registry / easypng / 1.0.0

easypng@1.0.0

Compress and convert PNG, JPEG, WebP, and AVIF images from the command line, the CLI companion to EasyPNG (https://amanghuman.com/easypng.html). Uses mozjpeg, pngquant-style palette quantization, libwebp, and libavif under the hood via sharp/libvips.

Static Scan Results

scanned 5h ago · by rust-scanner

Static analysis flagged 4 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

Filesystem

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 9.26 KB of source, external domains: amanghuman.com

Source & flagged code

1 flagged

bin/easypng.jsView file

Lines 175-215javascript

175 }));

176 } catch (err) {

177 console.error(`easypng: ${err.message}`);

178 process.exit(1);

179 }

180

181 if (values.version) {

182 console.log(VERSION);

183 return;

184 }

185 if (values.help) {

186 printHelp();

187 return;

188 }

189 if (positionals.length === 0) {

190 printHelp();

191 process.exit(1);

192 }

193

194 let sharp;

195 try {

196 sharp = require('sharp');

197 } catch (err) {

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

bin/easypng.jsView on unpkg · L195

198 console.error('easypng: the "sharp" dependency is not installed. Run `npm install` in this package first.');

199 process.exit(1);

200 }

201

202 const format = values.format;

203 if (!['original', 'png', 'jpeg', 'webp', 'avif'].includes(format)) {

204 console.error(`easypng: invalid --format "${format}". Use png, jpeg, webp, avif, or original.`);

205 process.exit(1);

206 }

207 const quality = Math.max(1, Math.min(100, parseInt(values.quality, 10) || 75));

208 const colors = Math.max(0, Math.min(256, parseInt(values.colors, 10)));

209 const targetSizeKb = values['target-size'] ? parseFloat(values['target-size']) : null;

210 let resize;

211 try {

212 resize = parseResize(values.resize);

213 } catch (err) {

214 console.error(`easypng: ${err.message}`);

215 process.exit(1);

Source & flagged code

1 flagged · loading source

bin/easypng.jsView file

195package = easypng; repositoryIdentity = amanghuman; dependency = sharp L195: try { L196: sharp = require('sharp'); L197: } catch (err) {

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code