registry / dokugen / 14.0.5

dokugen@14.0.5

⚠ Under review

Readme generator command line tool.

Static Scan Results

scanned 3mo ago · by rust-scanner

Static analysis flagged 16 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 17 file(s), 104 KB of source, external domains: api.myhappr.com, dokugen.samueltuoyo.com, github.com, linkedin.com, myhappr.com, registry.npmjs.org, unlicense.org, www.apache.org, www.gnu.org, www.google.com, x.com

Source & flagged code

9 flagged

package.jsonView file

•scripts.postinstall = node dist/scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•Runtime dependency names matching Node built-ins: fs

High

Node Builtin Dependency Squat

Package declares a runtime dependency whose name matches a Node built-in module.

package.jsonView on unpkg

•scripts.postinstall = node dist/scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/bin/commands/aic.mjsView file

1import { execSync, spawnSync } from "child_process"; L2: import chalk from "chalk";

High

Child Process

Package source references child process execution.

dist/bin/commands/aic.mjsView on unpkg · L1

dist/bin/helpers/readme.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = dokugen@14.0.1 matchedIdentity = npm:ZG9rdWdlbg:14.0.1 similarity = 0.706 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/bin/helpers/readme.mjsView on unpkg

38else if (platform === "win32") { L39: // Escape special shell characters to prevent cmd.exe from splitting the URL at '&' L40: const escapedUrl = url.replace(/[&^<>|]/g, "^$&");

High

Shell

Package source references shell execution.

dist/bin/helpers/readme.mjsView on unpkg · L38

3import chalk from "chalk"; L4: import axios from "axios"; L5: import { execFile } from "child_process"; L6: import { createSpinner } from "nanospinner"; ... L13: function terminalLink(text, url) { L14: const supports = !!(process.env.FORCE_HYPERLINK === "1" || L15: (process.stdout.isTTY &&

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/bin/helpers/readme.mjsView on unpkg · L3

dist/bin/helpers/fileOps.mjsView file

5import os from "os"; L6: const DOKUGEN_HOME = path.join(os.homedir(), ".dokugen"); L7: function projectKey(projectDir) { ... L255: "*.lib", L256: "package-lock.json", L257: "yarn.lock",

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/bin/helpers/fileOps.mjsView on unpkg · L5

dist/bin/helpers/network.mjsView file

47try { L48: execSync("npm install -g dokugen@latest --ignore-scripts", { L49: stdio: "pipe",

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/bin/helpers/network.mjsView on unpkg · L47

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node dist/scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•Runtime dependency names matching Node built-ins: fs

High

Node Builtin Dependency Squat

Package declares a runtime dependency whose name matches a Node built-in module.

package.jsonView on unpkg

•scripts.postinstall = node dist/scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/bin/commands/aic.mjsView file

Findings

1 Critical6 High4 Medium5 Low

CriticalPrevious Version Dangerous Deltadist/bin/helpers/readme.mjs

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/bin/commands/aic.mjs

HighShelldist/bin/helpers/readme.mjs

HighSame File Env Network Executiondist/bin/helpers/readme.mjs

HighRuntime Package Installdist/bin/helpers/network.mjs

HighNode Builtin Dependency Squatpackage.json

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowWeak Cryptodist/bin/helpers/fileOps.mjs

Affected versions and remediation

This report applies to dokugen@14.0.5.

See all versions of dokugen for other recorded verdicts.

Review the evidence and your use of dokugen@14.0.5 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-07-18 15:00:59.374Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.