registry / @steipete/summarize / 0.21.6

@steipete/summarize@0.21.6

Link → clean text → summary.

Static Scan Results

scanned 8h ago · by rust-scanner

Static analysis completed at 93.0% confidence. No malicious behavior was detected; 13 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 276 file(s), 1.20 MB of source, external domains: 127.0.0.1, api.anthropic.com, api.firecrawl.dev, api.minimax.io, api.openai.com, api.x.ai, api.z.ai, example.com, generativelanguage.googleapis.com, github.com, integrate.api.nvidia.com, models.github.ai, openrouter.ai, www.apple.com, www.youtube.com

Source & flagged code

4 flagged

dist/esm/slides/source-id.jsView file

Lines 1-21javascript

1import { createHash } from "node:crypto";

2import path from "node:path";

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/esm/slides/source-id.jsView on unpkg · L1

3export function buildYoutubeSourceId(videoId) {

4 return `youtube-${videoId}`;

6export function buildDirectSourceId(url) {

7 const parsed = (() => {

8 try {

9 return new URL(url);

10 }

11 catch {

12 return null;

13 }

14 })();

15 const hostSlug = resolveHostSlug(parsed);

16 const rawName = parsed ? path.basename(parsed.pathname) : "video";

17 const base = rawName.replace(/\.[a-z0-9]+$/i, "").trim() || "video";

18 const slug = toSlug(base);

19 const combined = [hostSlug, slug].filter(Boolean).join("-");

20 const hash = createHash("sha1").update(url).digest("hex").slice(0, 8);

21 return combined ? `${combined}-${hash}` : `video-${hash}`;

dist/esm/daemon/systemd.jsView file

Lines 1-21javascript

1import { execFile } from "node:child_process";

2import fs from "node:fs/promises";

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/esm/daemon/systemd.jsView on unpkg · L1

3import path from "node:path";

completions/summarize.fishView file

•path = completions/summarize.fish kind = build_helper sizeBytes = 11027 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

completions/summarize.fishView on unpkg

dist/esm/daemon/native-messaging-install.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @steipete/summarize@0.21.2 matchedIdentity = npm:QHN0ZWlwZXRlL3N1bW1hcml6ZQ:0.21.2 similarity = 0.900 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/esm/daemon/native-messaging-install.jsView on unpkg

Source & flagged code

4 flagged · loading source

dist/esm/slides/source-id.js

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code