registry / @vicinae/api / 0.23.1

@vicinae/api@0.23.1

TypeScript SDK to build Vicinae extensions

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 8 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystem

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 54 file(s), 199 KB of source, external domains: raycast.com

Source & flagged code

2 flagged

dist/commands/develop/index.jsView file

Lines 20-101javascript

20 ownKeys = Object.getOwnPropertyNames || function (o) {

21 var ar = [];

22 for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;

23 return ar;

24 };

25 return ownKeys(o);

26 };

27 return function (mod) {

28 if (mod && mod.__esModule) return mod;

29 var result = {};

30 if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);

31 __setModuleDefault(result, mod);

32 return result;

33 };

34})();

35var __importDefault = (this && this.__importDefault) || function (mod) {

36 return (mod && mod.__esModule) ? mod : { "default": mod };

37};

38Object.defineProperty(exports, "__esModule", { value: true });

39const chokidar = __importStar(require("chokidar"));

40const esbuild = __importStar(require("esbuild"));

41const node_child_process_1 = require("node:child_process");

42const fs = __importStar(require("node:fs"));

High

Child Process

Package source references child process execution.

dist/commands/develop/index.jsView on unpkg · L40

43const fsp = __importStar(require("node:fs/promises"));

44const path = __importStar(require("node:path"));

45const manifest_js_1 = __importDefault(require("../../schemas/manifest.js"));

46const extension_types_js_1 = require("../../utils/extension-types.js");

47const logger_js_1 = require("../../utils/logger.js");

48const tail_js_1 = require("../../utils/tail.js");

49const utils_js_1 = require("../../utils/utils.js");

50const vicinae_js_1 = require("../../utils/vicinae.js");

51const develop = {

52 description: "Start an extension development session",

53 flags: {

54 target: {

55 short: "i",

56 description: "Path to the extension directory",

57 default: process.cwd(),

58 },

59 },

60 async run(flags) {

61 const logger = new logger_js_1.Logger();

62 const target = flags.target ?? process.cwd();

63 const pkgPath = path.join(target, "package.json");

64 const parseManifest = () => {

65 if (!fs.existsSync(pkgPath)) {

66 logger.logError(`No package.json found at ${pkgPath}. Does this location point to a valid extension repository?`);

67 process.exit(1);

68 }

69 const json = JSON.parse(fs.readFileSync(pkgPath, "utf8"));

70 const e = manifest_js_1.default.safeParse(json);

71 if (e.error) {

72 logger.logError(`${pkgPath} is not a valid extension manifest: ${e.error}`);

73 process.exit(1);

74 }

75 return e.data;

76 };

77 let manifest = parseManifest();

78 const vicinae = new vicinae_js_1.VicinaeClient();

79 logger.logInfo("Generating extension types...");

80 (0, extension_types_js_1.updateExtensionTypes)(manifest, target);

81 const typeCheck = async () => {

82 const spawned = (0, node_child_process_1.spawn)("npx", ["tsc", "--noEmit"]);

83 let stderr = Buffer.from("");

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/commands/develop/index.jsView on unpkg · L81

84 return new Promise((resolve) => {

85 spawned.stderr.on("data", (buf) => {

86 stderr = Buffer.concat([stderr, buf]);

87 });

88 spawned.on("exit", (status) => resolve({ error: stderr.toString(), ok: status === 0 }));

89 });

90 };

91 const build = async (outDir) => {

92 const entryPoints = manifest.commands

93 .map((cmd) => path.join("src", `${cmd.name}.tsx`))

94 .filter(fs.existsSync);

95 logger.logInfo(`entrypoints [${entryPoints.join(", ")}]`);

96 const promises = manifest.commands.map((cmd) => {

97 const base = path.join(process.cwd(), "src", `${cmd.name}`);

98 const tsxSource = `${base}.tsx`;

99 const tsSource = `${base}.ts`;

100 let source = tsxSource;

101 if (cmd.mode === "view" && !fs.existsSync(tsxSource)) {

Source & flagged code

2 flagged · loading source

dist/commands/develop/index.jsView file

40const esbuild = __importStar(require("esbuild")); L41: const node_child_process_1 = require("node:child_process"); L42: const fs = __importStar(require("node:fs"));

High

Child Process

Package source references child process execution.

dist/commands/develop/index.jsView on unpkg · L40

81const typeCheck = async () => { L82: const spawned = (0, node_child_process_1.spawn)("npx", ["tsc", "--noEmit"]); L83: let stderr = Buffer.from("");

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/commands/develop/index.jsView on unpkg · L81

Findings

2 High2 Medium4 Low

HighChild Processdist/commands/develop/index.js

HighRuntime Package Installdist/commands/develop/index.js

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

dist/commands/develop/index.jsView file

Lines 20-101javascript

20 ownKeys = Object.getOwnPropertyNames || function (o) {

21 var ar = [];

22 for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;

23 return ar;

24 };

25 return ownKeys(o);

26 };

27 return function (mod) {

28 if (mod && mod.__esModule) return mod;

29 var result = {};

30 if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);

31 __setModuleDefault(result, mod);

32 return result;

33 };

34})();

35var __importDefault = (this && this.__importDefault) || function (mod) {

36 return (mod && mod.__esModule) ? mod : { "default": mod };

37};

38Object.defineProperty(exports, "__esModule", { value: true });

39const chokidar = __importStar(require("chokidar"));

40const esbuild = __importStar(require("esbuild"));

41const node_child_process_1 = require("node:child_process");

42const fs = __importStar(require("node:fs"));

High

Child Process

Package source references child process execution.

dist/commands/develop/index.jsView on unpkg · L40

43const fsp = __importStar(require("node:fs/promises"));

44const path = __importStar(require("node:path"));

45const manifest_js_1 = __importDefault(require("../../schemas/manifest.js"));

46const extension_types_js_1 = require("../../utils/extension-types.js");

47const logger_js_1 = require("../../utils/logger.js");

48const tail_js_1 = require("../../utils/tail.js");

49const utils_js_1 = require("../../utils/utils.js");

50const vicinae_js_1 = require("../../utils/vicinae.js");

51const develop = {

52 description: "Start an extension development session",

53 flags: {

54 target: {

55 short: "i",

56 description: "Path to the extension directory",

57 default: process.cwd(),

58 },

59 },

60 async run(flags) {

61 const logger = new logger_js_1.Logger();

62 const target = flags.target ?? process.cwd();

63 const pkgPath = path.join(target, "package.json");

64 const parseManifest = () => {

65 if (!fs.existsSync(pkgPath)) {

66 logger.logError(`No package.json found at ${pkgPath}. Does this location point to a valid extension repository?`);

67 process.exit(1);

68 }

69 const json = JSON.parse(fs.readFileSync(pkgPath, "utf8"));

70 const e = manifest_js_1.default.safeParse(json);

71 if (e.error) {

72 logger.logError(`${pkgPath} is not a valid extension manifest: ${e.error}`);

73 process.exit(1);

74 }

75 return e.data;

76 };

77 let manifest = parseManifest();

78 const vicinae = new vicinae_js_1.VicinaeClient();

79 logger.logInfo("Generating extension types...");

80 (0, extension_types_js_1.updateExtensionTypes)(manifest, target);

81 const typeCheck = async () => {

82 const spawned = (0, node_child_process_1.spawn)("npx", ["tsc", "--noEmit"]);

83 let stderr = Buffer.from("");

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/commands/develop/index.jsView on unpkg · L81

84 return new Promise((resolve) => {

85 spawned.stderr.on("data", (buf) => {

86 stderr = Buffer.concat([stderr, buf]);

87 });

88 spawned.on("exit", (status) => resolve({ error: stderr.toString(), ok: status === 0 }));

89 });

90 };

91 const build = async (outDir) => {

92 const entryPoints = manifest.commands

93 .map((cmd) => path.join("src", `${cmd.name}.tsx`))

94 .filter(fs.existsSync);

95 logger.logInfo(`entrypoints [${entryPoints.join(", ")}]`);

96 const promises = manifest.commands.map((cmd) => {

97 const base = path.join(process.cwd(), "src", `${cmd.name}`);

98 const tsxSource = `${base}.tsx`;

99 const tsSource = `${base}.ts`;

100 let source = tsxSource;

101 if (cmd.mode === "view" && !fs.existsSync(tsxSource)) {