registry / electron-magickwand / 0.0.2

electron-magickwand@0.0.2

JavaScript and TypeScript bindings for ImageMagick-7 - electron

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsTelemetry

ManifestNo manifest risk signals triggered.

scanned 16 file(s), 46.1 KB of source

Source & flagged code

7 flagged

package.jsonView file

Lines 24-65json

24 },

25 "./wasm/worker": {

26 "default": "./lib/binding/emscripten-wasm32/magickwand.worker.js"

27 },

28 "./wasm/wasm": {

29 "default": "./lib/binding/emscripten-wasm32/magickwand.wasm"

30 },

31 "./policy-limited.xml": "./deps/ImageMagick/config/policy-limited.xml",

32 "./policy-open.xml": "./deps/ImageMagick/config/policy-open.xml",

33 "./policy-secure.xml": "./deps/ImageMagick/config/policy-secure.xml",

34 "./policy-websafe.xml": "./deps/ImageMagick/config/policy-websafe.xml"

35 },

36 "bin": {

37 "magick": "scripts/cli.cjs"

38 },

39 "workspaces": [

40 ".",

41 "test"

42 ],

43 "scripts": {

44 "preinstall": "npx @mmomtchev/xpm run npm-preinstall",

45 "install": "npx xpm run npm-install",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L44

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L44

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L45

46 "postinstall": "node scripts/write-swig-sources.cjs",

47 "build": "node-gyp configure && node-gyp build",

48 "generate-bindings": "node scripts/generate-bindings.cjs",

49 "generate-bindings:force": "node scripts/generate-bindings.cjs --force",

50 "lint": "npx eslint",

51 "test": "npm test -w test",

52 "test:integration": "npm run test:integration -w test",

53 "preversion": "npm run lint && npm run test",

54 "postversion": "git push && git push --tags && node ./scripts/publish-packages.mjs",

55 "postpublish": "gh workflow run test-package.yml -F package=magickwand.js@$npm_package_version",

56 "example:browser": "cd example/browser/webpack && npx webpack-cli serve --mode=development --env development",

57 "demo:start": "cd example/browser/demo && npx webpack-cli serve --mode=development --env development",

58 "demo:build": "cd example/browser/demo && npx webpack --mode production",

59 "demo:deploy": "cd example/browser/demo/dist && tar -zcf - . | ssh magickwand@orel.garga.net 'tar -C www -zxvf -'"

60 },

61 "keywords": [

62 "imagemagick",

63 "magick",

64 "image",

65 "resize",

swig/magickwand-js.cjsView file

Lines 1-35javascript

1/* ----------------------------------------------------------------------------

2 * This file was automatically generated by SWIG JSE (https://www.swig.org).

3 * Version 5.0.12

4 *

5 * Do not make changes to this file unless you know what you are doing - modify

6 * the SWIG interface file instead.

7 * ----------------------------------------------------------------------------- */

9/* ---------------------------------------------------------------------------

10 * SWIG Node-API runtime : module exports

11 *

test/MakefileView file

•path = test/Makefile kind = payload_in_excluded_dir sizeBytes = 240 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

test/MakefileView on unpkg

•path = test/Makefile kind = build_helper sizeBytes = 240 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

test/MakefileView on unpkg

deps/ImageMagick/config/cmyk.icmView file

•path = deps/ImageMagick/config/cmyk.icm kind = high_entropy_blob sizeBytes = 961644 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

deps/ImageMagick/config/cmyk.icmView on unpkg

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.preinstall = npx @mmomtchev/xpm run npm-preinstall

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.preinstall = npx @mmomtchev/xpm run npm-preinstall

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

•scripts.install = npx xpm run npm-install

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

swig/magickwand-js.cjsView file

15L16: var dll = require('../native/index.cjs'); L17: var {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

swig/magickwand-js.cjsView on unpkg · L15

test/MakefileView file

•path = test/Makefile kind = payload_in_excluded_dir sizeBytes = 240 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

test/MakefileView on unpkg

•path = test/Makefile kind = build_helper sizeBytes = 240 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

test/MakefileView on unpkg

deps/ImageMagick/config/cmyk.icmView file

•path = deps/ImageMagick/config/cmyk.icm kind = high_entropy_blob sizeBytes = 961644 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

deps/ImageMagick/config/cmyk.icmView on unpkg

Findings

3 High7 Medium4 Low

HighInstall Time Lifecycle Scriptspackage.json

HighShips High Entropy Blobdeps/ImageMagick/config/cmyk.icm

HighPayload In Excluded Dirtest/Makefile

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requireswig/magickwand-js.cjs

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helpertest/Makefile

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

Source & flagged code

7 flagged

package.jsonView file

Lines 24-65json

24 },

25 "./wasm/worker": {

26 "default": "./lib/binding/emscripten-wasm32/magickwand.worker.js"

27 },

28 "./wasm/wasm": {

29 "default": "./lib/binding/emscripten-wasm32/magickwand.wasm"

30 },

31 "./policy-limited.xml": "./deps/ImageMagick/config/policy-limited.xml",

32 "./policy-open.xml": "./deps/ImageMagick/config/policy-open.xml",

33 "./policy-secure.xml": "./deps/ImageMagick/config/policy-secure.xml",

34 "./policy-websafe.xml": "./deps/ImageMagick/config/policy-websafe.xml"

35 },

36 "bin": {

37 "magick": "scripts/cli.cjs"

38 },

39 "workspaces": [

40 ".",

41 "test"

42 ],

43 "scripts": {

44 "preinstall": "npx @mmomtchev/xpm run npm-preinstall",

45 "install": "npx xpm run npm-install",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L44

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L44

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L45

46 "postinstall": "node scripts/write-swig-sources.cjs",

47 "build": "node-gyp configure && node-gyp build",

48 "generate-bindings": "node scripts/generate-bindings.cjs",

49 "generate-bindings:force": "node scripts/generate-bindings.cjs --force",

50 "lint": "npx eslint",

51 "test": "npm test -w test",

52 "test:integration": "npm run test:integration -w test",

53 "preversion": "npm run lint && npm run test",

54 "postversion": "git push && git push --tags && node ./scripts/publish-packages.mjs",

55 "postpublish": "gh workflow run test-package.yml -F package=magickwand.js@$npm_package_version",

56 "example:browser": "cd example/browser/webpack && npx webpack-cli serve --mode=development --env development",

57 "demo:start": "cd example/browser/demo && npx webpack-cli serve --mode=development --env development",

58 "demo:build": "cd example/browser/demo && npx webpack --mode production",

59 "demo:deploy": "cd example/browser/demo/dist && tar -zcf - . | ssh magickwand@orel.garga.net 'tar -C www -zxvf -'"

60 },

61 "keywords": [

62 "imagemagick",

63 "magick",

64 "image",

65 "resize",

swig/magickwand-js.cjsView file

Lines 1-35javascript

1/* ----------------------------------------------------------------------------

2 * This file was automatically generated by SWIG JSE (https://www.swig.org).

3 * Version 5.0.12

4 *

5 * Do not make changes to this file unless you know what you are doing - modify

6 * the SWIG interface file instead.

7 * ----------------------------------------------------------------------------- */

9/* ---------------------------------------------------------------------------

10 * SWIG Node-API runtime : module exports

11 *

test/MakefileView file

•path = test/Makefile kind = payload_in_excluded_dir sizeBytes = 240 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

test/MakefileView on unpkg

•path = test/Makefile kind = build_helper sizeBytes = 240 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

test/MakefileView on unpkg

deps/ImageMagick/config/cmyk.icmView file

•path = deps/ImageMagick/config/cmyk.icm kind = high_entropy_blob sizeBytes = 961644 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

deps/ImageMagick/config/cmyk.icmView on unpkg