registry / @wrongstack/plugins / 0.282.2

@wrongstack/plugins@0.282.2

⚠ Under review

Official WrongStack plugin collection — 62 focused, single-purpose plugins for code quality, security, observability, planning, and agent coordination

Static Scan Results

scanned 4h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 64 file(s), 1.32 MB of source, external domains: keepachangelog.com

Source & flagged code

3 flagged

dist/format-on-save.jsView file

Lines 1-21javascript

1import { execSync, execFileSync } from 'child_process';

2import { existsSync, statSync } from 'fs';

High

Child Process

Package source references child process execution.

dist/format-on-save.jsView on unpkg · L1

3import { isAbsolute, resolve, relative } from 'path';

5// src/format-on-save/index.ts

6var API_VERSION = "^0.1.10";

7function withinProject(p) {

8 if (typeof p !== "string" || p.length === 0 || p.length > 4096) return false;

9 const root = process.cwd();

10 const resolved = isAbsolute(p) ? resolve(p) : resolve(root, p);

11 const rel = relative(root, resolved);

12 if (rel === "" || rel === ".") return true;

13 if (rel.startsWith("..")) return false;

14 if (isAbsolute(rel)) return false;

15 return true;

16}

17var state = {

18 invocationCount: 0,

19 /** Times formatting was applied (file changed). */

20 formattedCount: 0,

21 /** Times the file was already formatted (no change). */

Lines 63-103javascript

63 } catch {

64 }

65 state.patternUnregister = null;

66 }

67}

68function evictExpired(ttlMs) {

69 const cutoff = Date.now() - ttlMs;

70 for (const

dist/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @wrongstack/plugins@0.282.0 matchedIdentity = npm:QHdyb25nc3RhY2svcGx1Z2lucw:0.282.0 similarity = 0.891 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg

Source & flagged code

3 flagged · loading source

dist/format-on-save.jsView file

1import { execSync, execFileSync } from 'child_process'; L2: import { existsSync, statSync } from 'fs';

High

Child Process

Package source references child process execution.

dist/format-on-save.jsView on unpkg · L1

83try { L84: execFileSync("npx", ["biome", "format", "--write", filePath], { L85: encoding: "utf-8",

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/format-on-save.jsView on unpkg · L83

dist/index.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg

Findings

1 Critical3 High2 Medium4 Low

CriticalPrevious Version Dangerous Deltadist/index.js

HighChild Processdist/format-on-save.js

HighShell

HighRuntime Package Installdist/format-on-save.js

MediumNetwork

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

dist/format-on-save.jsView file

Lines 1-21javascript

1import { execSync, execFileSync } from 'child_process';

2import { existsSync, statSync } from 'fs';

High

Child Process

Package source references child process execution.

dist/format-on-save.jsView on unpkg · L1

3import { isAbsolute, resolve, relative } from 'path';

5// src/format-on-save/index.ts

6var API_VERSION = "^0.1.10";

7function withinProject(p) {

8 if (typeof p !== "string" || p.length === 0 || p.length > 4096) return false;

9 const root = process.cwd();

10 const resolved = isAbsolute(p) ? resolve(p) : resolve(root, p);

11 const rel = relative(root, resolved);

12 if (rel === "" || rel === ".") return true;

13 if (rel.startsWith("..")) return false;

14 if (isAbsolute(rel)) return false;

15 return true;

16}

17var state = {

18 invocationCount: 0,

19 /** Times formatting was applied (file changed). */

20 formattedCount: 0,

21 /** Times the file was already formatted (no change). */

Lines 63-103javascript

63 } catch {

64 }

65 state.patternUnregister = null;

66 }

67}

68function evictExpired(ttlMs) {

69 const cutoff = Date.now() - ttlMs;

70 for (const

dist/index.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg