domma-js@0.35.0: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

domma-js@0.35.0: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

4 flagged

package.jsonView file

Lines 18-58json

18 "public/dist/domma.esm.js",

19 "public/dist/domma.css",

20 "public/dist/bundles/",

21 "public/dist/elements.css",

22 "public/dist/grid.css",

23 "public/dist/syntax.css",

24 "public/dist/domma-syntax.min.js",

25 "public/dist/domma-flags.min.js",

26 "public/dist/domma-flags.esm.js",

27 "public/dist/themes/",

28 "assets/types/",

29 "LICENSE",

30 "README.md"

31 ],

32 "repository": {

33 "type": "git",

34 "url": "git+https://github.com/pinpointzero73/domma.git"

35 },

36 "type": "module",

37 "scripts": {

38 "postinstall": "node bin/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L38

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L38

39 "start": "node bin/domma-cli.js serve",

40 "serve": "node bin/domma-cli.js serve",

41 "serve:3096": "node bin/domma-cli.js serve --port 3096",

42 "dev": "NODE_ENV=development npm run generate:bundles && rollup -c && node scripts/build-info.js && npm run build:metadata && npm run copy:themes && npm run generate:themes && npm run build:css && npm run build:miniapps && live-server public --port=3001 --open=/index.html",

43 "dev:watch": "NODE_ENV=development npm run generate:bundles && rollup -c && node scripts/build-info.js && npm run build:metadata && npm run copy:themes && npm run generate:themes && npm run build:css && npm run build:miniapps && npm run watch:miniapps",

44 "build": "npm run generate:bundles && rollup -c && node scripts/build-info.js && npm run build:metadata && npm run copy:themes && npm run generate:themes && npm run build:css && npm run build:css-bundles && npm run build:archives && npm run build:kickstart-files && npm run build:miniapps",

45 "build:js": "rollup -c",

46 "build:css": "node scripts/build-css.js",

47 "validate:classes": "node scripts/validate-classes.js",

48 "validate:theme": "node scripts/validate-theme-contrast.js",

49 "validate": "npm run validate:classes && npm run validate:theme",

50 "build:css-bundles": "node scripts/build-css-bundles.js",

51 "build:archives": "node scripts/build-archives.js",

52 "build:kickstart-files": "node scripts/build-kickstart-files.js",

53 "build:info": "node scripts/build-info.js",

54 "build:metadata": "node scripts/copy-metadata.js",

55 "copy:themes": "node scripts/copy-theme-css.js",

56 "build:miniapps": "node scripts/build-miniapp.js && node scripts/copy-miniapps.js",

57 "build:miniapp:garage": "node scripts/build-miniapp.js garage",

58 "build:miniapp:address": "node scripts/build-miniapp.js address",

public/dist/domma.esm.jsView file

8patternName = generic_password severity = medium line = 8 matchedText = function...lt};

Medium

Secret Pattern

Package contains a possible secret pattern.

public/dist/domma.esm.jsView on unpkg · L8

bin/postinstall.jsView file

Lines 1-27javascript

1#!/usr/bin/env node

2

3/**

4 * Domma Postinstall Script

5 * Offers to copy AI assistance files to the project root

6 */

7

8import { existsSync, mkdirSync, copyFileSync, readdirSync, statSync, readFileSync, writeFileSync } from 'fs';

9import { join, dirname, resolve } from