registry / cssgraph / 0.3.2

cssgraph@0.3.2

CSS intelligence for AI coding agents — surgical style context, fewer tool calls, faster answers. 100% local.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 53 file(s), 365 KB of source, external domains: docs.claude.com, docs.cursor.com, github.com, google-gemini.github.io, opencode.ai

Source & flagged code

4 flagged

dist/installer/index.jsView file

Lines 32-126javascript

32 var ownKeys = function(o) {

33 ownKeys = Object.getOwnPropertyNames || function (o) {

34 var ar = [];

35 for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;

36 return ar;

37 };

38 return ownKeys(o);

39 };

40 return function (mod) {

41 if (mod && mod.__esModule) return mod;

42 var result = {};

43 if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);

44 __setModuleDefault(result, mod);

45 return result;

46 };

47})();

48Object.defineProperty(exports, "__esModule", { value: true });

49exports.runInstaller = runInstaller;

50exports.runInstallerWithOptions = runInstallerWithOptions;

51exports.uninstallTargets = uninstallTargets;

52exports.runUninstaller = runUninstaller;

53const child_process_1 = require("child_process");

54const path = __importStar(require("path"));

High

Child Process

Package source references child process execution.

dist/installer/index.jsView on unpkg · L52

55const fs = __importStar(require("fs"));

56const os = __importStar(require("os"));

57const registry_1 = require("./targets/registry");

58// Dynamic import helper — tsc compiles import() to require() in CJS mode,

59// which fails for ESM-only packages. This bypasses the transformation.

60// eslint-disable-next-line @typescript-eslint/no-implied-eval

61const importESM = new Function('specifier', 'return import(specifier)');

62function getVersion() {

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/installer/index.jsView on unpkg · L60

63 try {

64 const packageJsonPath = path.join(__dirname, '..', '..', 'package.json');

65 const packageJson = JSON.parse(fs.readFileSync(packageJsonPath, 'utf-8'));

66 return packageJson.version;

67 }

68 catch {

69 return '0.1.0';

70 }

71}

72/**

73 * Interactive entry point — preserves the existing UX (`cssgraph

74 * install` with no args goes through the prompts), but now starts

75 * the targets multi-select pre-populated with detected agents.

76 */

77async function runInstaller() {

78 return runInstallerWithOptions({});

79}

80async function runInstallerWithOptions(opts) {

86 // they're committing to before we touch npm or disk.

87 const detectionLocation = opts.location ?? 'global';

88 const targets = await resolveTargets(clack, opts, detectionLocation, useDefaults);

89 if (targets.length === 0) {

90 clack.outro('No agent targets selected — nothing to do.');

91 return;

92 }

93 // Step 2: install the cssgraph npm package on PATH. Skipped when --yes.

94 if (!useDefaults) {

95 const shouldInstallGlobally = await clack.confirm({

96 message: 'Install the cssgraph CLI on your PATH? (Required so agents can launch the MCP server)',

97 initialValue: true,

98 });

99 if (clack.isCancel(shouldInstallGlobally)) {

100 clack.cancel('Installation cancelled.');

101 process.exit(0);

102 }

103 if (shouldInstallGlobally) {

104 const s = clack.spinner();

105 s.start('Installing cssgraph CLI...');

106 try {

107 (0, child_process_1.execSync)('npm install -g cssgraph', { stdio: 'pipe', windowsHide: true });

108 s.stop('Installed cssgraph CLI on PATH');

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/installer/index.jsView on unpkg · L106

109 }

110 catch {

111 s.stop('Could not install (permission denied)');

112 clack.log.warn('Try: sudo npm install -g cssgraph');

113 }

114 }

115 else {

116 clack.log.info('Skipped CLI install — agents will not be able to launch the MCP server without it');

117 }

118 }

119 // Step 3: where the per-agent config files should land.

120 let location;

121 if (opts.location) {

122 location = opts.location;

123 }

124 else if (useDefaults) {

125 location = 'global';

126 }

dist/project-config.jsView file

Lines 23-63javascript

23 return ar;

24 };

25 return ownKeys(o);

26 };

27 return function (mod) {

28 if (mod && mod.__esModule) return mod;

29 var result =

Source & flagged code

4 flagged · loading source

dist/installer/index.jsView file

52exports.runUninstaller = runUninstaller; L53: const child_process_1 = require("child_process"); L54: const path = __importStar(require("path"));

High

Child Process

Package source references child process execution.

dist/installer/index.jsView on unpkg · L52

106try { L107: (0, child_process_1.execSync)('npm install -g cssgraph', { stdio: 'pipe', windowsHide: true }); L108: s.stop('Installed cssgraph CLI on PATH');

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/installer/index.jsView on unpkg · L106

60// eslint-disable-next-line @typescript-eslint/no-implied-eval L61: const importESM = new Function('specifier', 'return import(specifier)'); L62: function getVersion() {

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/installer/index.jsView on unpkg · L60

dist/project-config.jsView file

43exports.extractCodeTokens = extractCodeTokens; L44: const path = __importStar(require("path")); L45: const fs = __importStar(require("fs"));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/project-config.jsView on unpkg · L43

Findings

3 High3 Medium5 Low

HighChild Processdist/installer/index.js

HighShell

HighRuntime Package Installdist/installer/index.js

MediumDynamic Requiredist/project-config.js

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvaldist/installer/index.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

dist/installer/index.jsView file

Lines 32-126javascript

32 var ownKeys = function(o) {

33 ownKeys = Object.getOwnPropertyNames || function (o) {

34 var ar = [];

35 for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;

36 return ar;

37 };

38 return ownKeys(o);

39 };

40 return function (mod) {

41 if (mod && mod.__esModule) return mod;

42 var result = {};

43 if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);

44 __setModuleDefault(result, mod);

45 return result;

46 };

47})();

48Object.defineProperty(exports, "__esModule", { value: true });

49exports.runInstaller = runInstaller;

50exports.runInstallerWithOptions = runInstallerWithOptions;

51exports.uninstallTargets = uninstallTargets;

52exports.runUninstaller = runUninstaller;

53const child_process_1 = require("child_process");

54const path = __importStar(require("path"));

High

Child Process

Package source references child process execution.

dist/installer/index.jsView on unpkg · L52

55const fs = __importStar(require("fs"));

56const os = __importStar(require("os"));

57const registry_1 = require("./targets/registry");

58// Dynamic import helper — tsc compiles import() to require() in CJS mode,

59// which fails for ESM-only packages. This bypasses the transformation.

60// eslint-disable-next-line @typescript-eslint/no-implied-eval

61const importESM = new Function('specifier', 'return import(specifier)');

62function getVersion() {

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/installer/index.jsView on unpkg · L60

63 try {

64 const packageJsonPath = path.join(__dirname, '..', '..', 'package.json');

65 const packageJson = JSON.parse(fs.readFileSync(packageJsonPath, 'utf-8'));

66 return packageJson.version;

67 }

68 catch {

69 return '0.1.0';

70 }

71}

72/**

73 * Interactive entry point — preserves the existing UX (`cssgraph

74 * install` with no args goes through the prompts), but now starts

75 * the targets multi-select pre-populated with detected agents.

76 */

77async function runInstaller() {

78 return runInstallerWithOptions({});

79}

80async function runInstallerWithOptions(opts) {

86 // they're committing to before we touch npm or disk.

87 const detectionLocation = opts.location ?? 'global';

88 const targets = await resolveTargets(clack, opts, detectionLocation, useDefaults);

89 if (targets.length === 0) {

90 clack.outro('No agent targets selected — nothing to do.');

91 return;

92 }

93 // Step 2: install the cssgraph npm package on PATH. Skipped when --yes.

94 if (!useDefaults) {

95 const shouldInstallGlobally = await clack.confirm({

96 message: 'Install the cssgraph CLI on your PATH? (Required so agents can launch the MCP server)',

97 initialValue: true,

98 });

99 if (clack.isCancel(shouldInstallGlobally)) {

100 clack.cancel('Installation cancelled.');

101 process.exit(0);

102 }

103 if (shouldInstallGlobally) {

104 const s = clack.spinner();

105 s.start('Installing cssgraph CLI...');

106 try {

107 (0, child_process_1.execSync)('npm install -g cssgraph', { stdio: 'pipe', windowsHide: true });

108 s.stop('Installed cssgraph CLI on PATH');

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/installer/index.jsView on unpkg · L106

109 }

110 catch {

111 s.stop('Could not install (permission denied)');

112 clack.log.warn('Try: sudo npm install -g cssgraph');

113 }

114 }

115 else {

116 clack.log.info('Skipped CLI install — agents will not be able to launch the MCP server without it');

117 }

118 }

119 // Step 3: where the per-agent config files should land.

120 let location;

121 if (opts.location) {

122 location = opts.location;

123 }

124 else if (useDefaults) {

125 location = 'global';

126 }

dist/project-config.jsView file

Lines 23-63javascript

23 return ar;

24 };

25 return ownKeys(o);

26 };

27 return function (mod) {

28 if (mod && mod.__esModule) return mod;

29 var result =