registry / @wrongstack/plugins / 0.282.0

@wrongstack/plugins@0.282.0

Official WrongStack plugin collection — 62 focused, single-purpose plugins for code quality, security, observability, planning, and agent coordination

Static Scan Results

scanned 1d ago · by rust-scanner

Static analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 64 file(s), 1.32 MB of source, external domains: keepachangelog.com

Source & flagged code

2 flagged

dist/format-on-save.jsView file

Lines 1-21javascript

1import { execSync, execFileSync } from 'child_process';

2import { existsSync, statSync } from 'fs';

High

Child Process

Package source references child process execution.

dist/format-on-save.jsView on unpkg · L1

3import { isAbsolute, resolve, relative } from 'path';

5// src/format-on-save/index.ts

6var API_VERSION = "^0.1.10";

7function withinProject(p) {

8 if (typeof p !== "string" || p.length === 0 || p.length > 4096) return false;

9 const root = process.cwd();

10 const resolved = isAbsolute(p) ? resolve(p) : resolve(root, p);

11 const rel = relative(root, resolved);

12 if (rel === "" || rel === ".") return true;

13 if (rel.startsWith("..")) return false;

14 if (isAbsolute(rel)) return false;

15 return true;

16}

17var state = {

18 invocationCount: 0,

19 /** Times formatting was applied (file changed). */

20 formattedCount: 0,

21 /** Times the file was already formatted (no change). */

Lines 45-85javascript

45 skipWhenCoveredBy: r["skipWhenCoveredBy"] !== false,

46 skipTtlMs: typeof r["skipTtlMs"] === "number" && r["skipTtlMs"] >= 0 ? r["skipTtlMs"] : DEFAULTS.skipTtlMs

47 };

48}

Source & flagged code

2 flagged · loading source

dist/format-on-save.jsView file

1import { execSync, execFileSync } from 'child_process'; L2: import { existsSync, statSync } from 'fs';

High

Child Process

Package source references child process execution.

dist/format-on-save.jsView on unpkg · L1

65try { L66: execFileSync("npx", ["biome", "format", "--write", filePath], { L67: encoding: "utf-8",

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/format-on-save.jsView on unpkg · L65

Findings

3 High2 Medium4 Low

HighChild Processdist/format-on-save.js

HighShell

HighRuntime Package Installdist/format-on-save.js

MediumNetwork

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

dist/format-on-save.jsView file

Lines 1-21javascript

1import { execSync, execFileSync } from 'child_process';

2import { existsSync, statSync } from 'fs';

High

Child Process

Package source references child process execution.

dist/format-on-save.jsView on unpkg · L1

3import { isAbsolute, resolve, relative } from 'path';

5// src/format-on-save/index.ts

6var API_VERSION = "^0.1.10";

7function withinProject(p) {

8 if (typeof p !== "string" || p.length === 0 || p.length > 4096) return false;

9 const root = process.cwd();

10 const resolved = isAbsolute(p) ? resolve(p) : resolve(root, p);

11 const rel = relative(root, resolved);

12 if (rel === "" || rel === ".") return true;

13 if (rel.startsWith("..")) return false;

14 if (isAbsolute(rel)) return false;

15 return true;

16}

17var state = {

18 invocationCount: 0,

19 /** Times formatting was applied (file changed). */

20 formattedCount: 0,

21 /** Times the file was already formatted (no change). */

Lines 45-85javascript

45 skipWhenCoveredBy: r["skipWhenCoveredBy"] !== false,

46 skipTtlMs: typeof r["skipTtlMs"] === "number" && r["skipTtlMs"] >= 0 ? r["skipTtlMs"] : DEFAULTS.skipTtlMs

47 };

48}