medium7 Low
HighShips High Entropy Blobbootstrap/plugdev-bootstrap-paper.jar
HighPrevious Version Dangerous Deltadist/cli.js
MediumNetwork
MediumEnvironment Vars
MediumShips Compressed Blobbootstrap/plugdev-bootstrap-paper.jar
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Cryptodist/cli.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNested Archive Needs Inspectionbootstrap/plugdev-bootstrap-paper.jar