registry / darkmode-plus-a11y / 0.2.0

darkmode-plus-a11y@0.2.0

Dark mode plus 14 more accessible themes (high contrast, color-vision deficiency, anti-glare), generated from your light theme at Sass compile time — with WCAG contrast enforced mechanically, accessible fonts, and a scaffolded accessibility menu.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessFilesystemShell

Supply chain

HighEntropyStrings

Manifest

CopyleftLicense

scanned 34 file(s), 116 KB of source

Source & flagged code

3 flagged

bin/cli.mjsView file

Lines 1-36javascript

1#!/usr/bin/env node

2/** @format */

4// Scaffolding CLI — shadcn model: copies the UI (trigger + card +

5// SCSS + config) INTO the consumer's project, which then owns it. Pure

6// Node, no extra dependency.

7//

8// init Copies the templates + AGENTS.md into <dir> (default ./a11y).

9// init --diff Compares the local copy against the package's reference.

10// audit Name-based HC semantic inspector (runs dist/testing/run-audit.js).

11//

12// init options: --dir <path> --pkg <import-name> --fonts <path> --force

13// audit options: --entry <scss> [--load-path <p>]… [--themes a,b]

14// [--waive "regex=reason"]… [--out report.md] [--strict]

16import { readFileSync, writeFileSync, copyFileSync, mkdirSync, existsSync, readdirSync } from "node:fs";

17import { spawnSync } from "node:child_process";

18import { dirname, join, resolve, relative } from "node:path";

High

Child Process

Package source references child process execution.

bin/cli.mjsView on unpkg · L16

19import { fileURLToPath } from "node:url";

21const HERE = dirname(fileURLToPath(import.meta.url));

22const PKG_ROOT = resolve(HERE, "..");

23const TEMPLATES = join(PKG_ROOT, "templates");

24const FONTS_SRC = join(PKG_ROOT, "fonts", "files");

26// Docs copied from the package ROOT alongside the templates (single

27// source: the same AGENTS.md serves the installed package and the copy).

28const ROOT_DOCS = ["AGENTS.md"];

30// Import name used INSIDE the templates (the published name); only

31// rewritten when the consumer installed under a different name (--pkg).

32const SOURCE_IMPORT = "darkmode-plus-a11y";

34const C = {

35 reset: "\x1b[0m", bold: "\x1b[1m", dim: "\x1b[2m",

36 green: "\x1b[32m", yellow: "\x1b[33m", red: "\x1b[31m", cyan: "\x1b[36m",

Lines 143-183javascript

143 } else {

144 same++;

145 }

146 }

147

148 console.log(`\n${nw} new, ${mod} modified, ${same} unchanged.`);

149 if (nw

fonts/files/Andika-Bold.woff2View file

•path = fonts/files/Andika-Bold.woff2 kind = high_entropy_blob sizeBytes = 274976 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

fonts/files/Andika-Bold.woff2View on unpkg

Source & flagged code

3 flagged · loading source

bin/cli.mjsView file

16import { readFileSync, writeFileSync, copyFileSync, mkdirSync, existsSync, readdirSync } from "node:fs"; L17: import { spawnSync } from "node:child_process"; L18: import { dirname, join, resolve, relative } from "node:path";

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code