registry / @skyramp/skyramp / 1.3.34

@skyramp/skyramp@1.3.34

module for leveraging skyramp cli functionality

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 34 file(s), 328 KB of source, external domains: cdnjs.cloudflare.com, tokenize.skyramp.dev

Source & flagged code

5 flagged

package.jsonView file

Lines 1-29json

2 "name": "@skyramp/skyramp",

3 "version": "1.3.34",

4 "description": "module for leveraging skyramp cli functionality",

5 "scripts": {

High

Node Builtin Dependency Squat

Package declares a runtime dependency whose name matches a Node built-in module.

package.jsonView on unpkg · L5

6 "lint": "eslint 'src/**/*.js' 'src/**/*.ts' --fix",

7 "pack": "npm pack",

8 "reference-docs": "documentation build src/**/*.js src/classes/**/*.js -f md -o reference.md",

9 "postinstall": "node scripts/download-binary.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L9

10 "clean": "rimraf node_modules && rimraf package-lock.json && rimraf skyramp && rimraf lib/*"

11 },

12 "files": [

13 "scripts/*.js",

14 "src/*.js",

15 "src/*.ts",

16 "src/classes/*.js",

17 "src/classes/*.ts",

18 "src/pdfViewer/*.js",

19 "src/pdfViewer/*.ts",

20 "lib/*.dylib"

21 ],

22 "main": "src/index.js",

23 "types": "src/index.d.ts",

24 "author": "",

25 "license": "MIT",

26 "dependencies": {

27 "@aws-sdk/client-s3": "^3.812.0",

28 "fs": "^0.0.1-security",

29 "js-yaml": "^4.1.0",

scripts/build-pdf-bundle.jsView file

Lines 1-34javascript

1#!/usr/bin/env node

3/**

4 * Builds bundle.js from Playwright's pdfJsViewer.ts using TypeScript's transpileModule.

5 * This correctly handles all TypeScript syntax without regex-based stripping.

6 *

7 * Usage:

8 * node scripts/build-pdf-bundle.js [playwright-root-path]

9 * PLAYWRIGHT_ROOT=/path/to/playwright node scripts/build-pdf-bundle.js

10 *

11 * NOTE: This replaces the regex-based generate-pdf-bundle.js approach which had

12 * issues stripping complex TypeScript types and template literal strings.

scripts/download-binary.jsView file

Lines 1-21javascript

1const https = require('https');

2const fs = require('fs');

Low

Weak Crypto

Package source references weak cryptographic algorithms.

scripts/download-binary.jsView on unpkg · L1

3const path = require('path');

src/classes/SmartPlaywright.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @skyramp/skyramp@1.3.32 matchedIdentity = npm:QHNreXJhbXAvc2t5cmFtcA:1.3.32 similarity = 0.941 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/classes/SmartPlaywright.jsView on unpkg

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/download-binary.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•Runtime dependency names matching Node built-ins: fs

High

Node Builtin Dependency Squat

Package declares a runtime dependency whose name matches a Node built-in module.

package.jsonView on unpkg

scripts/build-pdf-bundle.jsView file

14L15: const fs = require('fs'); L16: const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

scripts/build-pdf-bundle.jsView on unpkg · L14

scripts/download-binary.jsView file

1const https = require('https'); L2: const fs = require('fs'); ... L23: L24: let S3_PRIVATE = process.env.S3_PRIVATE || false; // Set to true if libraries are in a private S3 bucket L25: const AWS_REGION = process.env.AWS_REGION || 'us-west-2'; // Used only for private S3 bucket access ... L56: L57: const rawPlatform = process.platform; L58: const rawArch = process.arch; ... L72: const baseUrl = `https://${PUBLIC_BUCKET_NAME}.s3.${PUBLIC_BUCKET_REGION}.amazonaws.com/${PUBLIC_LIBRARY_PATH}/`; L73: const localDir = path.join(__dirname, '..', 'lib'); L74: ... L138: const command = new GetObjectCommand({ Bucket: bucket, Key: s3Key });

Low

Weak Crypto

Package source references weak cryptographic algorithms.

scripts/download-binary.jsView on unpkg · L1

src/classes/SmartPlaywright.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/classes/SmartPlaywright.jsView on unpkg

Findings

3 High4 Medium5 Low

HighInstall Time Lifecycle Scriptspackage.json

HighNode Builtin Dependency Squatpackage.json

HighPrevious Version Dangerous Deltasrc/classes/SmartPlaywright.js

MediumDynamic Requirescripts/build-pdf-bundle.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowWeak Cryptoscripts/download-binary.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

5 flagged

package.jsonView file

Lines 1-29json

2 "name": "@skyramp/skyramp",

3 "version": "1.3.34",

4 "description": "module for leveraging skyramp cli functionality",

5 "scripts": {

High

Node Builtin Dependency Squat

Package declares a runtime dependency whose name matches a Node built-in module.

package.jsonView on unpkg · L5

6 "lint": "eslint 'src/**/*.js' 'src/**/*.ts' --fix",

7 "pack": "npm pack",

8 "reference-docs": "documentation build src/**/*.js src/classes/**/*.js -f md -o reference.md",

9 "postinstall": "node scripts/download-binary.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L9

10 "clean": "rimraf node_modules && rimraf package-lock.json && rimraf skyramp && rimraf lib/*"

11 },

12 "files": [

13 "scripts/*.js",

14 "src/*.js",

15 "src/*.ts",

16 "src/classes/*.js",

17 "src/classes/*.ts",

18 "src/pdfViewer/*.js",

19 "src/pdfViewer/*.ts",

20 "lib/*.dylib"

21 ],

22 "main": "src/index.js",

23 "types": "src/index.d.ts",

24 "author": "",

25 "license": "MIT",

26 "dependencies": {

27 "@aws-sdk/client-s3": "^3.812.0",

28 "fs": "^0.0.1-security",

29 "js-yaml": "^4.1.0",

scripts/build-pdf-bundle.jsView file

Lines 1-34javascript

1#!/usr/bin/env node

3/**

4 * Builds bundle.js from Playwright's pdfJsViewer.ts using TypeScript's transpileModule.

5 * This correctly handles all TypeScript syntax without regex-based stripping.

6 *

7 * Usage:

8 * node scripts/build-pdf-bundle.js [playwright-root-path]

9 * PLAYWRIGHT_ROOT=/path/to/playwright node scripts/build-pdf-bundle.js

10 *

11 * NOTE: This replaces the regex-based generate-pdf-bundle.js approach which had

12 * issues stripping complex TypeScript types and template literal strings.

scripts/download-binary.jsView file

Lines 1-21javascript

1const https = require('https');

2const fs = require('fs');

Low

Weak Crypto

Package source references weak cryptographic algorithms.

scripts/download-binary.jsView on unpkg · L1

3const path = require('path');

src/classes/SmartPlaywright.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/classes/SmartPlaywright.jsView on unpkg