registry / @wrongstack/plugins / 0.281.3

@wrongstack/plugins@0.281.3

⚠ Under review

Official WrongStack plugin collection — auto-doc, git-autocommit, shell-check, cost-tracker, file-watcher, cron, template-engine, semver-bump, secret-scanner, todo-tracker, token-budget, lint-gate, branch-guard, diff-summary, commit-validator, format-on-s

Static Scan Results

scanned 2d ago · by rust-scanner

Static analysis flagged 10 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 37 file(s), 741 KB of source, external domains: keepachangelog.com

Source & flagged code

3 flagged

dist/format-on-save.jsView file

Lines 1-59javascript

1import { execSync } from 'child_process';

2import { existsSync, statSync } from 'fs';

High

Child Process

Package source references child process execution.

dist/format-on-save.jsView on unpkg · L1

4// src/format-on-save/index.ts

5var API_VERSION = "^0.1.10";

6var state = {

7 invocationCount: 0,

8 /** Times formatting was applied (file changed). */

9 formattedCount: 0,

10 /** Times the file was already formatted (no change). */

11 cleanCount: 0,

12 /** Times biome failed (not installed, timeout, parse error). */

13 errorCount: 0,

14 /** Hook handle for teardown. */

15 hookUnregister: null,

16 /** Last format result — surfaced by health() + status tool. */

17 lastResult: null

18};

19var DEFAULTS = {

20 enabled: true,

21 timeoutMs: 5e3

22};

23function readConfig(raw) {

24 if (!raw || typeof raw !== "object") return { ...DEFAULTS };

25 const r = raw;

26 return {

27 enabled: r["enabled"] !== false,

28 timeoutMs: typeof r["timeoutMs"] === "number" && r["timeoutMs"] > 0 ? r["timeoutMs"] : DEFAULTS.timeoutMs

29 };

30}

31function formatFile(filePath, timeoutMs) {

32 if (!existsSync(filePath)) return null;

33 let bytesBefore;

34 try {

35 bytesBefore = statSync(filePath).size;

36 } catch {

37 return null;

38 }

39 try {

40 execSync(`npx biome format --write "${filePath}"`, {

41 encoding: "utf-8",

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/format-on-save.jsView on unpkg · L39

42 timeout: timeoutMs,

43 cwd: process.cwd(),

44 stdio: ["pipe", "pipe", "pipe"]

45 });

46 } catch (err) {

47 const e = err;

48 if (e.killed) return null;

49 }

50 let bytesAfter;

51 try {

52 bytesAfter = statSync(filePath).size;

53 } catch {

54 return null;

55 }

56 if (bytesAfter !== bytesBefore) {

57 return { changed: true, bytesBefore, bytesAfter };

58 }

59 try {

dist/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @wrongstack/plugins@0.281.0 matchedIdentity = npm:QHdyb25nc3RhY2svcGx1Z2lucw:0.281.0 similarity = 0.703 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg

Source & flagged code

3 flagged · loading source

dist/format-on-save.jsView file

1import { execSync } from 'child_process'; L2: import { existsSync, statSync } from 'fs';

High

Child Process

Package source references child process execution.

dist/format-on-save.jsView on unpkg · L1

39try { L40: execSync(`npx biome format --write "${filePath}"`, { L41: encoding: "utf-8",

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/format-on-save.jsView on unpkg · L39

dist/index.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg

Findings

1 Critical3 High2 Medium4 Low

CriticalPrevious Version Dangerous Deltadist/index.js

HighChild Processdist/format-on-save.js

HighShell

HighRuntime Package Installdist/format-on-save.js

MediumNetwork

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

dist/format-on-save.jsView file

Lines 1-59javascript

1import { execSync } from 'child_process';

2import { existsSync, statSync } from 'fs';

High

Child Process

Package source references child process execution.

dist/format-on-save.jsView on unpkg · L1

4// src/format-on-save/index.ts

5var API_VERSION = "^0.1.10";

6var state = {

7 invocationCount: 0,

8 /** Times formatting was applied (file changed). */

9 formattedCount: 0,

10 /** Times the file was already formatted (no change). */

11 cleanCount: 0,

12 /** Times biome failed (not installed, timeout, parse error). */

13 errorCount: 0,

14 /** Hook handle for teardown. */

15 hookUnregister: null,

16 /** Last format result — surfaced by health() + status tool. */

17 lastResult: null

18};

19var DEFAULTS = {

20 enabled: true,

21 timeoutMs: 5e3

22};

23function readConfig(raw) {

24 if (!raw || typeof raw !== "object") return { ...DEFAULTS };

25 const r = raw;

26 return {

27 enabled: r["enabled"] !== false,

28 timeoutMs: typeof r["timeoutMs"] === "number" && r["timeoutMs"] > 0 ? r["timeoutMs"] : DEFAULTS.timeoutMs

29 };

30}

31function formatFile(filePath, timeoutMs) {

32 if (!existsSync(filePath)) return null;

33 let bytesBefore;

34 try {

35 bytesBefore = statSync(filePath).size;

36 } catch {

37 return null;

38 }

39 try {

40 execSync(`npx biome format --write "${filePath}"`, {

41 encoding: "utf-8",

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/format-on-save.jsView on unpkg · L39

42 timeout: timeoutMs,

43 cwd: process.cwd(),

44 stdio: ["pipe", "pipe", "pipe"]

45 });

46 } catch (err) {

47 const e = err;

48 if (e.killed) return null;

49 }

50 let bytesAfter;

51 try {

52 bytesAfter = statSync(filePath).size;

53 } catch {

54 return null;

55 }

56 if (bytesAfter !== bytesBefore) {

57 return { changed: true, bytesBefore, bytesAfter };

58 }

59 try {

dist/index.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg