registry / dimcode-darwin-arm64 / 0.2.19

dimcode-darwin-arm64@0.2.19

dimcode binary for macOS ARM64 (Apple Silicon)

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireFilesystemShell

Supply chain

HighEntropyStrings

Manifest

NoLicense

scanned 1 file(s), 3.75 KB of source

Source & flagged code

6 flagged

bin/skills-assets/pdf/scripts/render_cover.jsView file

Lines 1-81javascript

1#!/usr/bin/env node

2/**

3 * render_cover.js — Render cover.html → cover.pdf via Playwright.

4 *

5 * Usage:

6 * node render_cover.js --input cover.html --out cover.pdf

7 * node render_cover.js --input cover.html --out cover.pdf --wait 1200

8 *

9 * Exit codes: 0 success, 1 bad args, 2 dependency missing, 3 render error

10 */

12const path = require("path");

13const fs = require("fs");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/skills-assets/pdf/scripts/render_cover.jsView on unpkg · L11

15function usage() {

16 console.error("Usage: node render_cover.js --input <file.html> --out <file.pdf> [--wait <ms>]");

17 process.exit(1);

18}

20// ── Arg parsing ────────────────────────────────────────────────────────────────

21const args = process.argv.slice(2);

22let inputFile = null, outFile = null, waitMs = 800;

24for (let i = 0; i < args.length; i++) {

25 if (args[i] === "--input" && args[i + 1]) { inputFile = args[++i]; }

26 else if (args[i] === "--out" && args[i + 1]) { outFile = args[++i]; }

27 else if (args[i] === "--wait" && args[i + 1]) { waitMs = parseInt(args[++i], 10); }

28}

30if (!inputFile || !outFile) usage();

31if (!fs.existsSync(inputFile)) {

32 console.error(JSON.stringify({ status: "error", error: `File not found: ${inputFile}` }));

33 process.exit(1);

34}

36// ── Playwright loader (tolerates global npm installs) ─────────────────────────

37function loadPlaywright() {

38 const { execSync } = require("child_process");

39 try { return require("playwright"); } catch (_) {}

High

Child Process

Package source references child process execution.

bin/skills-assets/pdf/scripts/render_cover.jsView on unpkg · L37

40 try {

41 const root = execSync("npm root -g", { stdio: ["ignore","pipe","ignore"] }).toString().trim();

42 return require(path.join(root, "playwright"));

43 } catch (_) {}

44 console.error(JSON.stringify({

45 status: "error",

46 error: "playwright not found",

47 hint: "Run: npm install -g playwright && npx playwright install chromium"

48 }));

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/skills-assets/pdf/scripts/render_cover.jsView on unpkg · L37

49 process.exit(2);

50}

52// ── Main ───────────────────────────────────────────────────────────────────────

53(async () => {

54 const { chromium } = loadPlaywright();

56 let browser;

57 try {

58 browser = await chromium.launch();

59 } catch (e) {

60 // Chromium binary missing — try installing

61 const { spawnSync } = require("child_process");

62 const r = spawnSync("npx", ["playwright", "install", "chromium"], { stdio: "inherit", shell: true });

63 if (r.status !== 0) {

High

Shell

Package source references shell execution.

bin/skills-assets/pdf/scripts/render_cover.jsView on unpkg · L61

64 console.error(JSON.stringify({

65 status: "error",

66 error: "Chromium not installed and auto-install failed",

67 hint: "Run: npx playwright install chromium"

68 }));

69 process.exit(2);

70 }

71 browser = await chromium.launch();

72 }

74 try {

75 const page = await browser.newPage();

76 const fileUrl = "file://" + path.resolve(inputFile);

77 await page.goto(fileUrl);

78 await page.waitForTimeout(waitMs); // let CSS + any JS settle

80 await page.pdf({

81 path: outFile,

bin/runtime/sandbox/dim-sandbox-runnerView file

•path = bin/runtime/sandbox/dim-sandbox-runner kind = native_binary sizeBytes = 16046176 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/runtime/sandbox/dim-sandbox-runnerView on unpkg

bin/skills-assets/xlsx/scripts/xlsx_reader.pyView file

•path = bin/skills-assets/xlsx/scripts/xlsx_reader.py kind = build_helper sizeBytes = 13545 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/skills-assets/xlsx/scripts/xlsx_reader.pyView on unpkg

Source & flagged code

6 flagged · loading source

bin/skills-assets/pdf/scripts/render_cover.jsView file

37function loadPlaywright() { L38: const { execSync } = require("child_process"); L39: try { return require("playwright"); } catch (_) {}

High

Child Process

Package source references child process execution.

bin/skills-assets/pdf/scripts/render_cover.jsView on unpkg · L37

61const { spawnSync } = require("child_process"); L62: const r = spawnSync("npx", ["playwright", "install", "chromium"], { stdio: "inherit", shell: true }); L63: if (r.status !== 0) {

High

Shell

Package source references shell execution.

bin/skills-assets/pdf/scripts/render_cover.jsView on unpkg · L61

37function loadPlaywright() { L38: const { execSync } = require("child_process"); L39: try { return require("playwright"); } catch (_) {} ... L46: error: "playwright not found", L47: hint: "Run: npm install -g playwright && npx playwright install chromium" L48: }));

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/skills-assets/pdf/scripts/render_cover.jsView on unpkg · L37

11L12: const path = require("path"); L13: const fs = require("fs");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/skills-assets/pdf/scripts/render_cover.jsView on unpkg · L11

bin/runtime/sandbox/dim-sandbox-runnerView file

•path = bin/runtime/sandbox/dim-sandbox-runner kind = native_binary sizeBytes = 16046176 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/runtime/sandbox/dim-sandbox-runnerView on unpkg

bin/skills-assets/xlsx/scripts/xlsx_reader.pyView file

•path = bin/skills-assets/xlsx/scripts/xlsx_reader.py kind = build_helper sizeBytes = 13545 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/skills-assets/xlsx/scripts/xlsx_reader.pyView on unpkg

Findings

3 High4 Medium3 Low

HighChild Processbin/skills-assets/pdf/scripts/render_cover.js

HighShellbin/skills-assets/pdf/scripts/render_cover.js

HighRuntime Package Installbin/skills-assets/pdf/scripts/render_cover.js

MediumDynamic Requirebin/skills-assets/pdf/scripts/render_cover.js

MediumShips Native Binarybin/runtime/sandbox/dim-sandbox-runner

MediumShips Build Helperbin/skills-assets/xlsx/scripts/xlsx_reader.py

MediumStructural Risk Force Deep Review

LowFilesystem

LowHigh Entropy Strings

LowNo License

Source & flagged code

6 flagged

bin/skills-assets/pdf/scripts/render_cover.jsView file

Lines 1-81javascript

1#!/usr/bin/env node

2/**

3 * render_cover.js — Render cover.html → cover.pdf via Playwright.

4 *

5 * Usage:

6 * node render_cover.js --input cover.html --out cover.pdf

7 * node render_cover.js --input cover.html --out cover.pdf --wait 1200

8 *

9 * Exit codes: 0 success, 1 bad args, 2 dependency missing, 3 render error

10 */

12const path = require("path");

13const fs = require("fs");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/skills-assets/pdf/scripts/render_cover.jsView on unpkg · L11

15function usage() {

16 console.error("Usage: node render_cover.js --input <file.html> --out <file.pdf> [--wait <ms>]");

17 process.exit(1);

18}

21const args = process.argv.slice(2);

22let inputFile = null, outFile = null, waitMs = 800;

24for (let i = 0; i < args.length; i++) {

25 if (args[i] === "--input" && args[i + 1]) { inputFile = args[++i]; }

26 else if (args[i] === "--out" && args[i + 1]) { outFile = args[++i]; }

27 else if (args[i] === "--wait" && args[i + 1]) { waitMs = parseInt(args[++i], 10); }

28}

30if (!inputFile || !outFile) usage();

31if (!fs.existsSync(inputFile)) {

32 console.error(JSON.stringify({ status: "error", error: `File not found: ${inputFile}` }));

33 process.exit(1);

34}

36// ── Playwright loader (tolerates global npm installs) ─────────────────────────

37function loadPlaywright() {

38 const { execSync } = require("child_process");

39 try { return require("playwright"); } catch (_) {}

High

Child Process

Package source references child process execution.

bin/skills-assets/pdf/scripts/render_cover.jsView on unpkg · L37

40 try {

41 const root = execSync("npm root -g", { stdio: ["ignore","pipe","ignore"] }).toString().trim();

42 return require(path.join(root, "playwright"));

43 } catch (_) {}

44 console.error(JSON.stringify({

45 status: "error",

46 error: "playwright not found",

47 hint: "Run: npm install -g playwright && npx playwright install chromium"

48 }));

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/skills-assets/pdf/scripts/render_cover.jsView on unpkg · L37

49 process.exit(2);

50}

53(async () => {

54 const { chromium } = loadPlaywright();

56 let browser;

57 try {

58 browser = await chromium.launch();

59 } catch (e) {

60 // Chromium binary missing — try installing

61 const { spawnSync } = require("child_process");

62 const r = spawnSync("npx", ["playwright", "install", "chromium"], { stdio: "inherit", shell: true });

63 if (r.status !== 0) {

High

Shell

Package source references shell execution.

bin/skills-assets/pdf/scripts/render_cover.jsView on unpkg · L61

64 console.error(JSON.stringify({

65 status: "error",

66 error: "Chromium not installed and auto-install failed",

67 hint: "Run: npx playwright install chromium"

68 }));

69 process.exit(2);

70 }

71 browser = await chromium.launch();

72 }

74 try {

75 const page = await browser.newPage();

76 const fileUrl = "file://" + path.resolve(inputFile);

77 await page.goto(fileUrl);

78 await page.waitForTimeout(waitMs); // let CSS + any JS settle

80 await page.pdf({

81 path: outFile,

bin/runtime/sandbox/dim-sandbox-runnerView file

•path = bin/runtime/sandbox/dim-sandbox-runner kind = native_binary sizeBytes = 16046176 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/runtime/sandbox/dim-sandbox-runnerView on unpkg

bin/skills-assets/xlsx/scripts/xlsx_reader.pyView file

•path = bin/skills-assets/xlsx/scripts/xlsx_reader.py kind = build_helper sizeBytes = 13545 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/skills-assets/xlsx/scripts/xlsx_reader.pyView on unpkg