registry / benjamin-docs / 0.11.0

benjamin-docs@0.11.0

Persistent project memory for AI coding agents. Session hooks load it into Claude Code, Codex, and Cursor automatically; drift detection flags docs that fell behind the code.

Static Scan Results

scanned 12h ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 9 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 35 file(s), 279 KB of source, external domains: registry.npmjs.org

Source & flagged code

2 flagged

dist/src/export.jsView file

Lines 1-21javascript

1import { execFileSync } from "node:child_process";

2import { existsSync, readFileSync, rmSync } from "node:fs";

High

Child Process

Package source references child process execution.

dist/src/export.jsView on unpkg · L1

3import { CONFIG_DIR, KNOWN_AUDIENCES, MANIFEST_FILE, SCOPES_FILE } from "./constants.js";

4import { assertGeneratedPathSafe, ensureGeneratedDir, lstatIfExists, readGeneratedJson, rootPath, writeGeneratedText } from "./fsx.js";

5import { parseMarkdown, serializeMarkdown } from "./frontmatter.js";

6import { readConfig } from "./project-config.js";

7import { today } from "./templates.js";

8import { validateProject } from "./validate.js";

9const DEFAULT_BLOCKED_PHRASES = [

10 "AGENTS.md",

11 "agent-only",

12 "api key",

13 "internal only",

14 "password",

15 "private key",

16 "process.env",

17 "secret",

18 "stack trace",

19 "token",

20 ".env",

21];

dist/src/update-check.jsView file

Lines 1-21javascript

1import { spawn } from "node:child_process";

2import { mkdirSync, readFileSync, writeFileSync } from "node:fs";

3import { homedir } from "node:os";

4import { dirname, join, resolve } from "node:path";

5import { getPackageVersion } from "./info.js";

Source & flagged code

2 flagged · loading source

dist/src/export.jsView file

1import { execFileSync } from "node:child_process"; L2: import { existsSync, readFileSync, rmSync } from "node:fs";

High

Child Process

Package source references child process execution.

dist/src/export.jsView on unpkg · L1

dist/src/update-check.jsView file

1import { spawn } from "node:child_process"; L2: import { mkdirSync, readFileSync, writeFileSync } from "node:fs"; ... L7: const FETCH_TIMEOUT_MS = 3000; L8: const DEFAULT_REGISTRY_URL = "https://registry.npmjs.org/benjamin-docs/latest"; L9: export function updateChecksEnabled() { L10: return process.env.BENJAMIN_DOCS_NO_UPDATE_CHECK !== "1"; L11: }

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/src/update-check.jsView on unpkg · L1

Findings

3 High2 Medium4 Low

HighChild Processdist/src/export.js

HighShell

HighSame File Env Network Executiondist/src/update-check.js

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

dist/src/export.jsView file

Lines 1-21javascript

1import { execFileSync } from "node:child_process";

2import { existsSync, readFileSync, rmSync } from "node:fs";

High

Child Process

Package source references child process execution.

dist/src/export.jsView on unpkg · L1

3import { CONFIG_DIR, KNOWN_AUDIENCES, MANIFEST_FILE, SCOPES_FILE } from "./constants.js";

4import { assertGeneratedPathSafe, ensureGeneratedDir, lstatIfExists, readGeneratedJson, rootPath, writeGeneratedText } from "./fsx.js";

5import { parseMarkdown, serializeMarkdown } from "./frontmatter.js";

6import { readConfig } from "./project-config.js";

7import { today } from "./templates.js";

8import { validateProject } from "./validate.js";

9const DEFAULT_BLOCKED_PHRASES = [

10 "AGENTS.md",

11 "agent-only",

12 "api key",

13 "internal only",

14 "password",

15 "private key",

16 "process.env",

17 "secret",

18 "stack trace",

19 "token",

20 ".env",

21];

dist/src/update-check.jsView file

Lines 1-21javascript

1import { spawn } from "node:child_process";

2import { mkdirSync, readFileSync, writeFileSync } from "node:fs";

3import { homedir } from "node:os";

4import { dirname, join, resolve } from "node:path";

5import { getPackageVersion } from "./info.js";