Loading npm security reports…

@redpanda-data/docs-extensions-and-macros@5.1.3: Suspicious npm | LPM Firewall

registry / @redpanda-data/docs-extensions-and-macros / 5.1.3

@redpanda-data/docs-extensions-and-macros@5.1.3

Antora extensions and macros developed for Redpanda documentation.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 154 file(s), 1.18 MB of source, external domains: api.github.com, artifacthub.io, docs.docker.com, docs.redpanda.com, git-scm.com, github.com, go.dev, hub.docker.com, nodejs.org, pandoc.org, python.org, raw.githubusercontent.com, redocly.com, redpanda.com, redpandadata.atlassian.net, www.redpanda.com, www.sitemaps.org

Source & flagged code

6 flagged

tools/generate-cli-docs.jsView file

Lines 1-39javascript

1#!/usr/bin/env node

3/**

4 * Generate CLI Reference Documentation

5 *

6 * This script automatically generates AsciiDoc documentation for the doc-tools CLI

7 * by executing commands with --help and parsing the output, then enhancing it with

8 * JSDoc comments from the source code.

9 */

11const { execSync } = require('child_process');

12const fs = require('fs');

High

Child Process

Package source references child process execution.

tools/generate-cli-docs.jsView on unpkg · L10

13const path = require('path');

15/**

16 * Execute a CLI command and capture help output

17 */

18function getHelpOutput(command) {

19 try {

20 return execSync(`npx doc-tools ${command} --help`, {

21 encoding: 'utf8',

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

tools/generate-cli-docs.jsView on unpkg · L19

22 stdio: ['pipe', 'pipe', 'pipe']

23 });

24 } catch (error) {

25 // Commander exits with code 0 for help, but some shells treat it as error

26 return error.stdout || '';

27 }

28}

30/**

31 * Sanitize path values in option descriptions to remove user-specific absolute paths

32 */

33function sanitizePathInDescription(description) {

34 // Get the repository root path for relativization

35 const repoRoot = path.resolve(__dirname, '..');

37 let sanitized = description;

39 // First, handle repository root paths specifically

tools/property-extractor/generate-handlebars-docs.jsView file

Lines 1-23javascript

1const AUTOGEN_NOTICE = '// This content is autogenerated. Do not edit manually. To override descriptions, use the doc-tools CLI with the --overrides option: https://redpandadata.atlassian.net/wiki/spaces/DOC/pages/1396244485/Review+Redpanda+configuration+properties\n';

2'use strict';

4const fs = require(

tools/rpk-docs/generate-rpk-docs.jsView file

Lines 1-35javascript

1'use strict'

3const fs = require('fs')

4const path = require('path')

5const

docker-compose/25.1/transform/regex.wasmView file

•path = docker-compose/25.1/transform/regex.wasm kind = wasm_module sizeBytes = 334263 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

docker-compose/25.1/transform/regex.wasmView on unpkg

tools/metrics/metrics.pyView file

•path = tools/metrics/metrics.py kind = build_helper sizeBytes = 7735 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

tools/metrics/metrics.pyView on unpkg

Source & flagged code

6 flagged · loading source

tools/generate-cli-docs.js

Source & flagged code

6 flagged

tools/generate-cli-docs.jsView file

Lines 1-39javascript

1#!/usr/bin/env node

3/**

4 * Generate CLI Reference Documentation

5 *

6 * This script automatically generates AsciiDoc documentation for the doc-tools CLI

7 * by executing commands with --help and parsing the output, then enhancing it with

8 * JSDoc comments from the source code.

9 */

11const { execSync } = require('child_process');

12const fs = require('fs');

High

Child Process

Package source references child process execution.

tools/generate-cli-docs.jsView on unpkg · L10

13const path = require('path');

15/**

16 * Execute a CLI command and capture help output

17 */

18function getHelpOutput(command) {

19 try {

20 return execSync(`npx doc-tools ${command} --help`, {

21 encoding: 'utf8',

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

tools/generate-cli-docs.jsView on unpkg · L19

22 stdio: ['pipe', 'pipe', 'pipe']

23 });

24 } catch (error) {

25 // Commander exits with code 0 for help, but some shells treat it as error

26 return error.stdout || '';

27 }

28}

30/**

31 * Sanitize path values in option descriptions to remove user-specific absolute paths

32 */

33function sanitizePathInDescription(description) {

34 // Get the repository root path for relativization

35 const repoRoot = path.resolve(__dirname, '..');

37 let sanitized = description;

39 // First, handle repository root paths specifically

tools/property-extractor/generate-handlebars-docs.jsView file

Lines 1-23javascript

2'use strict';

4const fs = require(

tools/rpk-docs/generate-rpk-docs.jsView file

Lines 1-35javascript

1'use strict'

3const fs = require('fs')

4const path = require('path')

5const

docker-compose/25.1/transform/regex.wasmView file

•path = docker-compose/25.1/transform/regex.wasm kind = wasm_module sizeBytes = 334263 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

docker-compose/25.1/transform/regex.wasmView on unpkg

tools/metrics/metrics.pyView file

•path = tools/metrics/metrics.py kind = build_helper sizeBytes = 7735 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

tools/metrics/metrics.pyView on unpkg

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code