registry / @withfudge/design / 0.1.2

@withfudge/design@0.1.2

Local Fudge design CLI and MCP server for querying saved pins with Prolog.

Static Scan Results

scanned 10d ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

UrlStrings

Manifest

NoLicense

scanned 24 file(s), 129 KB of source, external domains: 127.0.0.1, api.fontofweb.com, api.withfudge.com, design.withfudge.com, pub-3a14aed695744ee3ae7b28553e18cf81.r2.dev, search.fontofweb.com

Source & flagged code

4 flagged

dist/ops/auth.jsView file

Lines 1-24javascript

1import { mkdir, readFile, rm, writeFile, chmod } from "node:fs/promises";

2import { homedir } from "node:os";

3import { platform } from "node:process";

4import { join } from "node:path";

5import { execFile } from "node:child_process";

6import { promisify } from "node:util";

High

Child Process

Package source references child process execution.

dist/ops/auth.jsView on unpkg · L4

7const execFileAsync = promisify(execFile);

8const KEYCHAIN_SERVICE = "fontofweb.fudge.session";

9const KEYCHAIN_ACCOUNT = "default";

10export async function readSession(options = {}) {

11 if (shouldUseKeychain(options)) {

12 const keychainSession = await readKeychainSession();

13 if (keychainSession)

14 return keychainSession;

15 }

16 return readFileSession(options);

17}

18async function readFileSession(options = {}) {

19 const path = sessionPath(options);

20 let raw = "";

21 try {

22 raw = await readFile(path, "utf8");

23 }

24 catch {

dist/ops/package-info.jsView file

Lines 1-6javascript

1import { createRequire } from "node:module";

2const require = createRequire(import.meta.url);

3const manifest = require("../../package.json");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/ops/package-info.jsView on unpkg · L1

dist/ops/login.jsView file

Lines 1-21javascript

1import { createHash, randomBytes } from "node:crypto";

2import { spawn } from "node:child_process";

3import { createServer } from "node:http";

4import { writeSession } from "./auth.js";

5import { refreshEntitlement } from "./entitlement.js";

Source & flagged code

4 flagged · loading source

dist/ops/auth.jsView file

4import { join } from "node:path"; L5: import { execFile } from "node:child_process"; L6: import { promisify } from "node:util";

High

Child Process

Package source references child process execution.

dist/ops/auth.jsView on unpkg · L4

dist/ops/package-info.jsView file

1import { createRequire } from "node:module"; L2: const require = createRequire(import.meta.url); L3: const manifest = require("../../package.json");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/ops/package-info.jsView on unpkg · L1

dist/ops/login.jsView file

107const args = process.platform === "win32" ? ["/c", "start", "", url] : [url]; L108: const child = spawn(command, args, { stdio: "ignore", detached: true }); L109: child.unref(); ... L118: function apiBase(value) { L119: return (value || process.env.FUDGE_API_BASE || "https://api.withfudge.com").replace(/\/+$/, ""); L120: }

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/ops/login.jsView on unpkg · L107

1import { createHash, randomBytes } from "node:crypto"; L2: import { spawn } from "node:child_process"; L3: import { createServer } from "node:http"; L4: import { writeSession } from "./auth.js"; ... L6: export async function browserLoopbackLogin(options = {}) { L7: const state = randomBase64url(24); L8: const codeVerifier = randomBase64url(48); ... L39: headers: { "content-type": "application/json" }, L40: body: JSON.stringify({ code, code_verifier: codeVerifier }), L41: }); ... L101: function openInBrowser(url) { L102: const command = process.platform === "darwin"

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/ops/login.jsView on unpkg · L1

Findings

4 High4 Medium4 Low

HighChild Processdist/ops/auth.js

HighShell

HighSame File Env Network Executiondist/ops/login.js

HighSandbox Evasion Gated Capabilitydist/ops/login.js

MediumDynamic Requiredist/ops/package-info.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowUrl Strings

LowNo License

Source & flagged code

4 flagged

dist/ops/auth.jsView file

Lines 1-24javascript

1import { mkdir, readFile, rm, writeFile, chmod } from "node:fs/promises";

2import { homedir } from "node:os";

3import { platform } from "node:process";

4import { join } from "node:path";

5import { execFile } from "node:child_process";

6import { promisify } from "node:util";

High

Child Process

Package source references child process execution.

dist/ops/auth.jsView on unpkg · L4

7const execFileAsync = promisify(execFile);

8const KEYCHAIN_SERVICE = "fontofweb.fudge.session";

9const KEYCHAIN_ACCOUNT = "default";

10export async function readSession(options = {}) {

11 if (shouldUseKeychain(options)) {

12 const keychainSession = await readKeychainSession();

13 if (keychainSession)

14 return keychainSession;

15 }

16 return readFileSession(options);

17}

18async function readFileSession(options = {}) {

19 const path = sessionPath(options);

20 let raw = "";

21 try {

22 raw = await readFile(path, "utf8");

23 }

24 catch {

dist/ops/package-info.jsView file

Lines 1-6javascript

1import { createRequire } from "node:module";

2const require = createRequire(import.meta.url);

3const manifest = require("../../package.json");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/ops/package-info.jsView on unpkg · L1

dist/ops/login.jsView file

Lines 1-21javascript

1import { createHash, randomBytes } from "node:crypto";

2import { spawn } from "node:child_process";

3import { createServer } from "node:http";

4import { writeSession } from "./auth.js";

5import { refreshEntitlement } from "./entitlement.js";

Lines 87-127javascript

87 const address = server.address();

88 if (!address || typeof address === "string") {

89 reject(new Error("Could not bind loopback login server"));

90 return;

91 }

92 resolve(`http://127.0.0.1:${address.port}/callback`);

93 });

94 });

95}

96function closeServer(server) {

97 return new Promise((resolve) => {

98 server.close(() => resolve());

99 });

100}

101function openInBrowser(url) {

102 const command = process.platform === "darwin"

103 ? "open"

104 : process.platform === "win32"

105 ? "cmd"

106 : "xdg-open";

107 const args = process.platform === "win32" ? ["/c", "start", "", url] : [url];

108 const child = spawn(command, args, { stdio: "ignore", detached: true });

109 child.unref();

110 return Promise.resolve();

111}

112function randomBase64url(bytes) {

113 return randomBytes(bytes).toString("base64url");

114}

115function sha256Base64url(value) {

116 return createHash("sha256").update(value).digest("base64url");

117}

118function apiBase(value) {

119 return (value || process.env.FUDGE_API_BASE || "https://api.withfudge.com").replace(/\/+$/, "");

120}

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/ops/login.jsView on unpkg · L107

121function loginError(code, message) {

122 const error = new Error(message);

123 Object.assign(error, { code });

124 return error;

125}

126function escapeHtml(value) {

127 return value.replace(/[&<>"']/g, (char) => ({