registry  /  cssgraph  /  0.3.2

cssgraph@0.3.2

CSS intelligence for AI coding agents — surgical style context, fewer tool calls, faster answers. 100% local.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemShell
Supply chain
HighEntropyStringsUrlStrings
ManifestNo manifest risk signals triggered.
scanned 53 file(s), 365 KB of source, external domains: docs.claude.com, docs.cursor.com, github.com, google-gemini.github.io, opencode.ai

Source & flagged code

4 flagged · loading source
dist/installer/index.jsView file
52exports.runUninstaller = runUninstaller; L53: const child_process_1 = require("child_process"); L54: const path = __importStar(require("path"));
High
Child Process

Package source references child process execution.

dist/installer/index.jsView on unpkg · L52
106try { L107: (0, child_process_1.execSync)('npm install -g cssgraph', { stdio: 'pipe', windowsHide: true }); L108: s.stop('Installed cssgraph CLI on PATH');
High
Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/installer/index.jsView on unpkg · L106
60// eslint-disable-next-line @typescript-eslint/no-implied-eval L61: const importESM = new Function('specifier', 'return import(specifier)'); L62: function getVersion() {
Low
Eval

Package source references a known benign dynamic code generation pattern.

dist/installer/index.jsView on unpkg · L60
dist/project-config.jsView file
43exports.extractCodeTokens = extractCodeTokens; L44: const path = __importStar(require("path")); L45: const fs = __importStar(require("fs"));
Medium
Dynamic Require

Package source references dynamic require/import behavior.

dist/project-config.jsView on unpkg · L43

Findings

3 High3 Medium5 Low
HighChild Processdist/installer/index.js
HighShell
HighRuntime Package Installdist/installer/index.js
MediumDynamic Requiredist/project-config.js
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowEvaldist/installer/index.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings