registry / @skyramp/skyramp / 1.3.35

@skyramp/skyramp@1.3.35

module for leveraging skyramp cli functionality

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 35 file(s), 333 KB of source, external domains: cdnjs.cloudflare.com, tokenize.skyramp.dev

Source & flagged code

4 flagged

package.jsonView file

Lines 1-29json

2 "name": "@skyramp/skyramp",

3 "version": "1.3.35",

4 "description": "module for leveraging skyramp cli functionality",

5 "scripts": {

High

Node Builtin Dependency Squat

Package declares a runtime dependency whose name matches a Node built-in module.

package.jsonView on unpkg · L5

6 "lint": "eslint 'src/**/*.js' 'src/**/*.ts' --fix",

7 "pack": "npm pack",

8 "reference-docs": "documentation build src/**/*.js src/classes/**/*.js -f md -o reference.md",

9 "postinstall": "node scripts/download-binary.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L9

10 "clean": "rimraf node_modules && rimraf package-lock.json && rimraf skyramp && rimraf lib/*"

11 },

12 "files": [

13 "scripts/*.js",

14 "src/*.js",

15 "src/*.ts",

16 "src/classes/*.js",

17 "src/classes/*.ts",

18 "src/pdfViewer/*.js",

19 "src/pdfViewer/*.ts",

20 "lib/*.dylib"

21 ],

22 "main": "src/index.js",

23 "types": "src/index.d.ts",

24 "author": "",

25 "license": "MIT",

26 "dependencies": {

27 "@aws-sdk/client-s3": "^3.812.0",

28 "fs": "^0.0.1-security",

29 "js-yaml": "^4.1.0",

scripts/build-pdf-bundle.jsView file

Lines 1-34javascript

1#!/usr/bin/env node

3/**

4 * Builds bundle.js from Playwright's pdfJsViewer.ts using TypeScript's transpileModule.

5 * This correctly handles all TypeScript syntax without regex-based stripping.

6 *

7 * Usage:

8 * node scripts/build-pdf-bundle.js [playwright-root-path]

9 * PLAYWRIGHT_ROOT=/path/to/playwright node scripts/build-pdf-bundle.js

10 *

11 * NOTE: This replaces the regex-based generate-pdf-bundle.js approach which had

scripts/download-binary.jsView file

Lines 1-21javascript

1const https = require('https');

2const fs = require('fs');

Low

Weak Crypto

Package source references weak cryptographic algorithms.

scripts/download-binary.jsView on unpkg · L1

3const

Source & flagged code

4 flagged · loading source

package.jsonView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code