registry / @wrongstack/plugins / 0.280.0

@wrongstack/plugins@0.280.0

Official WrongStack plugin collection — auto-doc, git-autocommit, shell-check, cost-tracker, file-watcher, cron, template-engine, semver-bump, secret-scanner, todo-tracker, token-budget, lint-gate, branch-guard, diff-summary, commit-validator, format-on-s

Static Scan Results

scanned 4d ago · by rust-scanner

Static analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 37 file(s), 729 KB of source, external domains: keepachangelog.com

Source & flagged code

2 flagged

dist/format-on-save.jsView file

Lines 1-59javascript

1import { execSync } from 'child_process';

2import { existsSync, statSync } from 'fs';

High

Child Process

Package source references child process execution.

dist/format-on-save.jsView on unpkg · L1

4// src/format-on-save/index.ts

5var API_VERSION = "^0.1.10";

6var state = {

7 invocationCount: 0,

8 /** Times formatting was applied (file changed). */

9 formattedCount: 0,

10 /** Times the file was already formatted (no change). */

11 cleanCount: 0,

12 /** Times biome failed (not installed, timeout, parse error). */

13 errorCount: 0,

14 /** Hook handle for teardown. */

15 hookUnregister: null,

16 /** Last format result — surfaced by health() + status tool. */

17 lastResult: null

18};

19var DEFAULTS = {

20 enabled: true,

21 timeoutMs: 5e3

22};

23function readConfig(raw) {

24 if (!raw || typeof raw !== "object") return { ...DEFAULTS };

25 const r = raw;

26 return {

27 enabled: r["enabled"] !== false,

28 timeoutMs: typeof r["timeoutMs"] === "number" && r["timeoutMs"] > 0 ? r["timeoutMs"] : DEFAULTS.timeoutMs

29 };

30}

31function formatFile(filePath, timeoutMs) {

32 if (!existsSync(filePath)) return null;

33 let bytesBefore;

34 try {

35 bytesBefore = statSync(filePath).size;

36 } catch {

37 return null;

38 }

39 try {

40 execSync(`npx biome format --write "${filePath}"`, {

41 encoding: "utf-8",

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/format-on-save.jsView on unpkg · L39

42 timeout: timeoutMs,

43 cwd: process.cwd(),

44 stdio: ["pipe", "pipe", "pipe"]

45 });

46 } catch (err) {

47 const e = err;

48 if (e.killed) return null;

49 }

50 let bytesAfter;

51 try {

52 bytesAfter = statSync(filePath).size;

53 } catch {

54 return null;

55 }

56 if (bytesAfter !== bytesBefore) {

57 return { changed: true, bytesBefore, bytesAfter };

58 }

59 try {

Source & flagged code

2 flagged · loading source

dist/format-on-save.jsView file

1import { execSync } from 'child_process'; L2: import { existsSync, statSync } from 'fs';

High

Child Process

Package source references child process execution.

dist/format-on-save.jsView on unpkg · L1

39try { L40: execSync(`npx biome format --write "${filePath}"`, { L41: encoding: "utf-8",

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/format-on-save.jsView on unpkg · L39

Findings

3 High2 Medium4 Low

HighChild Processdist/format-on-save.js

HighShell

HighRuntime Package Installdist/format-on-save.js

MediumNetwork

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

dist/format-on-save.jsView file

Lines 1-59javascript

1import { execSync } from 'child_process';

2import { existsSync, statSync } from 'fs';

High

Child Process

Package source references child process execution.

dist/format-on-save.jsView on unpkg · L1

4// src/format-on-save/index.ts

5var API_VERSION = "^0.1.10";

6var state = {

7 invocationCount: 0,

8 /** Times formatting was applied (file changed). */

9 formattedCount: 0,

10 /** Times the file was already formatted (no change). */

11 cleanCount: 0,

12 /** Times biome failed (not installed, timeout, parse error). */

13 errorCount: 0,

14 /** Hook handle for teardown. */

15 hookUnregister: null,

16 /** Last format result — surfaced by health() + status tool. */

17 lastResult: null

18};

19var DEFAULTS = {

20 enabled: true,

21 timeoutMs: 5e3

22};

23function readConfig(raw) {

24 if (!raw || typeof raw !== "object") return { ...DEFAULTS };

25 const r = raw;

26 return {

27 enabled: r["enabled"] !== false,

28 timeoutMs: typeof r["timeoutMs"] === "number" && r["timeoutMs"] > 0 ? r["timeoutMs"] : DEFAULTS.timeoutMs

29 };

30}

31function formatFile(filePath, timeoutMs) {

32 if (!existsSync(filePath)) return null;

33 let bytesBefore;

34 try {

35 bytesBefore = statSync(filePath).size;

36 } catch {

37 return null;

38 }

39 try {

40 execSync(`npx biome format --write "${filePath}"`, {

41 encoding: "utf-8",

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/format-on-save.jsView on unpkg · L39

42 timeout: timeoutMs,

43 cwd: process.cwd(),

44 stdio: ["pipe", "pipe", "pipe"]

45 });

46 } catch (err) {

47 const e = err;

48 if (e.killed) return null;

49 }

50 let bytesAfter;

51 try {

52 bytesAfter = statSync(filePath).size;

53 } catch {

54 return null;

55 }

56 if (bytesAfter !== bytesBefore) {

57 return { changed: true, bytesBefore, bytesAfter };

58 }

59 try {